Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
3
1
1
Contributors
5
Categories
20,425
11,812
5,870
5,145
4,864
Platforms
2
2
1
1
Products / Services
1
1
1
1
1
MITRE Techniques
3
3
3
2
2
CVEs
2
1
1
IDS Classtypes
3
IDS Protocols
2
1
Detects external scanning and connection attempts against internet-exposed macOS Screen Sharing (port 5900), including mass scanning and coordinated multi-source probing, with an allowlist for known internal scanners.
Detects completed RFB/VNC protocol handshakes to internal macOS Screen Sharing hosts (TCP/5900) from external networks, thresholded to separate reconnaissance/scanning from single stray connections. Early-warning exposure signal for CVE-2026-65400 targeting.
Detects accounts authenticating from compromised webmail/CMS infrastructure that pivot, within a tight time window and matching source IP, to authenticate against internal virtualization-management systems — the lateral-movement pattern Jewelbug used to reach a national webmail estate's backing infrastructure.
Detects the Hermes Agent/DeepSeek autonomous CVE-research pivot pattern — proxy traffic showing both a GitHub trending-PoC search sorted by stars and a CVSS/exploitability scoring pipeline query, indicating autonomous vulnerability research and target re-selection after a failed exploitation attempt.
Detects high-volume, threshold-based scanning/exploitation attempts against the WordPress REST API batch endpoint from a single source, consistent with mass wp2shell PoC-driven exploitation.