Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
365 detections
Filters
Last updated
All Time
Detection languages
171
77
40
29
16
Contributors
84
57
41
29
27
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
187
56
46
38
37
Products / Services
122
40
32
27
26
MITRE Techniques
335
181
98
79
78
CVEs
8
7
6
5
5
IDS Classtypes
5
1
IDS Protocols
4
2
Detects a burst of new user account creation activity on a self-hosted git repository instance. This pattern is indicative of unauthorized mass account creation, potentially following an initial compromise or exploitation, which is often a precursor to further malicious activities like persistent access or unauthorized code access.
Detects a burst of new user account creation activity on a self-hosted git repository instance. This pattern is indicative of unauthorized mass account creation, potentially following an initial compromise or exploitation, which is often a precursor to further malicious activities like persistent access or unauthorized code access.
Detects a burst of new user account creation activity on a self-hosted git repository instance. This pattern is indicative of unauthorized mass account creation, potentially following an initial compromise or exploitation, which is often a precursor to further malicious activities like persistent access or unauthorized code access.
Detects a burst of new user account creation activity on a self-hosted git repository instance. This pattern is indicative of unauthorized mass account creation, potentially following an initial compromise or exploitation, which is often a precursor to further malicious activities like persistent access or unauthorized code access.
Detects a burst of new user account creation activity on a self-hosted git repository instance. This pattern is indicative of unauthorized mass account creation, potentially following an initial compromise or exploitation, which is often a precursor to further malicious activities like persistent access or unauthorized code access.
This rule monitors for the creation or presence of a specific backdoor account (username 'p2pwn' and password 'p2password') on Dahua devices. This account is known to be injected by threat actors exploiting CVE-2024-39943 as part of Operation CameraSwarm to maintain persistent unauthorized access.
This rule detects the creation of a local user account using the 'net.exe' or 'net1.exe' utility where the command line contains a specific hardcoded password ('Numlock!123'). This pattern is indicative of automated or manual post-exploitation activities, such as creating a back-door account for persistent access.
This rule monitors for the execution of 'net.exe' or 'net1.exe' with command line arguments containing 'user', '/add', and a specific suspicious string 'Numlock!123'. This pattern is indicative of an adversary attempting to create a local user account on a Windows system using a hardcoded or known adversary credential.
Detects unauthorized creation of a WordPress administrator account through direct SQL injection or manual database modification by monitoring for insertions into the 'wp_users' table or modifications to the 'wp_usermeta' table with 'administrator' capabilities.
Detects the creation of known backdoor accounts 'p2pwn' or 'p2password' on Dahua devices, which are associated with the exploitation of CVE-2024-39943. This activity indicates an attacker attempting to establish persistent unauthorized access that may survive factory resets.
Detects user creation, capability granting, or role modification events occurring on WordPress sites where the Admin Menu Editor plugin (versions 2.35 or 2.36) is active and the associated user account has administrator privileges. This pattern is often indicative of exploitation of known vulnerabilities in this specific plugin to perform unauthorized administrative actions.
Detects administrator-privileged actions in JFrog Artifactory audit logs attributed to the 'token:anonymous' identity, the tell-tale signature left when CVE-2026-42018 (unauthenticated token retrieval) is chained with CVE-2026-42016 (privilege escalation) to mint an admin-scope token that retains the anonymous username. Also relevant to CVE-2026-82329 authentication bypass activity.
Detects the creation of a WordPress administrator account within one hour of a recorded web request to a known web shell path (Mushr00w) or suspect plugin upload directory. This correlation is a high-fidelity indicator of post-exploitation persistence and administrative account hijacking.
Detects the creation of an administrator-level user account in a WordPress environment within a one-hour window after the 'Admin Menu Editor Pro' plugin is updated to known trojanized versions (2.35 or 2.36), which is indicative of a backdoor installation.
Detects administrator-privileged actions in JFrog Artifactory audit logs attributed to the 'token:anonymous' identity, the tell-tale signature left when CVE-2026-42018 (unauthenticated token retrieval) is chained with CVE-2026-42016 (privilege escalation) to mint an admin-scope token that retains the anonymous username. Also relevant to CVE-2026-82329 authentication bypass activity.
Detects administrator-privileged actions in JFrog Artifactory audit logs attributed to the 'token:anonymous' identity, the tell-tale signature left when CVE-2026-42018 (unauthenticated token retrieval) is chained with CVE-2026-42016 (privilege escalation) to mint an admin-scope token that retains the anonymous username. Also relevant to CVE-2026-82329 authentication bypass activity.
Detects administrator-privileged actions in JFrog Artifactory audit logs attributed to the 'token:anonymous' identity, the tell-tale signature left when CVE-2026-42018 (unauthenticated token retrieval) is chained with CVE-2026-42016 (privilege escalation) to mint an admin-scope token that retains the anonymous username. Also relevant to CVE-2026-82329 authentication bypass activity.
Detects the creation of a WordPress administrator account within one hour of a recorded web request to a known web shell path (Mushr00w) or suspect plugin upload directory. This correlation is a high-fidelity indicator of post-exploitation persistence and administrative account hijacking.
Detects exploitation attempts against the WordPress LiteSpeed Cache plugin (CVE-2024-28000), including suspicious web requests involving ESI/crawler cookie hash manipulation, execution of known exploit binaries (wp28000, wp28000_cp), and subsequent unauthorized creation of administrator accounts via the WordPress REST API.
This rule monitors for the creation or presence of a specific backdoor account (username 'p2pwn' and password 'p2password') on Dahua devices. This account is known to be injected by threat actors exploiting CVE-2024-39943 as part of Operation CameraSwarm to maintain persistent unauthorized access.
Detects suspicious activity associated with the exploitation of a vulnerability in N-central (CVE-2026-86218). The rule monitors for unauthorized child process spawning by N-central components, creation of files in the application directory consistent with web shells, outbound network connections indicative of command and control, and the creation of new local or service accounts for persistence.
Page 4 of 18