Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
24 detections
Filters
Last updated
All Time
Detection languages
11
9
2
2
Contributors
21
1
1
1
Categories
11
10
9
5
4
Platforms
10
9
7
4
2
Products / Services
14
8
2
2
2
MITRE Techniques
9
9
7
7
4
CVEs
71
71
64
58
49
24
IDS Classtypes
1
1
IDS Protocols
1
1
Detects successful passkey/WebAuthn authentication or signing events where the User Verification (UV) flag is unset/false or no UV assertion accompanies a device-key signature, scoped to relying parties/credentials where UV is policy-required, or corroborated by a missing biometric/user-presence event or a static (unchanged) signature counter. This reduces noise from relying parties or lower-risk contexts that legitimately do not require UV on every assertion.
Detects potential exploitation of Apache bRPC command injection vulnerability (CVE-2025-60021) via the /pprof/heap endpoint.
Detects attempts to exploit the Apache bRPC heap profiler command injection vulnerability, CVE-2025-60021. This is done by monitoring for HTTP GET requests to the `/pprof/heap` endpoint where the `extra_options` parameter contains shell metacharacters indicative of an RCE attempt.
Page 2 of 2