Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
461 detections
Filters
Last updated
All Time
Detection languages
459
2
Contributors
132
104
86
64
24
Categories
408
390
281
37
35
Platforms
404
80
43
24
6
Products / Services
446
282
21
18
15
MITRE Techniques
320
196
58
43
30
CVEs
15
9
8
7
7
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
452
3
1
1
This rule detects common Cross-Site Scripting (XSS) patterns within the HTTP URI, specifically looking for script tags, javascript: URI handlers, and common event handlers (onerror/onload) that are frequently used in XSS injection attacks.
This rule detects attempts to inject malicious JavaScript code via HTTP URI requests. It uses PCRE pattern matching to identify common XSS indicators such as <script> tags, JavaScript event handlers (onerror, onload), and attempts to access document.cookie, which are indicative of stored or reflected Cross-Site Scripting (XSS) attack patterns.
This rule detects HTTP requests attempting to perform Local File Inclusion (LFI) or path traversal attacks by searching for patterns such as '/../' sequences and common sensitive file paths like /etc/passwd, /etc/shadow, or /proc/self/environ in the URI.
Detects common SQL injection patterns within the HTTP URI query string. The rule monitors established network traffic to web servers and uses regex matching to identify attempts to use SQL keywords like UNION SELECT, OR 1=1 boolean-based attacks, blind SQL injection techniques (sleep/benchmark), and attempts to access information_schema metadata tables.
This rule detects potential Cross-Site Scripting (XSS) attack attempts by inspecting HTTP requests for common malicious patterns, such as embedded script tags, JavaScript URIs, or HTML event handlers like 'onload' and 'onerror'. These payloads are often used by attackers to execute arbitrary code within a user's browser session.
Detects classic SQL injection attack patterns within incoming HTTP requests, such as UNION SELECT statements, boolean-based tautologies (1=1), table dropping commands, or common URL-encoded quote characters.
Detects HTTP response bodies containing specific strings associated with the 'Montana Empire' phishing kit. This rule monitors for indicators that a web server is serving a phishing credential harvesting page.
This rule detects HTTP POST requests containing the specific string 'GEMINI_TRUST_WORKSPACE', which is associated with environment variable injection attacks targeting CI/CD pipeline configurations.
This rule detects potential Remote Code Execution (RCE) exploitation attempts targeting Dell Wyse Management Suite (WMS) by identifying abnormally large POST requests containing JSON payloads directed at specific management paths (/WMS/ or /wyse/). This behavior is indicative of an exploit attempt against CVE-2026-41120.
Detects the transmission of a Windows executable binary file in an HTTP response stream, which may indicate an attempt to exploit vulnerabilities in Dell Wyse Management Suite (CVE-2026-41120 or CVE-2026-49506) by delivering malicious payloads.
This rule detects attempts to access sensitive .env configuration files in Gemini CLI applications, which may indicate an attempt to exploit CVE-2026-12537. Attackers target these files to retrieve credentials or environment variables that could lead to Remote Code Execution (RCE) within CI/CD pipelines or deployment environments.
This rule detects attempts to exploit a path traversal vulnerability (CVE-2026-49506) in the Dell Wyse Management Suite API. The rule inspects HTTP requests for directory traversal sequences such as '..' or URL-encoded equivalents, which could allow an unauthorized attacker to access files or directories outside the intended scope on the web server.
Detects the transmission of a Windows executable binary file in an HTTP response stream, which may indicate an attempt to exploit vulnerabilities in Dell Wyse Management Suite (CVE-2026-41120 or CVE-2026-49506) by delivering malicious payloads.
This rule detects attempts to access sensitive .env configuration files in Gemini CLI applications, which may indicate an attempt to exploit CVE-2026-12537. Attackers target these files to retrieve credentials or environment variables that could lead to Remote Code Execution (RCE) within CI/CD pipelines or deployment environments.
Detects inbound HTTP requests containing the JNDI lookup string characteristic of attempts to exploit the Log4Shell vulnerability (CVE-2021-44228) in Java-based applications.
This rule detects repeated path traversal sequences (../ or ..%2F) in the HTTP URI. This behavior is indicative of an attacker attempting to escape the intended web directory to access sensitive files or configuration files on the underlying filesystem.
Detects network exploitation attempts related to the Log4j vulnerability (CVE-2021-44228), where an adversary sends an HTTP request containing a JNDI lookup string (e.g., ldap://, rmi://, dns://) designed to trigger a remote code execution via vulnerable Log4j libraries.
Detects common SQL injection attack patterns within HTTP URI or POST body traffic, such as UNION SELECT, tautologies (e.g., OR 1=1), schema enumeration, and database functions like benchmark or sleep.
This rule detects common Cross-Site Scripting (XSS) patterns within the HTTP URI, specifically looking for script tags, javascript: URI handlers, and common event handlers (onerror/onload) that are frequently used in XSS injection attacks.
This rule monitors incoming HTTP requests for classic SQL injection patterns, such as UNION SELECT, SLEEP, BENCHMARK, and various SQL commands like DROP or ALTER. These signatures are commonly associated with attempts to gain unauthorized access to database contents, exfiltrate data, or compromise the database integrity via web applications.
Detects attempts to exploit Apache Struts vulnerabilities by identifying OGNL (Object-Graph Navigation Language) expressions (starting with %{ or ${) within the Content-Type HTTP header, combined with requests to .action or .do endpoints.
Page 14 of 22