Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
461 detections
Filters
Last updated
All Time
Detection languages
459
2
Contributors
132
104
86
64
24
Categories
408
390
281
37
35
Platforms
404
80
43
24
6
Products / Services
446
282
21
18
15
MITRE Techniques
320
196
58
43
30
CVEs
15
9
8
7
7
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
452
3
1
1
This rule detects attempts to exploit an insecure deserialization vulnerability (CVE-2025-53690) in Sitecore Experience Platform via exposed ASP.NET MachineKeys. It specifically looks for HTTP POST requests to '/sitecore/blocked.aspx' containing a '__VIEWSTATE' parameter with a highly encoded string, indicative of a crafted ViewState payload used in deserialization attacks.
ET WEB_SPECIFIC_APPS Oracle E-Business Suite (EBS) Template Manager Template Copy (CVE-2025-61882)
This rule detects an attempt to exploit a critical vulnerability (CVE-2025-31324) in SAP NetWeaver Visual Composer's Metadata Uploader. The exploit leverages unauthenticated HTTP GET or HEAD requests to the '/developmentserver/metadatauploader' URI, combined with specific characters in the URI parameters (semicolon, dollar sign, backtick, pipe, or their URL-encoded equivalents) that indicate an attempt to execute arbitrary commands. This vulnerability allows an unauthenticated attacker to achieve remote command execution on the affected SAP system.
ET WEB_SPECIFIC_APPS Oracle E-Business Suite (EBS) Unauthenticated Template Manager Template Preview (CVE-2025-61882)
ET WEB_SPECIFIC_APPS Oracle E-Business Suite (EBS) Template Manager Template File Add (CVE-2025-61882)
This rule detects an attempted exploitation of an insecure deserialization vulnerability (CVE-2025-10035) in Fortra GoAnywhere MFT. Specifically, it looks for HTTP POST requests to the '/goanywhere/lic/accept/' URI containing the string 'bundle=' in the request body, which is indicative of an attempt to trigger the vulnerability.
This rule detects attempts to exploit CVE-2021-20021, an unauthenticated arbitrary user creation vulnerability in SonicWall Email Security. The rule specifically looks for HTTP POST requests to the '/createou' URI with 'data=' in the request body, indicating an attempt to create a new organizational unit or user.
ET WEB_SPECIFIC_APPS Django Privilege Escalation via SQLi (CVE-2025-64459)
ET WEB_SPECIFIC_APPS Django Authentication Bypass via SQLi (CVE-2025-64459)
ET WEB_SPECIFIC_APPS Wordpress Post SMTP Plugin Unauthenticated Account Takeover via Email Log Disclosure (CVE-2025-11833)
ET WEB_SPECIFIC_APPS Django Data Exfiltration via SQLi (CVE-2025-64459)
ET WEB_SPECIFIC_APPS Nagios Log Server API Unauthorized Access to Elasticsearch Service (CVE-2025-44824)
This rule detects attempts to exploit a deserialization vulnerability (CVE-2018-8421) in Microsoft SharePoint via a crafted workflow. The detection specifically looks for HTTP POST requests to the `/_vti_bin/webpartpages.asmx` endpoint containing `ValidateWorkflowMarkupAndCreateSupportObjects` and `workflowMarkupText` with CDATA, indicating an attempt to inject malicious XML.
This rule detects attempts to exploit CVE-2021-20021, an unauthenticated arbitrary user creation vulnerability in SonicWall Email Security. The detection is based on HTTP GET requests to the '/createou' URI containing 'data=' in the request body, which is indicative of an exploitation attempt.
ET WEB_SPECIFIC_APPS Monsta FTP Server Side Request Forgery Attempt (CVE-2022-31827)
ET WEB_SPECIFIC_APPS Cacti links.php Multiple Parameters Cross Site Scripting Attempt (CVE-2024-43362, CVE-2024-43364)
ET WEB_SPECIFIC_APPS IPFire urlfilter.cgi QUOTA_USERS Parameter Cross Site Scripting Attempt (CVE-2025-34313)
ET WEB_SPECIFIC_APPS IPFire ids.cgi IGNORE_ENTRY_REMARK Parameter Cross Site Scripting Attempt (CVE-2025-34303)
ET WEB_SPECIFIC_APPS IPFire fwhosts.cgi COUNTRY_CODE Parameter Cross Site Scripting Attempt (CVE-2025-34301)
ET WEB_SPECIFIC_APPS Adobe Coldfusion BlazeDS Java Object Deserialization Remote Code Execution (CVE-2017-3066)
ET WEB_SPECIFIC_APPS Tenda DatabaseiniSet Time Parameter Buffer Overflow Attempt (CVE-2025-12618)
Page 19 of 22