Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
461 detections
Filters
Last updated
All Time
Detection languages
459
2
Contributors
132
104
86
64
24
Categories
408
390
281
37
35
Platforms
404
80
43
24
6
Products / Services
446
282
21
18
15
MITRE Techniques
320
196
58
43
30
CVEs
15
9
8
7
7
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
452
3
1
1
Detects HTTP GET requests to network appliance management interfaces containing query parameters commonly used to trigger remote command or shell execution (e.g., cmd, exec, shell, command), which is characteristic of web shell activity.
This rule detects malicious HTTP POST requests attempting a path traversal attack against Grav CMS, specifically targeting the __unique_form_id__ parameter. The rule looks for directory traversal sequences ('..') following the parameter, which is characteristic of attempts to read sensitive files outside the intended web directory.
This rule detects HTTP POST requests to .php files containing suspicious PHP execution functions in the request body, such as 'system', 'eval', or 'shell_exec'. These patterns are indicative of an attempt to execute commands via an in-memory or injected PHP web shell on an F5 BIG-IP APM device.
Detects post-exploitation activity against Citrix NetScaler appliances associated with CVE-2026-8452. The rule specifically monitors for HTTP GET requests targeting PHP files within the /var/vpn/theme/ directory, accompanied by efforts to execute shell commands (bin/sh) via the web server.
Detects an exploitation attempt targeting SharePoint through the EditingPageParser by injecting a Register directive. This attempt involves bypassing SafeControls through specifically crafted HTTP POST requests to ToolPane.aspx, utilizing the GetPartPreviewAndPropertiesFromMarkup function to execute malicious tag patterns.
Detects HTTP POST requests directed at common Machine Learning inference endpoints (e.g., /predict, /classify, /infer) where the request body claims to be a multipart form-data image upload (Content-Type: image/jpeg) but the actual binary data does not contain the standard JPEG file signature (FF D8 FF). This pattern is indicative of adversarial attempts to bypass security controls or provide malformed payloads to ML models.
Detects attempts to exploit CVE-2026-48710 in Starlette frameworks where an attacker attempts to smuggle path or authority information via the HTTP Host header using character encoding variations like slashes or URL-encoded sequences.
Detects unauthenticated attempts to access Adobe Commerce/Magento REST API endpoints. This rule specifically looks for HTTP GET requests containing /rest/ and /V1/ paths without an Authorization header, which may indicate an attempt to exploit CVE-2026-71362.
This rule detects attempts to exploit a SQL injection vulnerability in Sangoma Switchvox (CVE-2026-9586) by inspecting HTTP POST request bodies and URIs for common SQL injection patterns such as UNION SELECT, SLEEP(), and DROP TABLE. This vulnerability allows an attacker to execute arbitrary SQL commands on the backend database.
This rule detects HTTP POST requests to the Apache Qpid Broker-J Management API that include a pre-set JSESSIONID in the cookie header during a login operation, indicating an attempt to exploit CVE-2026-92609 via session fixation.
Detects common SQL injection patterns (such as UNION SELECT, tautologies, sleep functions, and information_schema queries) within HTTP URI parameters and HTTP POST request bodies, which are indicative of an attempt to manipulate backend database queries.
This rule detects malicious HTTP POST requests attempting a path traversal attack against Grav CMS, specifically targeting the __unique_form_id__ parameter. The rule looks for directory traversal sequences ('..') following the parameter, which is characteristic of attempts to read sensitive files outside the intended web directory.
This rule detects HTTP requests where the User-Agent header indicates a PowerShell execution occurring from a system configured with the zh-CN locale. This pattern is often associated with automated scripts or potential malicious activity masquerading as legitimate PowerShell traffic.
Detects HTTP GET requests targeting the Vite Dev Server that include directory traversal sequences ('../') within the '/@fs/' endpoint. This pattern is indicative of an attempt to bypass root directory restrictions to access sensitive files on the server.
This rule detects inbound HTTP requests targeting Oracle PeopleSoft applications that contain malicious patterns indicative of Server-Side Request Forgery (SSRF) attempts. The rule inspects the URI for specific PeopleSoft application paths and suspicious redirection or internal IP address patterns (including internal cloud metadata addresses like 169.254.169.254) which are commonly used in SSRF attacks to probe or access internal resources.
This rule detects network traffic patterns associated with ARToken-style OAuth device code phishing attacks, specifically monitoring for initial backend requests to Cloudflare Workers infrastructure, response payloads containing known phishing template indicators, and subsequent polling activity against device code endpoints that indicate an active phishing session.
This rule detects malicious HTTP POST requests attempting a path traversal attack against Grav CMS, specifically targeting the __unique_form_id__ parameter. The rule looks for directory traversal sequences ('..') following the parameter, which is characteristic of attempts to read sensitive files outside the intended web directory.
This rule detects malicious HTTP POST requests attempting a path traversal attack against Grav CMS, specifically targeting the __unique_form_id__ parameter. The rule looks for directory traversal sequences ('..') following the parameter, which is characteristic of attempts to read sensitive files outside the intended web directory.
Detects SQL injection exploitation attempts against MOVEit Transfer targeting the CVE-2023-34362 vulnerability, followed by the deployment and subsequent interaction with the 'human2.aspx' webshell associated with Cl0p ransomware mass-exploitation campaigns.
This rule detects network traffic patterns associated with the ARToken phishing campaign, specifically identifying access to lure pages hosted on 'workers.dev' domains with 'docviewer' in the hostname and 'turnstile' challenge responses in the HTTP body, which is used for anti-analysis/evasion.
Detects HTTP requests containing malicious JDBC strings targeting PaperCut NG/MF print management software, which are indicative of attempts to exploit authentication bypass and remote code execution vulnerabilities (CVE-2026-81578, CVE-2026-82078).
Page 3 of 22