Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
461 detections
Filters
Last updated
All Time
Detection languages
459
2
Contributors
132
104
86
64
24
Categories
408
390
281
37
35
Platforms
404
80
43
24
6
Products / Services
446
282
21
18
15
MITRE Techniques
320
196
58
43
30
CVEs
15
9
8
7
7
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
452
3
1
1
Detects an exploitation attempt against the Vite Development Server (CVE-2026-39364) where an attacker uses specific query parameters to bypass file access restrictions and disclose sensitive files. The rule triggers on GET requests containing suspicious import-related query parameters and checks the resulting response to ensure a successful 200/206 status code and non-HTML content type.
Detects an exploitation attempt against the Vite Development Server (CVE-2026-39364) where an attacker uses specific query parameters to bypass file access restrictions and disclose sensitive files. The rule triggers on GET requests containing suspicious import-related query parameters and checks the resulting response to ensure a successful 200/206 status code and non-HTML content type.
Detects incoming HTTP requests attempting to exploit a path traversal vulnerability in the GitLab Commits API (CVE-2026-85706). The rule looks for URI patterns containing directory traversal sequences (e.g., ../) targeting the repository commits endpoint.
Detects HTTP POST requests to a Gitea repository's diffpatch API endpoint whose body contains both a real git diff header and the malicious 'hooks/post-index-change' file path used by the CVE-2026-60004 exploit chain to plant an executable Git hook via an add/add merge collision.
Detects HTTP POST requests to a Gitea repository's diffpatch API endpoint whose body contains both a real git diff header and the malicious 'hooks/post-index-change' file path used by the CVE-2026-60004 exploit chain to plant an executable Git hook via an add/add merge collision.
Detects high-frequency POST requests to the JFrog Artifactory '/access/api/v1/tokens' endpoint, which is indicative of mass exploitation attempts targeting vulnerabilities (CVE-2026-82329) against administrative token management.
This rule detects SQL injection attempts targeting the BuddyBoss members REST endpoint, specifically identifying exploitation patterns associated with the 'sqlmap' tool. The rule monitors for specific URL parameters including 'member_type', 'search_terms', and 'scope' in combination with an 'sqlmap' user-agent, indicating an automated exploitation attempt against the application.
Detects path traversal attempts against a Vite development server by monitoring for various forms of URI encoding (single/double) and suspicious path patterns (e.g., /etc/passwd, .env, .git/config, /@fs/). The rule tracks these attempts using flowbits and alerts when a successful HTTP 200 response is received after a matching traversal request.
Detects path traversal attempts against a Vite development server by monitoring for various forms of URI encoding (single/double) and suspicious path patterns (e.g., /etc/passwd, .env, .git/config, /@fs/). The rule tracks these attempts using flowbits and alerts when a successful HTTP 200 response is received after a matching traversal request.
Detects attempts to access sensitive files like environment variables (.env), cloud provider credentials (AWS/Azure), or Terraform state files via a web server interface, specifically targeting Vite development server deployments.
Detects an exploitation attempt against the Vite Development Server (CVE-2026-39364) where an attacker uses specific query parameters to bypass file access restrictions and disclose sensitive files. The rule triggers on GET requests containing suspicious import-related query parameters and checks the resulting response to ensure a successful 200/206 status code and non-HTML content type.
Detects an exploitation attempt against the Vite Development Server (CVE-2026-39364) where an attacker uses specific query parameters to bypass file access restrictions and disclose sensitive files. The rule triggers on GET requests containing suspicious import-related query parameters and checks the resulting response to ensure a successful 200/206 status code and non-HTML content type.
Detects HTTP requests containing malicious JDBC strings targeting PaperCut NG/MF print management software, which are indicative of attempts to exploit authentication bypass and remote code execution vulnerabilities (CVE-2026-81578, CVE-2026-82078).
Detects indicators of cross-site scripting (XSS) attacks aimed at stealing web session cookies. The rule covers the injection of malicious scripts into client responses, anomalous CORS preflight responses that could facilitate data exfiltration, and subsequent HTTP callbacks or beaconing containing cookie data to external endpoints.
Detects incoming HTTP requests attempting to exploit a path traversal vulnerability in the GitLab Commits API (CVE-2026-85706). The rule looks for URI patterns containing directory traversal sequences (e.g., ../) targeting the repository commits endpoint.
Detects attempts to bypass authentication on Nacos servers, including the use of spoofed Nacos-Server User-Agent headers, suspicious API query patterns missing required access tokens, and the subsequent use of forged JWT tokens signed with default keys.
Detects attempts to bypass authentication on Nacos servers, including the use of spoofed Nacos-Server User-Agent headers, suspicious API query patterns missing required access tokens, and the subsequent use of forged JWT tokens signed with default keys.
Detects attempts to bypass authentication on Nacos servers, including the use of spoofed Nacos-Server User-Agent headers, suspicious API query patterns missing required access tokens, and the subsequent use of forged JWT tokens signed with default keys.
This rule monitors incoming HTTP requests for the use of PHP stream wrappers (e.g., php://, data://, expect://, etc.). Such wrappers are often leveraged by adversaries to perform Local File Inclusion (LFI) or to achieve Remote Code Execution (RCE) by manipulating input parameters in vulnerable web applications.
This rule detects potential OS command injection attempts in HTTP request parameters by monitoring for common shell command separators and subsequent execution of suspicious system binaries (e.g., sh, bash, curl, wget, python).
Detects HTTP POST requests to a Gitea repository's diffpatch API endpoint whose body contains both a real git diff header and the malicious 'hooks/post-index-change' file path used by the CVE-2026-60004 exploit chain to plant an executable Git hook via an add/add merge collision.
Page 6 of 22