Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
ET WEB_SPECIFIC_APPS Oracle E-Business Suite (EBS) Template Manager Template File Add (CVE-2025-61882)
ET MALWARE LeakyStealer CnC Checkin
This rule detects an attempted exploitation of an insecure deserialization vulnerability (CVE-2025-10035) in Fortra GoAnywhere MFT. Specifically, it looks for HTTP POST requests to the '/goanywhere/lic/accept/' URI containing the string 'bundle=' in the request body, which is indicative of an attempt to trigger the vulnerability.
This rule detects HTTP POST requests to github.com's /login/device/code endpoint that contain a 'client_id=' in the request body. This pattern is indicative of a device code authentication flow, which could be leveraged in phishing attacks (device code phishing) to steal application access tokens.
This rule detects HTTP requests to the '.well-known/' directory that include common webshell file extensions (php, cfm, cgi, asp, aspx, jsp, rb, sh, py, pl). This activity is suspicious as the '.well-known/' directory is typically used for standardized metadata files (e.g., for ACME challenges, security.txt) and not for executable scripts. The rule specifically excludes requests from 'Let's Encrypt validation server' to reduce false positives.
This rule detects HTTP traffic originating from a client within the home network to an external Cloudflare tunneling service (specifically, domains ending in '.trycloudflare.com') where the User-Agent header indicates 'Microsoft-WebDAV-MiniRedir'. This combination suggests potential command and control activity or data exfiltration using WebDAV over a Cloudflare tunnel, often employed by adversaries to bypass network restrictions and obscure their infrastructure.
This rule detects attempts to retrieve PowerShell scripts (.ps1) from an external server using WebDAV (PROPFIND method) with a 'Microsoft-WebDAV-MiniRedir/' user agent. This activity is often associated with adversaries attempting to transfer tools or malicious scripts into a compromised environment.
This rule detects attempts to exploit CVE-2021-20021, an unauthenticated arbitrary user creation vulnerability in SonicWall Email Security. The rule specifically looks for HTTP POST requests to the '/createou' URI with 'data=' in the request body, indicating an attempt to create a new organizational unit or user.
This rule detects the 'Get-ScheduledTask' PowerShell cmdlet within the HTTP response body, specifically when the HTTP status code is 200. This could indicate an attacker enumerating scheduled tasks on a compromised system via a web-based command and control channel or data exfiltration.
ET MOBILE_MALWARE Android/TrickMo.Banker GET Config Request
This rule detects HTTP POST requests to github.com's /login/device/code endpoint containing a 'client_id=' parameter in the request body. This pattern is indicative of a device code authentication flow, which could be leveraged in phishing attacks (device code phishing) to steal application access tokens or facilitate unauthorized access to GitHub accounts.
This rule detects an attempted remote code execution (RCE) vulnerability in Microsoft SharePoint, specifically CVE-2024-38018. The detection is based on an HTTP POST request targeting the `/_vti_bin/webpartpages.asmx` URI with a specific content pattern in the request body: `|3c|AttachedPropertiesShared|3e 2f|wE`. This pattern indicates an attempt to exploit a deserialization vulnerability within SharePoint's SPThemes functionality.
ET WEB_SPECIFIC_APPS Django Privilege Escalation via SQLi (CVE-2025-64459)
ET WEB_SPECIFIC_APPS Django Authentication Bypass via SQLi (CVE-2025-64459)
ET WEB_SPECIFIC_APPS Wordpress Post SMTP Plugin Unauthenticated Account Takeover via Email Log Disclosure (CVE-2025-11833)
ET ATTACK_RESPONSE ClickFix MSHTA Command Inbound
ET WEB_SPECIFIC_APPS Django Data Exfiltration via SQLi (CVE-2025-64459)
ET WEB_SPECIFIC_APPS Nagios Log Server API Unauthorized Access to Elasticsearch Service (CVE-2025-44824)
This rule detects attempts to exploit a deserialization vulnerability (CVE-2018-8421) in Microsoft SharePoint via a crafted workflow. The detection specifically looks for HTTP POST requests to the `/_vti_bin/webpartpages.asmx` endpoint containing `ValidateWorkflowMarkupAndCreateSupportObjects` and `workflowMarkupText` with CDATA, indicating an attempt to inject malicious XML.
ET ATTACK_RESPONSE HTML Smuggling Powershell Payload In href
This rule detects HTTP requests to archive.org for image files (png, jpg, jpeg, svg, gif, tiff) that have minimal request headers, specifically lacking both 'User-Agent' and 'Referer' headers. This behavior can be indicative of automated tools or malware attempting to retrieve content while trying to evade detection or hide their origin.
Page 109 of 116