Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
ET WEB_SPECIFIC_APPS D-Link hictlist_show.data enable Parameter Buffer Overflow Attempt
ET WEB_SPECIFIC_APPS D-Link dns_more_check.data enable Parameter Buffer Overflow Attempt
ET WEB_SPECIFIC_APPS D-Link ipportFilter sip_address Parameter Buffer Overflow Attempt (CVE-2023-43240)
ET MALWARE Observed VBScript Payload Downloader Inbound
ET MALWARE MEOWBACKCONN CnC Checkin - Server Response
ET ATTACK_RESPONSE Lumma Stealer Payload Inbound
ET ATTACK_RESPONSE Observed ClickFix Landing Page Inbound
ET ATTACK_RESPONSE ClickFix CnC Response (Click Logged Successfully)
ET ATTACK_RESPONSE Unknown Payload Downloader Inbound
ET ATTACK_RESPONSE Observed ClickFix Powershell Delivery Page Inbound
ET ATTACK_RESPONSE Observed ClickFix Powershell Delivery Page (Portuguese)
This rule detects the 'Stop-ScheduledTask' PowerShell cmdlet within the HTTP response body, indicating that a client on the internal network is receiving a command to stop a scheduled task. This could be part of an adversary's attempt to disable persistence mechanisms or disrupt system operations.
This rule detects HTTP traffic where the User-Agent string contains the case-insensitive substring 'iot'. This could indicate activity from Internet of Things (IoT) devices, potentially malicious botnet activity, or other suspicious automated traffic originating from or targeting IoT devices.
ET WEB_SPECIFIC_APPS IPFire dns.cgi TLS_HOSTNAME Parameter Cross Site Scripting Attempt (CVE-2025-34317)
ET WEB_SPECIFIC_APPS IPFire dnsforward.cgi REMARK Parameter Cross Site Scripting Attempt (CVE-2025-34305)
ET WEB_SPECIFIC_APPS IPFire weakeonlan.cgi CLIENT_COMMENT Parameter Cross Site Scripting Attempt (CVE-2025-34305)
ET WEB_SPECIFIC_APPS Tenda SafeClientFilter page Parameter Buffer Overflow Attempt (CVE-2025-12232)
ET WEB_SPECIFIC_APPS Tenda SetIpBind page Parameter Buffer Overflow Attempt (CVE-2025-12235)
ET WEB_SPECIFIC_APPS Draytek recvCMD Command Injection Attempt (CVE-2024-41585)
ET WEB_SPECIFIC_APPS Ilevia mbus_build_from_csv.php Multiple Parameters Command Injection Attempt (CVE-2025-34513)
ET WEB_SPECIFIC_APPS Brickcom syslog.dump action Parameter Information Disclosure Attempt (CVE-2017-9238)
Page 113 of 116