Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10 detections
Filters
Last updated
All Time
Detection languages
4
2
2
1
1
Contributors
3
2
1
1
1
Categories
6
5
4
4
1
Platforms
4
3
1
1
Products / Services
4
1
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
1
1
1
Detects network connections to known malicious domains or IP addresses associated with Fortinet or Ivanti VPN phishing campaigns or command and control infrastructure. This rule identifies attempts to connect to fake VPN portals or communicate with adversary-controlled servers.
This rule detects attempts to access a known vulnerable endpoint in Ivanti Sentry appliances, specifically '/mics/api/v2/sentry/mics-config/handleMessage', via an HTTP POST request. This activity is indicative of exploitation attempts related to CVE-2026-10520, which is a pre-authentication OS command injection vulnerability.
Matches published GRIMBOLT/SLAYSTYLE/BRICKSTORM hashes from RecoverPoint VM intrusions.
This rule detects the creation of specific JSP web shell filenames (1.jsp, 401.jsp, 403.jsp) and suspicious CSS files in the Ivanti EPMM web application directory. This activity is indicative of post-exploitation persistence following the exploitation of vulnerabilities like CVE-2026-1281 or CVE-2026-1340.
Detects HTTP requests containing the specific parameter 'k0f53cf964d387' in the query string or POST body. This parameter is the unique trigger used to activate the dormant 'base.Info' in-memory loader on vulnerable Ivanti EPMM instances.
BRICKSTORM malware is a backdoor with multiple capabilities that theat actors use to set up persistence on exploited systems.
Detects potential BRICKSTORM C2 activity. This rule identifies processes initiating a WebSocket connection over HTTPS, which is a technique used by BRICKSTORM for its command and control channel. The rule filters for processes that lack file metadata, a common characteristic of Go-based malware like BRICKSTORM.
Detects potential BRICKSTORM C2 activity. This rule identifies processes initiating a WebSocket connection over HTTPS, which is a technique used by BRICKSTORM for its command and control channel. The rule filters for processes that lack file metadata, a common characteristic of Go-based malware like BRICKSTORM.
Detects known file hashes and filenames associated with the BRICKSTORM backdoor as reported by Google/Mandiant in relation to UNC5221 activity.
Detects potential exploitation attempts against Ivanti Connect Secure devices for vulnerability CVE-2025-22457. This vulnerability is actively exploited in the wild. Attackers can send an abnormally long string composed of digits and periods in the 'X-Forwarded-For' HTTP header to trigger a stack-based buffer overflow, which can lead to remote code execution.