Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)
Detects potential OGNL Injection exploitation, which may lead to RCE.
OGNL is an expression language that is supported in many JVM based systems.
OGNL Injection is the reason for some high profile RCE's such as Apache Struts (CVE-2017-5638) and Confluence (CVE-2022-26134)
OGNL is an expression language that is supported in many JVM based systems.
OGNL Injection is the reason for some high profile RCE's such as Apache Struts (CVE-2017-5638) and Confluence (CVE-2022-26134)
Detects process execution related errors in NodeJS. If the exceptions are caused due to user input then they may suggest an RCE vulnerability.
Detects potential local file read vulnerability in JVM based apps.
If the exceptions are caused due to user input and contain path traversal payloads then it's a red flag.
If the exceptions are caused due to user input and contain path traversal payloads then it's a red flag.
Detects process execution related exceptions in JVM based apps, often relates to RCE
Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE.
Java Payload Strings
Sigma
Detects possible Java payloads in web access logs
Detects path traversal exploitation attempts
Detects potential JNDI Injection exploitation. Often coupled with Log4Shell exploitation.
Detects XML parsing issues, if the application expects to work with XML make sure that the parser is initialized safely.
Detects SQL error messages that indicate probing for an injection attack
Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell.
SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
Detects an issue in apache logs that reports threading related errors
Detects potential SQL injection attempts via GET requests in access logs.
Detects suspicious file type dropped by an Exchange component in IIS
Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which could be a sign of ProxyShell exploitation
Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.
Detects suspicious Django web application framework exceptions that could indicate exploitation attempts
Generic rule for SQL exceptions in Python according to PEP 249
Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts
Detects suspicious Spring framework exceptions that could indicate exploitation attempts
Page 101 of 102