Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
Detects a potential automated exploit sweep or brute-force attempt, identified by a high frequency of HTTP requests (GET or POST) directed to the same URI from a single source IP address within a short time frame.
Detects inbound HTTP POST requests directed at common paths associated with self-hosted OpenAI-compatible LLM inference APIs, such as LocalAI or vLLM. This rule identifies potentially unauthorized or unintended public exposure of internal LLM infrastructure, which could lead to unauthorized model usage, information disclosure, or exploitation of the inference engine.
Detects a suspicious sequence of events where a known web server process (e.g., IIS, Nginx, Apache) spawns a command shell process, followed shortly by the creation of a file with a web shell-like extension (.aspx, .jsp, .php) in the same environment. This pattern is indicative of an adversary exploiting a public-facing application to upload and potentially access a web shell.
Detects anomalous access to the SharePoint WebPartPages.asmx SOAP endpoint, specifically using the GetWebPartPageConnectionInfo method. This query identifies patterns consistent with the exploitation of CVE-2026-65660, where adversaries attempt to smuggle WebPart template markup (e.g., <%@ Register, XamlServices) after legitimate preview methods have been disabled.
Detects a suspicious sequence of events where a common internet-facing server process (e.g., w3wp.exe, nginx.exe) spawns a potentially malicious child process (e.g., cmd.exe, powershell.exe), followed shortly thereafter by mass file modifications on the same host, which is characteristic of ransomware behavior following initial exploitation.
Detects a suspicious sequence of events where a common internet-facing server process (e.g., w3wp.exe, nginx.exe) spawns a potentially malicious child process (e.g., cmd.exe, powershell.exe), followed shortly thereafter by mass file modifications on the same host, which is characteristic of ransomware behavior following initial exploitation.
Detects Server-Side Request Forgery (SSRF) attempts targeting SonicWall SMA1000 WorkPlace endpoints. The rule monitors both HTTP GET query parameters and HTTP request bodies for patterns indicating attempts to redirect the application to internal loopback addresses or local network ranges (e.g., 127.0.0.1, 169.254.169.254, RFC1918 private subnets).
This rule detects an exploitation attempt targeting the ConnectWise ScreenConnect Path Traversal vulnerability (CVE-2024-1708). The detection monitors incoming HTTP traffic for attempts to traverse the file system by inspecting the URI for repeated '..' sequences within the '/App_Extensions/' directory, a hallmark of this vulnerability.
Detects activity from known Storm-3168 (JADEPUFFER) campaign IP addresses across Azure control-plane, sign-in, and App Service logs. The rule monitors for malicious indicators in Azure Activity logs, Azure Sign-in logs, and Service Principal sign-ins, as well as specific sensitive URI paths (e.g., shells, admin login paths) within App Service HTTP logs.
Detects activity from known Storm-3168 (JADEPUFFER) campaign IP addresses across Azure control-plane, sign-in, and App Service logs. The rule monitors for malicious indicators in Azure Activity logs, Azure Sign-in logs, and Service Principal sign-ins, as well as specific sensitive URI paths (e.g., shells, admin login paths) within App Service HTTP logs.
Identifies NetScaler ADC or Gateway software versions in the inventory that are known to be vulnerable to CVE-2026-88771 and CVE-2026-88772, despite having received the patch for CVE-2026-19490.
Detects web requests targeting Oracle PeopleSoft Integration Broker (PSIGW) endpoints that contain suspicious query parameters associated with exploitation attempts, such as path traversal sequences, command injection patterns, or Java-based class invocations. This rule is designed to identify exploitation attempts against PeopleSoft systems as observed in the mid-2026 ShinyHunters zero-day campaign.
Detects anomalous child processes, such as shells or interpreters, spawned by web server processes (PHP-FPM, Apache, Nginx). This behavior is often indicative of exploitation attempts, such as Remote Code Execution (RCE) via web application vulnerabilities.
Detects a sequence of potentially malicious activity targeting LLM-related API endpoints. The rule identifies a client IP performing rapid, distinct endpoint discovery, followed by a POST request to sensitive paths, and concluding with a spike in 5xx server-side errors, indicating potential exploitation attempts or fuzzing against Large Language Model interfaces.
This rule detects attempts to exploit a pre-authentication path traversal and unsafe file-upload vulnerability (CVE-2026-93616) in Check Point Management Server. It monitors web server logs for specific application-level error messages related to ReflectionUtils failure and suspicious path traversal sequences (../) in request URLs.
Detects instances where the Ivanti Sentry service process spawns suspicious child processes (shells, network utilities, or interpreters) while running with root privileges. This behavior is indicative of exploitation of CVE-2026-10520, an OS command injection vulnerability in Ivanti Sentry that enables unauthenticated remote code execution with root permissions.
Detects unauthorized HTTP requests to sensitive Cisco Identity Services Engine (ISE) API and administrative paths (/ers/, /admin/, /api/). The rule specifically looks for incoming requests that lack both an Authorization header and a Cookie header, which is indicative of potential exploitation attempts against vulnerabilities such as CVE-2026-76460, where authentication mechanisms might be bypassed or ignored.
Detects evidence of indirect prompt injection attacks where an adversary introduces malicious instructions into data sources retrieved by an LLM or agent. The rule identifies common obfuscation and override techniques, including the use of zero-width characters, HTML comments for prompt breaking, base64 encoded instruction verbs, and specific override phrases within retrieved documents or tool outputs.
Detects the execution of suspicious child processes (e.g., cmd.exe, powershell.exe, bash, wget) spawned by processes associated with public-facing appliances like Fortinet SSL-VPN, Veeam Backup & Replication, Citrix ADC, and cPanel/WHM. This behavior is often indicative of exploitation of public-facing applications (T1190) for initial access, frequently associated with ransomware actors targeting unpatched infrastructure.
Detects web application server processes (such as IIS, Apache, Tomcat, Java, Nginx, or Node.js) spawning command-line interpreters or system utilities. This behavior is frequently associated with webshell execution or post-exploitation activities following the exploitation of a public-facing application, often seen in VPN or enterprise software compromises.
Detects network exploitation attempts targeting Fortinet FortiOS and FortiProxy vulnerabilities (CVE-2024-55591, CVE-2025-24472) involving authentication bypass via HTTP header manipulation (Forwarded, X-Forwarded-For) and unauthorized access to the /jsconsole endpoint.
Page 11 of 102