Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
This rule detects potentially malicious HTTP requests targeting Alibaba Nacos services. It specifically identifies requests that include 'accesstoken' parameters when accessing sensitive endpoints such as user management, login, or configuration modification paths. This pattern is commonly associated with unauthorized attempts to leverage known Nacos vulnerabilities for credential access or configuration manipulation.
Detects attempts to exploit an unauthenticated Remote Code Execution (RCE) vulnerability in Langflow via the /api/v1/validate/code endpoint. The rule monitors for POST requests containing Base64 encoded payloads or direct Python command-line execution patterns, which indicate an attempt to achieve arbitrary code execution.
Identifies Debian systems running vulnerable versions of the libheif package (versions 1.10.x through 1.21.x) that are susceptible to CVE-2026-32882. This rule uses software inventory data to detect installations requiring an upgrade to version 1.22.0 or higher.
Identifies Debian systems running vulnerable versions of the libheif package (versions 1.10.x through 1.21.x) that are susceptible to CVE-2026-32882. This rule uses software inventory data to detect installations requiring an upgrade to version 1.22.0 or higher.
This rule monitors Salesforce lead creation events for potential prompt-injection payloads. It identifies submissions containing common AI manipulation instructions, HTML tags, or suspicious outbound URLs, which could be used to hijack internal user sessions or execute malicious content within the Salesforce environment.
This rule monitors Salesforce lead creation events for potential prompt-injection payloads. It identifies submissions containing common AI manipulation instructions, HTML tags, or suspicious outbound URLs, which could be used to hijack internal user sessions or execute malicious content within the Salesforce environment.
This rule monitors Salesforce lead creation events for potential prompt-injection payloads. It identifies submissions containing common AI manipulation instructions, HTML tags, or suspicious outbound URLs, which could be used to hijack internal user sessions or execute malicious content within the Salesforce environment.
Detects unauthenticated access attempts or requests originating from system/service accounts targeting the PaperCut NG/MF administrative interface, which may indicate exploitation of authentication bypass vulnerabilities (e.g., CVE-2026-81578).
Detects alerts that reference specific CVEs historically exploited by the threat group QTFY against internet-facing applications, including common vulnerabilities in Pulse Secure, FortiOS, Citrix ADC, Exchange, F5 BIG-IP, Log4Shell, and others, when the alert severity is Medium or High and contains indicators of exploit or initial access.
Detects attempts to exploit the GitLab commits API via path traversal or direct file path manipulation to access sensitive configuration files or system secrets, such as gitlab-secrets.json, database.yml, or system files like /etc/passwd.
Detects HTTP requests containing malicious JDBC strings targeting PaperCut NG/MF print management software, which are indicative of attempts to exploit authentication bypass and remote code execution vulnerabilities (CVE-2026-81578, CVE-2026-82078).
Detects network traffic attempting to exploit CVE-2021-33044 in Dahua NetKeyboard devices. The rule identifies specifically crafted 'global.login' requests designed to bypass authentication mechanisms.
Detects high-frequency, unauthenticated probe requests targeting Dahua P2P relay endpoints (/probe/device/ and /online/p2psrv/). This activity is indicative of automated scanning, enumeration, or potential exploitation attempts related to CVE-2025-31702 against internet-facing or network-connected Dahua hardware.
Detects exploit attempts targeting the authentication bypass vulnerability in Dahua NetKeyboard devices (CVE-2021-33044) by monitoring HTTP requests containing malicious 'global.login' RPC parameters.
Detects unauthenticated HTTP POST requests targeting the FortiGate administrative API (/api/v2/), which may indicate exploitation attempts related to CVE-2025-25249. The rule specifically looks for requests lacking authentication headers (Cookie or Authorization).
Detects an attempt to exploit CVE-2026-24858 in FortiCloud SSO by sending a crafted SAML authentication request that lacks a signature. This vulnerability allows an attacker to bypass authentication by providing an unsigned SAML response.
Detects HTTP requests that use URL-encoded backslash traversal sequences
("..%5C") to walk out of a Next.js dynamic route and request the
"server-reference-manifest" file, which discloses the Server Action
encryption key. This is the reconnaissance/priming stage of CVE-2026-75604
RCE exploitation, observed against both the App Router and the Pages
Router ("/_next/data/<buildId>/.../server-reference-manifest.json").
("..%5C") to walk out of a Next.js dynamic route and request the
"server-reference-manifest" file, which discloses the Server Action
encryption key. This is the reconnaissance/priming stage of CVE-2026-75604
RCE exploitation, observed against both the App Router and the Pages
Router ("/_next/data/<buildId>/.../server-reference-manifest.json").
Detects potential zero-click administrator session hijacking by correlating a logged-in administrator accessing a page containing user-generated content (e.g., comments) followed immediately by a sensitive administrative action (e.g., plugin installation, user creation) within a 5-second window, suggesting automated script execution via an autofocus/onfocus handler triggered by the admin's browser.
Detects potential zero-click administrator session hijacking by correlating a logged-in administrator accessing a page containing user-generated content (e.g., comments) followed immediately by a sensitive administrative action (e.g., plugin installation, user creation) within a 5-second window, suggesting automated script execution via an autofocus/onfocus handler triggered by the admin's browser.
Detects potential zero-click administrator session hijacking by correlating a logged-in administrator accessing a page containing user-generated content (e.g., comments) followed immediately by a sensitive administrative action (e.g., plugin installation, user creation) within a 5-second window, suggesting automated script execution via an autofocus/onfocus handler triggered by the admin's browser.
Detects attempts to exploit a path traversal vulnerability in the GitLab commits API, specifically targeting the /api/v4/projects/ repository/commits path. The rule monitors for directory traversal patterns such as .. or url-encoded variations in conjunction with file paths, which could allow unauthorized access to files outside the intended directory.
Page 23 of 102