Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
This rule identifies instances of Cisco Secure Email Gateway (AsyncOS) running vulnerable versions that are susceptible to CVE-2026-76461. It parses the software inventory data to identify appliances within branches 15.5, 16.0, and 16.5, comparing the patch and build versions against the known secure release versions (15.5.5-0141, 16.0.4-302, 16.5.0-780).
Detects the spawning of suspicious processes like cmd, powershell, or certutil by the Exchange Server's web worker process (w3wp.exe), which is a common indicator of post-exploitation activity following an initial web vulnerability exploitation, such as ProxyLogon.
Detects suspicious child processes (cmd.exe, powershell.exe, java.exe) spawned by the PaperCut NG/MF server processes (pc-app.exe or java.exe), which is indicative of potential post-exploitation activity following remote code execution.
Detects high-volume, sequential HTTP requests directed at sensitive PaperCut NG/MF web interfaces from a single source IP address within a one-hour window. The high frequency of unique target access suggests automated scanning or exploitation attempts (consistent with CVE-2026-81578/CVE-2026-82078) typical of AI-driven or scripted attack campaigns.
Detects incoming HTTP requests to Microsoft Exchange servers that match patterns indicative of exploitation attempts for the ProxyLogon SSRF vulnerability (CVE-2021-26855). This includes detecting specific manipulation of the Autodiscover service and the injection of X-BEResource or X-AnonResource-Backend headers, which were commonly used during the initial access phase of this campaign.
Detects unauthenticated requests to the WordPress admin-ajax.php endpoint utilizing the 'super_create_nonce' action. This action allows an unauthenticated user to generate a valid session nonce, which is a critical bypass mechanism often required for the exploitation of vulnerabilities within the Super Forms plugin, such as CVE-2026-14894.
Detects web requests to 'wp-admin/theme-install.php' containing suspicious query parameters that indicate an attempt to force an unauthenticated theme installation via a Cross-Site Request Forgery (CSRF) exploit (Click2Shell). The rule identifies requests with malicious payloads in the 'theme' parameter, specifically looking for indicators that attempt to bypass CSRF protections when originating from an external site or a non-admin session context.
Detects web requests to 'wp-admin/theme-install.php' containing suspicious query parameters that indicate an attempt to force an unauthenticated theme installation via a Cross-Site Request Forgery (CSRF) exploit (Click2Shell). The rule identifies requests with malicious payloads in the 'theme' parameter, specifically looking for indicators that attempt to bypass CSRF protections when originating from an external site or a non-admin session context.
Detects HTTP requests containing malicious JDBC strings targeting PaperCut NG/MF print management software, which are indicative of attempts to exploit authentication bypass and remote code execution vulnerabilities (CVE-2026-81578, CVE-2026-82078).
Detects alerts that reference specific CVEs historically exploited by the threat group QTFY against internet-facing applications, including common vulnerabilities in Pulse Secure, FortiOS, Citrix ADC, Exchange, F5 BIG-IP, Log4Shell, and others, when the alert severity is Medium or High and contains indicators of exploit or initial access.
Detects anomalous serialized object payloads within authenticated GraphQL subscription requests to GitLab Duo Chat endpoints. This pattern is indicative of exploitation attempts targeting the insecure deserialization vulnerability in GitLab EE (CVE-2026-87719), where malicious payloads are injected into serialized data streams.
Detects potential exploitation of CVE-2025-3248 in Langflow by identifying suspicious inbound network traffic targeting the /api/v1/validate/code endpoint, correlated with subsequent python child processes containing base64 decoding and execution primitives such as eval, exec, or subprocess.
Detects potential exploitation of CVE-2025-3248 in Langflow by identifying suspicious inbound network traffic targeting the /api/v1/validate/code endpoint, correlated with subsequent python child processes containing base64 decoding and execution primitives such as eval, exec, or subprocess.
This rule detects potential exploitation activities targeting Atlassian Confluence by monitoring for unauthorized access to administrative configuration actions (e.g., setup/setupadministrator.action) and the subsequent addition of accounts to the 'confluence-administrators' group. It correlates process execution, network request patterns, and local user account modifications to identify successful or attempted privilege escalation and configuration manipulation.
Detects anomalous activity originating from or associated with the PostgreSQL service account, including the execution of shells and utilities commonly used for post-exploitation or system enumeration, as well as external network logins. This activity is indicative of credential abuse or container escapes where an adversary attempts to execute commands on the underlying host.
This rule monitors for various types of events (user logons, network connections, API audits, cloud app events, and email traffic) originating from a specific CIDR block (160.79.104.0/21), which is flagged as suspicious or unauthorized.
This rule detects SQL injection attempts targeting the BuddyBoss members REST endpoint, specifically identifying exploitation patterns associated with the 'sqlmap' tool. The rule monitors for specific URL parameters including 'member_type', 'search_terms', and 'scope' in combination with an 'sqlmap' user-agent, indicating an automated exploitation attempt against the application.
Detection rules identifying malformed RDP MCS Connect Initial PDUs and unusual service crashes following RDP connection attempts, both indicative of exploitation attempts against the CVE-2019-0708 (BlueKeep) vulnerability.
Detects unauthorized or suspicious POST requests to the Cisco Firepower Management Center (FMC) web interface that lack standard authentication headers (Cookie, Authorization, or X-Api-Token). This pattern is consistent with exploit attempts targeting CVE-2026-20079.
Detects web server processes (e.g., w3wp.exe, nginx.exe, tomcat.exe) spawning command-line interpreters or utilities that could indicate remote code execution, web shell activity, or post-exploitation discovery/download attempts.
Detects anomalous, high-volume unauthenticated POST requests to the Elementor Pro 'admin-ajax.php' endpoint with the 'elementor_pro_forms_send_form' action. This behavior is indicative of potential exploitation attempts or reconnaissance associated with the Elementor Pro file upload vulnerability (CVE-2026-32475).
Page 28 of 102