Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
This rule detects potential Server-Side Request Forgery (SSRF) activity where web application or runtime processes attempt to access the Cloud Instance Metadata Service (IMDS) or container task metadata endpoints. By monitoring network connections and application logs, the rule filters out known legitimate metadata clients and identifies suspicious processes frequently associated with web-based vulnerabilities that are repeatedly querying sensitive metadata paths.
This rule detects potential Server-Side Request Forgery (SSRF) activity where web application or runtime processes attempt to access the Cloud Instance Metadata Service (IMDS) or container task metadata endpoints. By monitoring network connections and application logs, the rule filters out known legitimate metadata clients and identifies suspicious processes frequently associated with web-based vulnerabilities that are repeatedly querying sensitive metadata paths.
Detects the initialization of containerized LLM-based gateway services (e.g., litellm, ollama) followed closely in time by high-volume network traffic containing suspicious web injection payloads (e.g., SQLi, XSS, SSRF). The rule correlates process execution events for container launches with network activity originating from the same device to identify potential unauthorized or unsupervised automated exploitation.
Detects high-velocity, automated web activity originating from a single source IP that simultaneously performs widespread endpoint enumeration, tests sensitive authentication flows, and attempts common injection attack payloads. This behavior is indicative of an automated scanner, crawler, or malicious botnet agent performing rapid discovery and exploitation attempts.
Detects unauthorized remote access sessions within N-able N-central by monitoring the Windows Application log for events indicating usage of the default 'MSP Support' account or source IP addresses associated with active exploitation of CVE-2026-18577.
Detects anomalous child process execution originating from PaperCut application processes (pc-app.exe) or associated Java processes. This is indicative of post-exploitation activity following an RCE vulnerability where the application server is leveraged to spawn command interpreters, discovery utilities, or ingress tools.
This rule detects SQL injection attempts targeting the BuddyBoss members REST endpoint, specifically identifying exploitation patterns associated with the 'sqlmap' tool. The rule monitors for specific URL parameters including 'member_type', 'search_terms', and 'scope' in combination with an 'sqlmap' user-agent, indicating an automated exploitation attempt against the application.
Detects anomalous child process execution (e.g., cmd.exe, powershell.exe, whoami) by PaperCut application processes (java.exe, pc-app.exe, PCClient.exe), which is indicative of post-exploitation activity following an authentication bypass and remote code execution chain against PaperCut NG/MF.
This rule detects file creation, modification, or renaming activity involving Acronis plugins integrated with web hosting control panels such as cPanel, WHM, or Plesk, where the plugin version is identified as vulnerable. It specifically monitors for versions earlier than 1.9.3 (excluding specifically patched 1.9.3 HF3 versions) that are prone to exploitation.
Detects possible unauthenticated exploitation attempts against CVE-2025-53521 (F5 BIG-IP APM RCE). Tightened from a generic 'any POST without a cookie on 443/8443' match (extremely broad, alerts on ordinary cookie-less API/health-check traffic) to POST requests specifically targeting F5 APM access-policy processing endpoints (/my.policy, /vdesk/) that lack a session cookie, since the CVE requires an access policy configured on the virtual server and legitimate APM sessions carry a session cookie. Added detection_filter (3 hits/60s per source) to suppress single incidental matches and prioritize repeated attempts. Note: public reporting for this CVE does not include the exact exploit URI/payload, so this is a behavioral/namespace heuristic, not a payload-specific signature — validate against your own APM traffic baseline and update once exploit specifics are published.
Detects possible unauthenticated exploitation attempts against CVE-2025-53521 (F5 BIG-IP APM RCE). Tightened from a generic 'any POST without a cookie on 443/8443' match (extremely broad, alerts on ordinary cookie-less API/health-check traffic) to POST requests specifically targeting F5 APM access-policy processing endpoints (/my.policy, /vdesk/) that lack a session cookie, since the CVE requires an access policy configured on the virtual server and legitimate APM sessions carry a session cookie. Added detection_filter (3 hits/60s per source) to suppress single incidental matches and prioritize repeated attempts. Note: public reporting for this CVE does not include the exact exploit URI/payload, so this is a behavioral/namespace heuristic, not a payload-specific signature — validate against your own APM traffic baseline and update once exploit specifics are published.
Detects incoming HTTP POST requests to the GitLab '/import' endpoint that attempt to access the internal cloud metadata service (169.254.169.254), indicating an exploitation attempt for vulnerabilities such as CVE-2021-22175 or CVE-2021-39935.
Detects incoming HTTP POST requests to the GitLab '/import' endpoint that attempt to access the internal cloud metadata service (169.254.169.254), indicating an exploitation attempt for vulnerabilities such as CVE-2021-22175 or CVE-2021-39935.
Detects HTTP GET requests to the GitLab project repository commits API that contain path traversal sequences ('../' or encoded variations). This behavior is characteristic of exploitation attempts targeting vulnerabilities that allow unauthorized file access or directory traversal within the GitLab environment.
Detects HTTP GET requests to the GitLab project repository commits API that contain path traversal sequences ('../' or encoded variations). This behavior is characteristic of exploitation attempts targeting vulnerabilities that allow unauthorized file access or directory traversal within the GitLab environment.
Detects attempts to exploit CVE-2023-2825, a path traversal vulnerability in GitLab. The rule monitors HTTP GET requests to the /uploads/ endpoint containing directory traversal sequences (e.g., ../ or encoded variants) in the URI, indicating an effort to access restricted files on the system.
This rule detects anomalous high-frequency, short-duration bursts of CAPWAP (Control and Provisioning of Wireless Access Points) traffic originating from external sources and targeting internal FortiGate devices. This behavior is indicative of automated exploitation attempts, specifically targeting known heap-grooming activities used in vulnerabilities like CVE-2023-27997, which rely on repetitive 'Add-Station' operations. Legitimate controller traffic is filtered by focusing on internal-to-internal communication patterns.
Detects unauthenticated HTTP POST requests to the PaperCut web management interface that attempt to modify server configuration settings. This behavior is consistent with exploitation attempts targeting vulnerabilities like CVE-2026-81578, which may allow for unauthorized pre-authentication remote code execution.
Detects suspicious process execution patterns originating from Langflow or Nacos AI orchestration services, including the spawning of sensitive binaries like cmd, powershell, or scripts (python/bash/sh) with suspicious command-line arguments. Additionally, it identifies potential exploitation attempts targeting known-vulnerable API endpoints (code validation and Nacos user authentication).
Detects suspicious process execution patterns originating from Langflow or Nacos AI orchestration services, including the spawning of sensitive binaries like cmd, powershell, or scripts (python/bash/sh) with suspicious command-line arguments. Additionally, it identifies potential exploitation attempts targeting known-vulnerable API endpoints (code validation and Nacos user authentication).
Detects suspicious process execution patterns originating from Langflow or Nacos AI orchestration services, including the spawning of sensitive binaries like cmd, powershell, or scripts (python/bash/sh) with suspicious command-line arguments. Additionally, it identifies potential exploitation attempts targeting known-vulnerable API endpoints (code validation and Nacos user authentication).
Page 35 of 102