Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
Detects path traversal attempts against a Vite development server by monitoring for various forms of URI encoding (single/double) and suspicious path patterns (e.g., /etc/passwd, .env, .git/config, /@fs/). The rule tracks these attempts using flowbits and alerts when a successful HTTP 200 response is received after a matching traversal request.
Detects path traversal attempts against a Vite development server by monitoring for various forms of URI encoding (single/double) and suspicious path patterns (e.g., /etc/passwd, .env, .git/config, /@fs/). The rule tracks these attempts using flowbits and alerts when a successful HTTP 200 response is received after a matching traversal request.
Detects attempts to access sensitive files like environment variables (.env), cloud provider credentials (AWS/Azure), or Terraform state files via a web server interface, specifically targeting Vite development server deployments.
Detects attempts to access sensitive files like environment variables (.env), cloud provider credentials (AWS/Azure), or Terraform state files via a web server interface, specifically targeting Vite development server deployments.
This rule detects inbound HTTP requests targeting a Vite development server that attempt to access the '.env' configuration file via the '//@fs/' path, which is a known technique for sensitive file exposure in misconfigured Vite environments.
Detects high-volume bursts of HTTP GET requests against specific paths associated with a Vite development server (/@vite/client, /@fs/, /src/) on port 5173. This pattern is indicative of automated reconnaissance or vulnerability scanning targeting an exposed development environment.
Detects high-volume bursts of HTTP GET requests against specific paths associated with a Vite development server (/@vite/client, /@fs/, /src/) on port 5173. This pattern is indicative of automated reconnaissance or vulnerability scanning targeting an exposed development environment.
The following analytic identifies potential exploitation attempts against Citrix ADC related to CVE-2023-3519. It detects POST requests to specific web endpoints associated with this vulnerability by leveraging the Web datamodel.
This activity is significant as CVE-2023-3519 involves a SAML processing overflow issue that can lead to memory corruption, posing a high risk.
If confirmed malicious, attackers could exploit this to execute arbitrary code, escalate privileges, or disrupt services, making it crucial for SOC analysts to monitor and investigate these alerts promptly.
This activity is significant as CVE-2023-3519 involves a SAML processing overflow issue that can lead to memory corruption, posing a high risk.
If confirmed malicious, attackers could exploit this to execute arbitrary code, escalate privileges, or disrupt services, making it crucial for SOC analysts to monitor and investigate these alerts promptly.
Detects inbound HTTP POST requests to the /paypal/transparent/response/ endpoint containing encoded PHP webshell payloads, specifically attempting to execute base64-decoded code via eval.
Detects exploitation attempts against the WordPress LiteSpeed Cache plugin (CVE-2024-28000), including suspicious web requests involving ESI/crawler cookie hash manipulation, execution of known exploit binaries (wp28000, wp28000_cp), and subsequent unauthorized creation of administrator accounts via the WordPress REST API.
Detects instances where base64-encoded PHP code, obfuscated behind a 'data:image/gif;base64' MIME type prefix, is written to the disk as a .php file or initiated by web server processes. This pattern is commonly used in file upload bypass attacks to execute arbitrary code.
Detects network requests targeting Dahua devices that attempt to exploit CVE-2021-33044. The exploitation involves sending a crafted 'global.login' RPC call with specific parameters (clientType 'NetKeyboard', loginType 'Direct', authorityType 'Default') to bypass authentication and retrieve administrative session tokens.
This rule detects IDS/IPS or vulnerability management alerts triggered by exploitation attempts targeting the Cisco IOS XR control plane, specifically related to CVE-2026-20212.
Detects high-frequency POST requests to the JFrog Artifactory '/access/api/v1/tokens' endpoint, which is indicative of mass exploitation attempts targeting vulnerabilities (CVE-2026-82329) against administrative token management.
Detects high-frequency POST requests to the JFrog Artifactory '/access/api/v1/tokens' endpoint, which is indicative of mass exploitation attempts targeting vulnerabilities (CVE-2026-82329) against administrative token management.
Detects HTTP GET requests to the GitLab project repository commits API that contain path traversal sequences ('../' or encoded variations). This behavior is characteristic of exploitation attempts targeting vulnerabilities that allow unauthorized file access or directory traversal within the GitLab environment.
Detects HTTP GET requests to the GitLab project repository commits API that contain path traversal sequences ('../' or encoded variations). This behavior is characteristic of exploitation attempts targeting vulnerabilities that allow unauthorized file access or directory traversal within the GitLab environment.
Detects anomalous child process execution (e.g., cmd.exe, powershell.exe, whoami) by PaperCut application processes (java.exe, pc-app.exe, PCClient.exe), which is indicative of post-exploitation activity following an authentication bypass and remote code execution chain against PaperCut NG/MF.
This rule detects attempted exploitation of Adobe Commerce (Magento) via GraphQL, specifically targeting Template Property Poisoning through malicious 'styles' array injection as observed in the StyleSmuggler campaign (CVE-2025-54236).
Detects network requests targeting Dahua devices that attempt to exploit CVE-2021-33044. The exploitation involves sending a crafted 'global.login' RPC call with specific parameters (clientType 'NetKeyboard', loginType 'Direct', authorityType 'Default') to bypass authentication and retrieve administrative session tokens.
Detects an attempt to exploit CVE-2026-14894 within the Super Forms plugin by sending a crafted HTTP POST request to admin-ajax.php. The attack attempts to upload an obfuscated PHP web shell disguised as a base64-encoded GIF image.
Page 38 of 102