Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
Detects instances where a Java process spawns a shell (cmd.exe, powershell.exe, sh, or bash) that executes suspicious commands often associated with remote code execution (RCE) patterns like those seen in Log4j exploitation. The rule excludes common Java-based build tools to reduce noise.
This rule monitors the software inventory for outdated versions of the PostgreSQL database server. It identifies installations where the major and minor versions are below the threshold for current security releases (e.g., v18 < 6, v17 < 11, v16 < 15, v15 < 19, v14 < 24). Running outdated software increases the risk of exploitation of known vulnerabilities.
Detects instances where common web server processes (e.g., PHP, Apache, Nginx) spawn child processes associated with command-line utilities (e.g., curl, bash, python). The rule specifically monitors for command-line arguments referencing log files or traces, which is indicative of potential exploitation attempts or post-exploitation activities such as log poisoning or remote code execution.
Detects a PHP TypeError in Magento system logs where array_merge() is called with an integer argument following an include statement. This signature is indicative of exploitation attempts targeting Magento sites using the StyleSmuggler vulnerability, which often involves malicious file inclusion and code execution.
Detects incoming Grafana API requests directed at vulnerable mcp-grafana server instances identified by an outdated version (pre-1.1.0). This rule correlates host-level version discovery with application-layer logs containing suspicious 'grafana_api_request' method calls, which may indicate an attempt to exploit Server-Side Request Forgery (SSRF) vulnerabilities.
Detects instances where unauthenticated users or sessions execute privileged 'tools/call' operations within the Grafana MCP dispatcher. This behavior is indicative of potential session spoofing attacks, specifically targeting vulnerabilities similar to CVE-2026-19516, where lack of an Authorization header allows unauthorized access to privileged tool functions.
This rule identifies instances of OpenVPN-related executables (openvpn.exe, openvpnserv.exe, tapctl.exe) running on endpoints where the version is below the threshold considered patched (2.7.7). It uses file metadata and certificate information to verify the binary version and flag legacy, potentially vulnerable installations.
This rule identifies instances of OpenVPN-related executables (openvpn.exe, openvpnserv.exe, tapctl.exe) running on endpoints where the version is below the threshold considered patched (2.7.7). It uses file metadata and certificate information to verify the binary version and flag legacy, potentially vulnerable installations.
This rule identifies instances of OpenVPN-related executables (openvpn.exe, openvpnserv.exe, tapctl.exe) running on endpoints where the version is below the threshold considered patched (2.7.7). It uses file metadata and certificate information to verify the binary version and flag legacy, potentially vulnerable installations.
This rule identifies instances of OpenVPN-related executables (openvpn.exe, openvpnserv.exe, tapctl.exe) running on endpoints where the version is below the threshold considered patched (2.7.7). It uses file metadata and certificate information to verify the binary version and flag legacy, potentially vulnerable installations.
Detects suspicious activity associated with the exploitation of a vulnerability in N-central (CVE-2026-86218). The rule monitors for unauthorized child process spawning by N-central components, creation of files in the application directory consistent with web shells, outbound network connections indicative of command and control, and the creation of new local or service accounts for persistence.
Detects suspicious activity associated with the exploitation of a vulnerability in N-central (CVE-2026-86218). The rule monitors for unauthorized child process spawning by N-central components, creation of files in the application directory consistent with web shells, outbound network connections indicative of command and control, and the creation of new local or service accounts for persistence.
Detects anomalous child process execution (e.g., cmd.exe, powershell.exe, whoami) by PaperCut application processes (java.exe, pc-app.exe, PCClient.exe), which is indicative of post-exploitation activity following an authentication bypass and remote code execution chain against PaperCut NG/MF.
Detects unauthenticated requests to the WordPress admin-ajax.php endpoint utilizing the 'super_create_nonce' action. This action allows an unauthenticated user to generate a valid session nonce, which is a critical bypass mechanism often required for the exploitation of vulnerabilities within the Super Forms plugin, such as CVE-2026-14894.
Detects local/remote file inclusion attempts via php wrappers and similar schemes.
Detects unauthenticated attempts to invoke Grafana API tools via the Model Context Protocol (MCP) by utilizing spoofed Mcp-Session-Id headers while bypassing bearer token authentication requirements. This primarily targets unauthorized access to API functionality on Grafana instances configured with bearer-token authentication (v1.1.0+).
Detects potential Server-Side Request Forgery (SSRF) attacks targeting Grafana instances. The rule identifies suspicious 'grafana_api_request' calls that occur shortly after an unauthenticated discovery call ('tools/call') within the same session, where the target URL in the request header is not included in a defined allowlist of known internal Grafana hosts.
Detects potential Server-Side Request Forgery (SSRF) attacks targeting Grafana instances. The rule identifies suspicious 'grafana_api_request' calls that occur shortly after an unauthenticated discovery call ('tools/call') within the same session, where the target URL in the request header is not included in a defined allowlist of known internal Grafana hosts.
Detects potential Server-Side Request Forgery (SSRF) attacks targeting Grafana instances. The rule identifies suspicious 'grafana_api_request' calls that occur shortly after an unauthenticated discovery call ('tools/call') within the same session, where the target URL in the request header is not included in a defined allowlist of known internal Grafana hosts.
Detects instances where unauthenticated users or sessions execute privileged 'tools/call' operations within the Grafana MCP dispatcher. This behavior is indicative of potential session spoofing attacks, specifically targeting vulnerabilities similar to CVE-2026-19516, where lack of an Authorization header allows unauthorized access to privileged tool functions.
Detects instances of an mcp-grafana server responding with an HTTP 200 status code to a 'tools/call' request without an Authorization header, indicating potential unauthenticated remote tool execution on a vulnerable or misconfigured server.
Page 44 of 102