Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
Detects a root-privileged Screen Sharing session with no successful authentication event in the preceding window, indicating exploitation of the screensharingd pre-auth bypass (CVE-2026-65400); excludes known ARD/MDM admin workflows.
Detects potential exploitation of the ScreenConnect SetupWizard.aspx to bypass authentication and create unauthorized administrative users. The rule monitors for the creation or modification of User.xml or Users.xml files in the ScreenConnect application directories, correlating these file events with suspicious process activity (such as cmd.exe or powershell.exe) or web requests to the SetupWizard.aspx endpoint.
This rule detects potential SQL injection attacks and anomalous request patterns targeting the '/api/session/reset_password' IIS API endpoint. It identifies common SQL injection payloads within the HTTP request body and flags excessive requests to this endpoint that lack expected JSON structure, which may indicate automated scanning or credential stuffing attempts.
Detects repeated screensharingd crash/restart cycles tightly time-correlated with file-copy helper activity, indicating CVE-2026-43777 DoS exploitation alongside its secondary file-copy abuse potential.
Detects external scanning and connection attempts against internet-exposed macOS Screen Sharing (port 5900), including mass scanning and coordinated multi-source probing, with an allowlist for known internal scanners.
This rule detects suspicious outbound network connections from common container runtime processes (e.g., containerd.exe, dockerd.exe) to well-known cloud instance metadata services (169.254.169.254, 100.100.100.200) or suspicious attempts to access container image manifests, which are indicative of SSRF attacks, credential theft from the metadata API, or potential container escape attempts.
Potential exploitation of JetBrains TeamCity (Unauthenticated RCE, CVE-2026-63077) looking for suspicious child processes spawned by TeamCity services.
Detects completed RFB/VNC protocol handshakes to internal macOS Screen Sharing hosts (TCP/5900) from external networks, thresholded to separate reconnaissance/scanning from single stray connections. Early-warning exposure signal for CVE-2026-65400 targeting.
Detects instances where Zscaler AI Protect (AI Guard) flags attempts to perform prompt injection or jailbreak against Large Language Model (LLM) or GenAI applications. The rule monitors blocked requests and allowed requests that exceed a high confidence score threshold (0.75), identifying potential malicious interactions with generative AI services.
Detects the RFB protocol length-field bypass frame pattern used to exploit the screensharingd pre-auth authentication bypass (CVE-2026-65400) on ports 5900/5988.
Detects a root-privileged child process of screensharingd with no corresponding TCC daemon activity on the host, indicating a TCC-bypassing privilege escalation via the pre-auth vulnerability.
Detects unauthenticated WordPress administrator account takeover attempts targeting the User Profile Builder plugin. The rule identifies inbound HTTP GET requests containing the 'autologin=true' parameter and a forged '_wpnonce' value matching the 'autologin-1-' pattern, which exploits an authentication bypass vulnerability (CVE-2026-15826) to gain unauthorized session access as user ID 1.
This rule detects potential exploitation of CVE-2026-15826, an authentication bypass vulnerability in the WordPress User Profile Builder plugin. It monitors HTTP POST requests to 'admin-ajax.php' or the 'profile-builder' endpoint for username parameters between 61 and 70 characters long, which is a known exploit condition for triggering a type confusion in the wppb_log_in_user() function that could allow unauthorized access as user ID 1.
Detects signs of exploitation against FortiOS/FortiProxy authentication bypass vulnerabilities (CVE-2024-55591 / CVE-2025-24472) consistent with Gunra ransomware activity. This rule monitors for administrative logins originating from non-management public IP addresses and identifies potential MFA bypass attempts through the reuse of identical one-time passcodes across multiple distinct accounts or sessions within a one-hour window.
This rule detects suspicious outbound network connections from common container runtime processes (e.g., containerd.exe, dockerd.exe) to well-known cloud instance metadata services (169.254.169.254, 100.100.100.200) or suspicious attempts to access container image manifests, which are indicative of SSRF attacks, credential theft from the metadata API, or potential container escape attempts.
Detects potential SQL injection attempts targeting OGC-compliant web services (such as GeoServer) via specific query parameters like 'cql_filter' or 'filter'. The rule identifies malicious patterns including common SQL keywords and syntax (union, select, information_schema, pg_sleep) within the request URI, query string, or body.
This rule detects potential webshell activity by monitoring the correlation between web server processes spawning suspicious child processes (e.g., cmd.exe, powershell.exe, rundll32.exe) and the creation of executable or script files within identified web directories. The logic establishes a high-confidence correlation when both events occur on the same device within a 15-minute window, while also surfacing uncorrelated individual process spawns or suspicious file writes as lower-confidence indicators. It includes exclusions for known administrative and deployment processes to reduce noise.
Potential exploitation of JetBrains TeamCity (Unauthenticated RCE, CVE-2026-63077) looking for suspicious child processes spawned by TeamCity services.
This rule detects suspicious activity originating from an Internet Information Services (IIS) worker process (w3wp.exe) associated with Microsoft SharePoint. It monitors for the spawning of common command-line shells, interpreters, or Living-off-the-Land Binaries (LOLBins) from the SharePoint IIS worker process, which is a potential indicator of Remote Code Execution (RCE) exploitation, specifically targeting vulnerabilities like the hypothetical CVE-2026-45659.
Detects suspicious command-line activity originating from TeamCity service processes on Windows. The rule looks for unexpected child processes (e.g., cmd.exe, powershell.exe, curl.exe) initiated by the TeamCity server or associated Java processes, which may indicate exploitation of an unauthenticated remote code execution vulnerability.
This rule detects suspicious activity originating from an Internet Information Services (IIS) worker process (w3wp.exe) associated with Microsoft SharePoint. It monitors for the spawning of common command-line shells, interpreters, or Living-off-the-Land Binaries (LOLBins) from the SharePoint IIS worker process, which is a potential indicator of Remote Code Execution (RCE) exploitation, specifically targeting vulnerabilities like the hypothetical CVE-2026-45659.
Page 46 of 102