Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
Detects an nginx HTTP Server response header containing a version number identified as vulnerable to CVE-2026-42533 (specifically 0.9.6 through 1.30.3, or 1.31.0 through 1.31.2). This rule identifies potentially exposed or unpatched infrastructure that may be susceptible to exploitation.
This rule monitors for suspicious activity by detecting two distinct patterns: first, network connections initiated by Java processes located in tomcat/catalina directories on high-risk ports; second, suspicious administrative audit actions (Add admin, Modify credential, Export device list) within N-central where the initiating user context is missing.
Detects shell/command execution spawned by a Marimo notebook server process where the shell command line contains suspicious indicators (download-and-execute patterns, base64-encoded commands, reverse-shell syntax, or outbound network utility invocation), consistent with exploitation of CVE-2026-39987 leading to command execution on Marimo notebook processes.
Detects repeated Nginx worker process crashes terminated by signals 6 (SIGABRT) or 11 (SIGSEGV) accompanied by core dumps. High-frequency crashes originating from a single source are indicative of an adversary brute-forcing ASLR in preparation for exploitation of memory corruption vulnerabilities (e.g., buffer overflows or heap clobbering) to achieve remote code execution.
Detects instances where an nginx worker process spawns a shell interpreter, such as sh or bash. This behavior is highly irregular for a web server and is often indicative of exploitation of a remote code execution vulnerability, such as the referenced CVE-2026-42533.
Detects HTTP requests to the WordPress REST batch endpoint (/wp-json/batch/v1 or /?rest_route=/batch/v1) carrying user agents associated with public wp2shell proof-of-concept tooling. This targets the pre-auth route confusion and SQL injection primitive in WordPress Core (CVE-2026-63030, CVE-2026-60137) that leads to full remote code execution.
Detects exploitation of the CVE-2026-12569 Java deserialization vulnerability in PTC Windchill and FlexPLM. The detection triggers when the specific payload class 'com.ptc.wpcfg.logic.ExpressionClassMethod' is identified within command-line arguments of Java-based processes, indicating an attempt to achieve remote code execution through the application's deserialization flaw.
Detects CVE-2026-33824 IKE VPN endpoint exploitation traffic (UDP 500/4500) correlated within a 5-minute window with a subsequent outbound reverse-shell callback from the same host.
Detects unauthenticated WebSocket upgrade requests to a terminal/shell-related URI path or subprotocol, lacking Authorization or Cookie headers, indicative of unauthenticated web-terminal exploitation.
Detects HTTP requests to the WordPress REST batch endpoint (/wp-json/batch/v1 or /?rest_route=/batch/v1) carrying user agents associated with public wp2shell proof-of-concept tooling. This targets the pre-auth route confusion and SQL injection primitive in WordPress Core (CVE-2026-63030, CVE-2026-60137) that leads to full remote code execution.
Detects CVE-2026-3055 Citrix NetScaler out-of-bounds memory-read exploitation via a GET request eliciting an oversized HTTP response body containing a leaked NSC_AAAC session cookie.
Threat actors are exploiting the recently Discovered WordPress Vulnerability. Vulnerability Management platform like defender not fully capable of identifying the vulnerable WordPress Core Application being installed on the organizations Servers. If you are using Defender XDR, here's the KQL to hunt for WordPress Installed Linux and Windows Servers.
Detects Langflow CVE-2026-33017 exploitation attempts combining the /api/v1/auto_login endpoint with a flow_id parameter.
This rule detects the creation of executable files within Git hooks directories ('.git/hooks') initiated by 'git' or 'gitea' processes. The logic specifically excludes files ending in '.sample' to focus on active hook deployment. This behavior is indicative of the 'diffpatch' collision technique (CVE-2026-60004), where attackers attempt to plant malicious Git hooks to achieve remote code execution (RCE) in the context of the Gitea service account.
Detects an n8n form file-upload request combining the vulnerable /form/ multipart upload endpoint with a path-traversal marker in the filename field, consistent with the chained CVE-2026-21858 arbitrary file read to CVE-2025-68613 sandbox-bypass RCE exploit.
Threat actors are exploiting the recently Discovered WordPress Vulnerability. Vulnerability Management platform like defender not fully capable of identifying the vulnerable WordPress Core Application being installed on the organizations Servers. If you are using Defender XDR, here's the KQL to hunt for WordPress Installed Linux and Windows Servers.
Detects inbound HTTP requests targeting specific hosts (photo.pokok.edu.hk, pta.sfaeps.edu.hk) with URI patterns associated with exploitation campaigns targeting vulnerabilities including CVE-2018-11511, CVE-2021-24139, CVE-2021-31755, and CVE-2021-32305.
Detects potential SQL injection attempts targeting the WordPress REST API batch endpoint (/wp-json/batch/v1) specifically attempting to query the wp_users table for credential fields such as user_pass or user_login.
Detects malicious SQL injection attempts targeting WordPress REST API endpoints that attempt to forge post parameters by injecting self-referential cycles. The pattern specifically looks for 'UNION SELECT' combined with 'author_exclude' and manipulated 'post_parent' values, matching known exploitation patterns for the wp2shell vulnerability (CVE-2026-63030 / CVE-2026-60137).
Detects malicious SQL injection attempts targeting WordPress REST API endpoints that attempt to forge post parameters by injecting self-referential cycles. The pattern specifically looks for 'UNION SELECT' combined with 'author_exclude' and manipulated 'post_parent' values, matching known exploitation patterns for the wp2shell vulnerability (CVE-2026-63030 / CVE-2026-60137).
Detects malicious SQL injection attempts targeting WordPress REST API endpoints that attempt to forge post parameters by injecting self-referential cycles. The pattern specifically looks for 'UNION SELECT' combined with 'author_exclude' and manipulated 'post_parent' values, matching known exploitation patterns for the wp2shell vulnerability (CVE-2026-63030 / CVE-2026-60137).
Page 48 of 102