Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
This rule monitors network traffic from CommonSecurityLog data to detect bidirectional communication between NetScaler appliances and known malicious infrastructure associated with the CVE-2026-88772 campaign, which is indicative of command-and-control activity.
Detects an unauthenticated remote code execution attempt against AhsayCBS via the UpdateReceivers.do endpoint using the checkSysPwd parameter, associated with CVE-2026-105133 and CVE-2026-105134.
Detects an unauthenticated remote code execution attempt against AhsayCBS via the UpdateReceivers.do endpoint using the checkSysPwd parameter, associated with CVE-2026-105133 and CVE-2026-105134.
Detects anomalous unauthenticated HTTP requests targeting Citrix NetScaler ADC/Gateway, characterized by suspicious URI patterns, non-standard HTTP methods, and malformed request parameters. This rule is designed to identify potential exploitation attempts consistent with CVE-2026-88771.
This rule monitors NetScaler ADC logs for indicators associated with the PitScaler campaign, specifically targeting exploitation of CVE-2026-88771 and CVE-2026-88772. It detects exploitation artifacts (DTLS handshake errors, NSPPE crashes), deployment of WHIPSHOT/SLAPSHOT malware, web shell installation, httpd.conf configuration tampering, persistence mechanisms involving privilege escalation (chmod), and connections to known malicious infrastructure.
Detects the execution of suspicious child processes (shells, interpreters, or system reconnaissance tools) directly spawned by critical Citrix NetScaler service binaries (nsppe, httpd, nsaaad). This behavior is indicative of post-exploitation activity, such as command injection or lateral movement following the exploitation of a public-facing NetScaler application vulnerability.
Detects potential exploitation attempts targeting unpatched Citrix NetScaler ADC or Gateway devices, specifically looking for unauthenticated requests to management or sensitive endpoints that contain command execution indicators. This rule is designed to identify activity associated with vulnerabilities similar to CVE-2026-88771.
Detects an unauthenticated remote code execution attempt against AhsayCBS via the UpdateReceivers.do endpoint using the checkSysPwd parameter, associated with CVE-2026-105133 and CVE-2026-105134.
This rule monitors for Cisco ASA/FTD device logs indicating an unexpected process crash (e.g., 'crashinfo', 'Traceback', 'decode-CF process restart') in conjunction with logs related to WebVPN activity or malformed HTTP requests. This pattern is indicative of potential exploitation attempts against the Cisco WebVPN service, such as those targeting CVE-2026-20349.
Detects a multi-stage compromise sequence involving anomalous authentication followed by VPN session establishment and a burst of outbound connections from Citrix ADC/Gateway appliances. Tightened to reduce false positives from legitimate admin access, routine VPN sessions, and authorized appliance telemetry/updates.
This rule monitors network traffic for communication with known malicious IP addresses (143.198.7.94 and 157.254.167.12) associated with the exploitation of NetScaler CVE-2026-88772 as part of the WHIPSHOT_SLAPSHOT campaign. These IPs are linked to staging, exploitation, and web shell backdoor installation activities.
Detects Ollama server errors and failures during model loading operations that may indicate malicious model injection, path traversal attempts, or exploitation of model loading mechanisms to achieve remote code execution. Adversaries may attempt to load specially crafted malicious models or exploit vulnerabilities in the model loading process to execute arbitrary code on the server. This detection monitors error messages and failure patterns that could signal attempts to abuse model loading functionality for malicious purposes.
Detects an exploitation attempt against PoeLLM or LiteLLM MCP test/connection endpoint using a python3 stdio payload that fetches data from port 81.
This analytic detects unexpected outbound network connections initiated by known webserver processes such as `httpd.exe`, `nginx.exe`, or `tomcat.exe` to common file sharing or public content hosting services like GitHub, Discord CDN, Transfer.sh, or Pastebin.
Webservers are rarely expected to perform outbound downloads, especially to dynamic or anonymous file hosting domains. This behavior is often associated with server compromise,
where an attacker uses a reverse shell, webshell, or injected task to fetch malware or tools post-exploitation.
The detection leverages Cisco Network Visibility Module flow data, enriched with process context, to identify this highly suspicious behavior.
Webservers are rarely expected to perform outbound downloads, especially to dynamic or anonymous file hosting domains. This behavior is often associated with server compromise,
where an attacker uses a reverse shell, webshell, or injected task to fetch malware or tools post-exploitation.
The detection leverages Cisco Network Visibility Module flow data, enriched with process context, to identify this highly suspicious behavior.
This rule detects indicators of the PitScaler campaign targeting Citrix NetScaler ADC and Gateway appliances, exploiting vulnerabilities (CVE-2026-88771, CVE-2026-88772). It identifies the full attack chain including initial DTLS heap corruption exploitation, WHIPSHOT web shell C2 patterns, SLAPSHOT tunneling artifacts, web shell deployment files, httpd.conf PHP configuration tampering for persistence, privilege escalation via setuid /bin/sh modification, and anti-forensic log tampering.
Detects HTTP requests directed at NetScaler AAA or Gateway authentication endpoints that exhibit characteristics indicative of exploitation attempts against CVE-2026-88771. The rule monitors for anomalies such as excessive Content-Length headers, unusually large URI query parameters, or the presence of duplicated HTTP headers, which may be leveraged to bypass security controls or trigger buffer-related vulnerabilities during the authentication process.
Detects the spawning of shells, interpreters, or system reconnaissance binaries by primary Citrix NetScaler ADC/Gateway processes (httpd, nsppe, aslearning). This behavior is strongly indicative of post-exploitation activity, such as remote command execution, often following the exploitation of vulnerabilities like CVE-2026-88771.
This rule monitors NetScaler ADC logs for indicators associated with the PitScaler campaign, specifically targeting exploitation of CVE-2026-88771 and CVE-2026-88772. It detects exploitation artifacts (DTLS handshake errors, NSPPE crashes), deployment of WHIPSHOT/SLAPSHOT malware, web shell installation, httpd.conf configuration tampering, persistence mechanisms involving privilege escalation (chmod), and connections to known malicious infrastructure.
Detects high-frequency, short-duration UDP flow activity on NetScaler VPN ports (443/4433) indicative of volumetric or malformed DTLS handshake probing, potentially associated with exploitation attempts like CVE-2026-88772.
Detects an attempt to exploit CVE-2026-88772 by identifying an oversized DTLS handshake record on a NetScaler Gateway. The rule looks for UDP traffic on port 443 where the initial handshake record exceeds the expected size threshold, indicative of a potential buffer overflow attempt.
This rule detects indicators of the PitScaler campaign targeting Citrix NetScaler ADC and Gateway appliances, exploiting vulnerabilities (CVE-2026-88771, CVE-2026-88772). It identifies the full attack chain including initial DTLS heap corruption exploitation, WHIPSHOT web shell C2 patterns, SLAPSHOT tunneling artifacts, web shell deployment files, httpd.conf PHP configuration tampering for persistence, privilege escalation via setuid /bin/sh modification, and anti-forensic log tampering.
Page 5 of 102