Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
Detects the execution of known exploit harnesses and proof-of-concept scripts related to CVE-2026-55200, a critical pre-authentication heap out-of-bounds write vulnerability in libssh2. The rule monitors for the execution of binaries and Python scripts identified as part of the libpwn exploit toolkit used to trigger the vulnerability.
Detects unauthenticated HTTP requests to sensitive Gitea endpoints containing the 'X-WEBAUTH-USER' header set to 'admin'. This rule identifies exploitation attempts against misconfigured Docker deployments where 'REVERSE_PROXY_TRUSTED_PROXIES' is improperly set to a wildcard, allowing unauthorized users to impersonate administrative accounts (CVE-2026-20896).
Detects Server-Side Request Forgery (SSRF) attempts against a GCP Cloud Run service. The rule identifies malicious payloads targeting the 'url' parameter, which utilize path traversal sequences (e.g., ../, %2f, %5c) to escape the GitHub repository segment or attempt to access sensitive local system files like /proc/self/environ, /app/main.py, or /app/requirements.txt.
Detects Server-Side Request Forgery (SSRF) attempts using a double-slash URL manipulation technique. Adversaries append an absolute local file path (e.g., /etc/passwd or /proc/self/environ) after a GitHub blob URL to bypass URL validation logic commonly found in web proxies, API gateways, and serverless environments like GCP Cloud Run.
Detects attempts to exploit Microsoft Exchange vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), collectively known as ProxyShell. The rule monitors inbound HTTP requests targeting the /autodiscover/ endpoint with specific path traversal patterns and malicious components used to stage web shells or execute arbitrary commands.
This rule detects attempts to exploit Microsoft 365 Copilot through prompt injection, where attackers inject HTML/script elements into search queries. It specifically identifies when these queries attempt to force Copilot to interact with external URLs via Bing image search (SSRF), potentially exfiltrating sensitive data such as MFA codes, email content, or meeting details to an attacker-controlled external domain.
Detects malicious activities targeting Cisco Catalyst SD-WAN infrastructure, including connections from known malicious IP addresses (UAT-8616), unauthenticated vManage API access attempts indicative of exploitation (CVE-2026-20182), and anomalous control-plane signaling (OMP/DTLS/NETCONF) from unauthorized external sources.
Detects anomalous, oversized IKEv1 Phase 1 packets targeting Check Point VPN devices, indicative of an exploitation attempt for CVE-2026-50751.
Detects attempts to exploit the Log4Shell vulnerability (CVE-2021-44228) by identifying JNDI lookup strings (e.g., ${jndi:ldap://, ${jndi:rmi://, ${jndi:dns://) within HTTP request headers, a technique used to trigger remote code execution in vulnerable Java applications using the Log4j library.
Detects malicious Parameter-to-Prompt (P2P) injection attempts targeting Microsoft 365 Copilot by monitoring search query parameters for indicators of natural-language command injection or HTML-based payload injection (e.g., img tags, source manipulation, or data extraction commands).
Detects anomalous activities associated with the CitrixBleed2 campaign where the ScreenConnect remote access tool is used to deploy or execute QEMU virtual machine artifacts. The rule monitors for the spawning of virtualization binaries (e.g., qemu-system-x86_64) via the ScreenConnect service, the dropping of QEMU-related files into ScreenConnect directories, and the suspicious creation of local administrator accounts (CtxAppVCOMService).
Detects potential exploitation of the Zerologon vulnerability (CVE-2020-1472) by correlating computer account password changes (Event ID 4742) with preceding anonymous or null SID logons (Event ID 4624) where the host identifier aligns. The rule identifies anomalous account modifications that occur within a short time window following an anonymous authentication request on the same host.
This rule detects attempts to exploit a Server-Side Request Forgery (SSRF) vulnerability in Oracle PeopleSoft by targeting the '/PSIGW/HttpListeningConnector' endpoint. The detection looks for malicious URI patterns and request bodies containing internal-only network indicators such as loopback addresses (127.0.0.1, localhost), link-local addresses (169.254.169.254), or local file access attempts (file://), which are indicative of SSRF exploitation attempts.
Detects remote code execution exploitation targeting CVE-2026-20253 in Splunk. The rule monitors for unauthorized child processes, such as shells or scripting interpreters, being spawned by the Splunk daemon (splunkd). It also flags processes containing exploit-related strings in the command line as a secondary indicator.
Detects Microsoft Exchange EWS (Exchange.asmx) requests containing a ReferenceAttachment call where the ProviderEndpointUrl parameter points to a non-Microsoft/external domain. This is consistent with SSRF exploitation techniques, such as those observed in CVE-2026-45504, where an attacker-controlled endpoint is provided to Exchange for fetching WOPI properties.
This rule detects attempts to exploit the Log4Shell vulnerability (CVE-2021-44228) by monitoring HTTP headers for malicious JNDI lookup strings. Attackers use this injection to trigger the JNDI mechanism to connect to a remote server (LDAP, RMI, DNS) and download malicious Java classes, leading to remote code execution.
Detects network traffic containing the Java Serialization magic header 'AC ED 00 05'. This sequence is commonly used to initiate Java deserialization attacks, which can lead to remote code execution if the application insecurely deserializes untrusted data.
Detects known suspicious (default) user-agents related to scanning/recon tools
Detects Server-Side Request Forgery (SSRF) attempts targeting Microsoft Exchange via the /autodiscover/ endpoint. The attack leverages a specifically crafted X-BEResource header containing an internal IP address, which is indicative of the CVE-2021-26855 vulnerability used in ProxyLogon exploitation.
Detects HTTP POST requests containing multipart form data that include suspicious PHP functions commonly associated with webshells, such as eval(), base64_decode(), system(), or passthru(). This indicates a potential attempt to upload or execute a malicious PHP script on a web server.
Detects attempts to exploit the ProxyShell vulnerability (CVE-2021-34473) in Microsoft Exchange servers. The rule identifies malicious path traversal sequences, specifically utilizing encoding techniques like double URL encoding (%25) or dot-dot-slash characters within requests to the Autodiscover service, aimed at bypassing security controls.
Page 53 of 102