Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
Detects the execution of cmd.exe originating from the Remote Mouse or Peyara service process, correlating with an immediately preceding unauthenticated network connection on TCP port 1313. This behavior is indicative of exploitation of a remote service vulnerability, often associated with the Peyara Remote Mouse remote code execution exploit.
This rule detects unauthorized exploitation attempts against Gitea environments vulnerable to CVE-2026-20896. When Gitea is configured with REVERSE_PROXY_TRUSTED_PROXIES set to permit all sources, an attacker can bypass authentication by injecting the 'X-WEBAUTH-USER: admin' header in HTTP requests. This allows the attacker to gain administrative privileges and perform unauthorized actions, such as creating new admin accounts or accessing restricted API endpoints.
Detects Parameter-to-Prompt (P2P) injection attempts targeting Microsoft 365 Copilot by identifying suspicious patterns in URL query parameters. The rule monitors AuditLogs for queries containing HTML tags, encoded payloads, or known malicious markers typical of prompt injection exploits against search functionalities (CVE-2026-42824).
Detects the exploitation of CVE-2026-20253, where the Flowise application fails to correctly sanitize or validate environment variables. By using a case-insensitive bypass (e.g., lowercase 'node_options'), an attacker can cause a spawned Node.js child process to honor the variable and execute unauthorized JavaScript files via the '--require' command-line argument.
Detects successful exploitation of the CVE-2026-48558 OIDC authentication bypass vulnerability in SimpleHelp. The rule monitors for a forged OIDC response processed by the OIDCAuthenticator followed immediately by the registration of a new technician account marked with the [New Anon] identifier, indicating identity verification failure and unauthorized privileged account creation.
Detects potential exploitation of the Zerologon vulnerability (CVE-2020-1472) by correlating computer account password changes (Event ID 4742) with preceding anonymous or null SID logons (Event ID 4624) where the host identifier aligns. The rule identifies anomalous account modifications that occur within a short time window following an anonymous authentication request on the same host.
This rule detects potential exploitation attempts targeting the BeyondTrust Privileged Remote Access API by identifying unauthenticated POST requests directed at specific sensitive API endpoints (e.g., /api/, /remote-support/). It flags high-frequency or multi-path request patterns indicative of automated vulnerability scanning or exploitation attempts related to CVE-2026-1731, where the absence of authorization headers is a key indicator of unauthorized access.
Detects incoming web requests to GCP Cloud Run services that exhibit patterns associated with Server-Side Request Forgery (SSRF) exploitation. The rule monitors for URLs containing GitHub blob paths combined with path traversal sequences ('//') that point to sensitive internal system paths such as /proc/, /etc/, or /var/task/.
This rule detects potentially malicious HTTP requests targeted at Google Cloud Run services that attempt to access restricted or internal application paths, such as '/app/' or '/var/task/'. These patterns often indicate attempts to probe for or exploit vulnerable web application files, internal scripts, or configuration files (e.g., 'graph_api.py', 'graph.zip') commonly found in serverless environments.
Detects potential exploitation attempts against management interfaces of SOHO network devices (Cisco, Ubiquiti, Draytek) by monitoring for suspicious web request activity, specifically targeting paths like /admin, /cgi-bin, or /setup.cgi. The rule identifies high-volume or systematic scan patterns from external sources, which may indicate automated exploitation attempts (e.g., related to CVE-2026-35616).
This rule monitors network logs (from proxies and firewalls) for web traffic (HTTP GET requests) containing suspicious JavaScript code injection patterns in the request context or message fields. It specifically looks for common XSS indicators such as <script tags, eval(), document.write(), fromCharCode(), and atob().
Detects evidence of successful cache poisoning exploitation in Next.js applications by identifying specific marker files ('VULNERABILITY_CONFIRMED.marker' and 'evidence.json') created in conjunction with active 'next start' or 'next build' processes. This pattern aligns with Proof of Concept (PoC) code targeting object argument collisions.
Detects incoming HTTP requests to Microsoft Exchange servers containing malicious X-AnonResource-Backend or X-BEResource headers, which are indicative of an attempt to exploit the ProxyLogon SSRF vulnerability (CVE-2021-26855).
Detects attempts to exploit the Log4Shell vulnerability (CVE-2021-44228) by monitoring HTTP headers for JNDI lookup strings. The rule inspects traffic for malicious patterns like '${jndi:ldap://', '${jndi:rmi://', or '${jndi:dns://', which are used to trigger remote code execution in vulnerable Java applications.
Detects attempts to exploit Apache Struts vulnerabilities by identifying OGNL (Object-Graph Navigation Language) expressions (starting with %{ or ${) within the Content-Type HTTP header, combined with requests to .action or .do endpoints.
Detects attempts to exploit the ProxyShell vulnerability (CVE-2021-34473) in Microsoft Exchange servers. The rule identifies malicious path traversal sequences, specifically utilizing encoding techniques like double URL encoding (%25) or dot-dot-slash characters within requests to the Autodiscover service, aimed at bypassing security controls.
Detects network exploitation attempts related to the Log4j vulnerability (CVE-2021-44228), where an adversary sends an HTTP request containing a JNDI lookup string (e.g., ldap://, rmi://, dns://) designed to trigger a remote code execution via vulnerable Log4j libraries.
Detects HTTP POST requests containing patterns associated with the Spring4Shell vulnerability (CVE-2022-22965). The rule specifically looks for payloads manipulating 'class.module.classLoader' or 'class.classLoader.resources.dirContext' to achieve Remote Code Execution (RCE) on vulnerable Spring Framework applications.
This rule monitors for HTTP POST requests containing 'class.module.classLoader', which is a characteristic payload component used to exploit the Spring4Shell vulnerability (CVE-2022-22965) in Spring Framework applications. This vulnerability allows for remote code execution (RCE) by manipulating class loader properties.
Detects incoming HTTP requests to Microsoft Exchange servers containing malicious X-AnonResource-Backend or X-BEResource headers, which are indicative of an attempt to exploit the ProxyLogon SSRF vulnerability (CVE-2021-26855).
This rule detects post-exploitation activity on Microsoft Exchange Servers by monitoring for w3wp.exe (IIS worker process) spawning command-line interpreters such as cmd.exe, powershell.exe, or pwsh.exe. This behavior is indicative of an attacker leveraging a web shell, often deployed via the exploitation of vulnerabilities like ProxyLogon (CVE-2021-26855), ProxyNotShell (CVE-2022-41082), or similar remote code execution flaws targeting Exchange endpoints.
Page 55 of 102