Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
Detects web application processes (such as nginx, gunicorn, uvicorn, python, node, or java) attempting to read sensitive information from /proc/self, specifically /proc/self/environ, /proc/self/cmdline, or /proc/self/maps. This behavior is indicative of a Local File Read (LFR) vulnerability exploitation, which an attacker may use to exfiltrate environment variables containing secrets or Cloud Run service account credentials.
Detects a suspected exploitation of CVE-2026-35616 on edge/SOHO devices, followed within 5 minutes by the download of an architecture-specific MIPS dropper via curl or wget, a behavior consistent with known threat activity such as the Volt Typhoon/JDY Botnet.
Detects the upload and execution of a specific malicious CSV file (evil_tenant.csv) on Cisco SD-WAN Manager (vManage) systems. This file is associated with exploitation of CVE-2026-20245, enabling attackers to inject a persistent root backdoor account into the system files.
Detects web traffic where the referrer header contains keywords associated with gaming or educational themes (such as 'bioshock', 'game', 'puzzle', 'math', 'quiz') combined with access attempts to sensitive URI paths (like '/code', '/token', '/secret', '/private', '/api-key') resulting in a redirect status (301-308). This behavior pattern is often indicative of automated reconnaissance or exploitation attempts using non-standard or obfuscated referrers to bypass simple security filters.
This rule monitors incoming HTTP requests for classic SQL injection patterns, such as UNION SELECT, SLEEP, BENCHMARK, and various SQL commands like DROP or ALTER. These signatures are commonly associated with attempts to gain unauthorized access to database contents, exfiltrate data, or compromise the database integrity via web applications.
Detects incoming HTTP traffic attempting to exploit the Apache Struts2 vulnerability CVE-2017-5638. The rule monitors the Content-Type HTTP header for OGNL (Object-Graph Navigation Language) expressions containing known exploitation markers like ClassLoader, getRuntime, or .exec(), which indicate an attempt to achieve Remote Code Execution (RCE).
Detects common SQL injection attack patterns within HTTP URI or POST body traffic, such as UNION SELECT, tautologies (e.g., OR 1=1), schema enumeration, and database functions like benchmark or sleep.
Detects incoming HTTP traffic attempting to exploit the Apache Struts2 vulnerability CVE-2017-5638. The rule monitors the Content-Type HTTP header for OGNL (Object-Graph Navigation Language) expressions containing known exploitation markers like ClassLoader, getRuntime, or .exec(), which indicate an attempt to achieve Remote Code Execution (RCE).
Detects attempts to exploit the Shellshock vulnerability (CVE-2014-6271) by inspecting HTTP request headers for the characteristic function definition syntax '() { :;'. This pattern is commonly used in malicious payloads to trigger command execution via environment variables in CGI scripts.
Detects Server-Side Request Forgery (SSRF) attempts targeting Microsoft Exchange via the /autodiscover/ endpoint. The attack leverages a specifically crafted X-BEResource header containing an internal IP address, which is indicative of the CVE-2021-26855 vulnerability used in ProxyLogon exploitation.
Detects attempts to exploit Velocity Template Language (VTL) injection vulnerabilities in the Floci API Gateway, specifically targeting MOCK integration configurations on port 4566. The rule monitors for the injection of malicious Java objects via response templates, deployment of these templates, and the execution of the RCE payload via a specific API endpoint path, including potential IAM enforcement bypass attempts.
This rule detects potential exploitation of Palo Alto PAN-OS vulnerabilities. It monitors for unusual inbound network traffic on ports 6081/6082 from non-RFC1918 (external) IP addresses and identifies specific user-agent strings associated with observed exploit attempts in the wild.
This rule detects potential Server-Side Request Forgery (SSRF) exploitation where Bing's 'search by image' functionality is abused to fetch external, non-Microsoft controlled URLs. The query monitors web proxy logs for specific Bing search parameters ('cbir=sbi' and 'imgurl') and filters out requests to trusted domains, effectively identifying attempts to use the search engine as an intermediary for unauthorized external web requests. The rule further correlates these hits with Microsoft Copilot interaction logs to identify if the activity is associated with authenticated Copilot user sessions.
Detects exploitation attempts against the Flowise MCP environment variable case-sensitivity vulnerability. Attackers can leverage a lowercase 'node_options' environment variable on Windows to bypass Flowise security denylists, allowing the injection of arbitrary JavaScript via the Node.js --require flag. The rule also monitors for the execution of associated proof-of-concept (PoC) python scripts and markers.
Monitors IIS web servers for signs of potential exploitation by tracking suspicious child processes spawned by worker processes (w3wp.exe/iisexpress.exe), tracking unexpected WER (Windows Error Reporting) crashes associated with IIS workers, aggregating IIS-related application crashes, and detecting anomalous W3C IIS log request patterns (e.g., malformed content-length, negative bytes, or suspicious URI characteristics).
This rule monitors for suspicious activity originating from Langflow-related web service processes (langflow, uvicorn, gunicorn, python). It detects the spawning of unexpected OS-level child processes (like shell interpreters), creation of suspicious files in temporary directories (e.g., /tmp, /dev/shm), and outbound network connections to known command-and-control (C2) infrastructure associated with recent Langflow exploitation attempts (CVE-2026-33017).
Detects exploitation attempts against GeoServer targeting CVE-2024-36401, a vulnerability involving unsafe OGC filter property name evaluation. The rule monitors for malicious HTTP patterns in incoming requests to OGC endpoints (ows, wfs, wms, wcs) and identifies subsequent suspicious process spawning by the GeoServer JVM instance that indicate successful remote code execution.
Detects potential exploitation of ProxyLogon (CVE-2021-26855) on Microsoft Exchange Servers. The rule identifies suspicious process activity where IIS worker processes (w3wp.exe) or Exchange UM processes (UMWorkerProcess.exe) spawn command-line shells (cmd.exe, powershell.exe, etc.) or create web shell files within Exchange-specific web directories (e.g., OWA, autodiscover, ecp).
Detects unauthorized attempts to escalate privileges within the MyBB Administrative Control Panel (ACP). The rule identifies malicious activity such as creating an administrator user by assigning usergroup 4, or accessing restricted configuration settings via HTTP POST/GET requests directed at the admin index script.
Detects suspicious activities indicative of a MyBB limited ACP user escalating privileges to full administrator. This includes web server processes (php, httpd, nginx) spawning command shells, interacting with database management tools, creating suspicious session files, or writing executable files to critical directories (cache, templates, uploads, inc).
Detects post-exploitation activities related to the PHP 8.5.7 CVE-2025-15661 StreamBucket SOAP vulnerability. This rule monitors for PHP worker processes spawning shells, writing executable files to suspicious directories, executing system binaries on Windows, or initiating outbound network connections on non-standard ports, including specific proof-of-concept markers.
Page 58 of 102