Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
Detects signs of exploitation targeting a PAN-OS GlobalProtect authentication bypass vulnerability (CVE-2026-0257). The rule identifies an initial network request with invalid or malformed session cookies aimed at GlobalProtect endpoints, followed immediately by unauthorized access attempts to administrative portal interfaces from the same source IP address.
Detects potential exploitation attempts targeting unpatched Citrix NetScaler ADC or Gateway devices, specifically looking for unauthenticated requests to management or sensitive endpoints that contain command execution indicators. This rule is designed to identify activity associated with vulnerabilities similar to CVE-2026-88771.
Detects instances where the Windchill Java/Tomcat application server process spawns command-line interfaces such as cmd.exe, powershell.exe, or bash.exe. This activity is indicative of post-exploitation behavior associated with CVE-2026-12569, where an attacker exploits a deserialization vulnerability to execute arbitrary commands, often for the purpose of dropping web shells.
Detects attempts to bypass authentication on Citrix NetScaler Gateway or management interfaces by using alternate URI paths, double-encoding, or path traversal techniques to reach restricted administrative endpoints. This is consistent with exploitation attempts targeting vulnerabilities like CVE-2026-19490.
Detects the initiation of VPN or ICA sessions on Citrix NetScaler devices where there is no record of a corresponding successful AAA (Authentication, Authorization, and Accounting) login event from the same source IP address within a one-hour lookback window. This pattern may indicate potential authentication bypass attempts, such as those associated with recent vulnerabilities in NetScaler products.
Detects a potential web shell deployment by identifying a web server process creating or modifying a file in common web directory locations, followed shortly (within 10 minutes) by the execution of that same file.
Detects potential scanning and exploitation attempts against Oracle PeopleSoft Environment Management Hub (PSEMHUB) endpoints, specifically targeting CVE-2026-35273. The rule monitors Azure Application Gateway logs for suspicious HTTP methods (PUT, DELETE, OPTIONS, TRACE) or parameters (e.g., directory traversal strings, command injection indicators) combined with high-frequency sequential probing patterns.
Detects an SSL_HANDSHAKE_FAILURE syslog event on a Citrix NetScaler appliance characterized by a DTLSv1.0 client version and a 'Handshake failure-Internal Error' reason. This pattern is indicative of exploitation attempts against CVE-2026-88772, specifically associated with the WHIPSHOT/SLAPSHOT campaign. This is a high-sensitivity precursor signal that should be correlated with system crash events on the appliance for increased confidence.
Detects an exploitation attempt against PoeLLM or LiteLLM MCP test/connection endpoint using a python3 stdio payload that fetches data from port 81.
Detects inbound network connections to NetScaler ADC management console interfaces (nsconfig, NetScaler AAA) from untrusted, external IP addresses. This rule identifies internet-facing exposure of critical management infrastructure, which is a common prerequisite for exploiting vulnerabilities such as CVE-2026-88771.
Detects network exploitation attempts targeting Fortinet FortiOS and FortiProxy vulnerabilities (CVE-2024-55591, CVE-2025-24472) involving authentication bypass via HTTP header manipulation (Forwarded, X-Forwarded-For) and unauthorized access to the /jsconsole endpoint.
Detects modifications to core NetScaler startup configuration files 'ns.conf' or 'rc.netscaler'. Attackers often target these files after initial access to establish persistence by injecting malicious commands, rewrite, or responder policies to maintain access to the appliance.
Detects evidence of exploitation and post-exploitation activity related to CVE-2026-59310, an unauthenticated RCE vulnerability in the VMware vCenter Syslog Server. The rule monitors for suspicious child processes spawned by vmsyslogcollector, directory traversal patterns in command lines, and persistence mechanisms involving SSH authorized_keys modification, cron job creation, or systemd unit deployment on the VCSA shell.
Detects exploitation attempts against Microsoft SharePoint leveraging the ToolShell exploit chain, as well as subsequent post-exploitation webshell activity involving anomalous 'layoutNsp.aspx' naming conventions. This covers initial exploitation of vulnerabilities such as CVE-2025-49704 and associated variants, followed by the deployment of webshells associated with the ToolShell campaign.
Detects a multi-stage compromise sequence involving anomalous authentication followed by VPN session establishment and a burst of outbound connections from Citrix ADC/Gateway appliances. Tightened to reduce false positives from legitimate admin access, routine VPN sessions, and authorized appliance telemetry/updates.
Detects unauthorized process activity that reads, copies, archives, or transmits the NetScaler ns.conf configuration file. This file contains highly sensitive information, including AAA/LDAP bind credentials and certificates. Adversaries may stage or exfiltrate this file following the exploitation of vulnerabilities (such as CVE-2026-88771 or CVE-2026-88772) on NetScaler appliances to facilitate further network compromise.
This rule identifies MikroTik devices running vulnerable versions of RouterOS (specifically those older than 7.24) that are susceptible to CVE-2026-84411. This vulnerability involves an integer underflow in the web management HTTP handling, which can lead to unauthenticated remote code execution or denial of service.
Detects potential exploitation attempts targeting the vulnerable Oracle PeopleSoft PSEMHUB Environment Management Hub endpoint (associated with CVE-2026-35273 and UNC6240). The rule identifies suspicious bursts of POST requests where the URI path uses percent-encoding or mixed-case characters to evade Web Application Firewall (WAF) filtering.
Detects potential exploitation attempts against CVE-2026-76504, an authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager. The rule monitors web server logs for requests to 'j_security_check' that include URL-encoded characters (specifically %6a, representing 'j'), which is a known pattern used to bypass security filters.
This rule monitors network traffic from CommonSecurityLog data to detect bidirectional communication between NetScaler appliances and known malicious infrastructure associated with the CVE-2026-88772 campaign, which is indicative of command-and-control activity.
Detects a multi-stage compromise sequence involving anomalous authentication followed by VPN session establishment and a burst of outbound connections from Citrix ADC/Gateway appliances. Tightened to reduce false positives from legitimate admin access, routine VPN sessions, and authorized appliance telemetry/updates.
Page 6 of 102