Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
Detects post-exploitation of CVE-2026-22778 (vLLM libopenjp2 JPEG2000 cdef heap overflow). The overwritten AVBuffer free() pointer is set to system(), so a successful exploit spawns /bin/sh -c as a direct child of the vLLM/python inference process. Matches a shell or download/exec utility launched with a vLLM/python/uvicorn parent, excluding benign python worker children.
This rule detects potentially malicious inbound HTTP POST requests directed at an API endpoint associated with public build directories. The detection logic monitors for suspicious user agents (e.g., Python requests), specific known malicious flow identifiers, known attacker IP addresses, and payload indicators such as OS command injection or execution patterns (e.g., __import__, os.system).
Detects instances where the Exchange Server IIS worker process (w3wp.exe) spawns unexpected child processes like PowerShell, pwsh, or cmd, often indicating exploitation of vulnerabilities such as ProxyNotShell (CVE-2022-41040 and CVE-2022-41082) where an attacker leverages Exchange backend processes for arbitrary command execution.
Detects the RondoDox campaign's use of obfuscated JNDI payloads targeting the Log4Shell (CVE-2021-44228) vulnerability. The rule identifies attempts to spray malicious JNDI lookup strings like ${env:NaN:-j}ndi across multiple HTTP headers including Authorization, Bearer, Cookie, and others, specifically designed to bypass web application firewall (WAF) filters.
Detects network connections to known ShinyHunters infrastructure, including specific IP addresses and DNS queries for 'azurenetfiles.net', which has been linked to their operations targeting Oracle PeopleSoft servers via gadget chain exploitation.
Detects exploitation attempts against CVE-2026-33017 in Langflow by monitoring for unauthenticated POST requests to the /api/v1/build_public_tmp/ endpoint, specifically using the identified exploit User-Agent, followed by outbound connections from the victim host to known attacker-controlled infrastructure.
Detects unauthenticated HTTP POST requests targeting Oracle PeopleSoft PSEMHUB and PSIGW endpoints that are characteristic of the CVE-2026-35273 remote code execution exploit gadget chain.
Detects evidence of the execution of a proof-of-concept (PoC) exploit targeting Next.js unstable_cache functionality. The rule monitors for the installation of canary versions of Next.js, execution of the PoC demonstration script 'run_demo.mjs', and the creation of a 'VULNERABILITY_CONFIRMED.marker' file, which are specific indicators associated with the exploitarium repository PoC.
This rule monitors web traffic logs for requests targeting administrative URI paths or containing the username 'admin' in the 'X-WEBAUTH-USER' header. It specifically filters out requests originating from trusted reverse proxies, identifying potential attempts to bypass authentication by manually injecting administrative headers.
Detects the execution or presence of identified exploit harness binaries and scripts associated with CVE-2026-55200, an RCE vulnerability in libssh2. The rule monitors process launches for specific filenames and command-line arguments indicative of proof-of-concept or exploitation tooling from the 'exploitarium' repository.
Detects common web server processes (IIS, Apache, Nginx, PHP, Tomcat) spawning command-line interpreters or utilities (cmd.exe, powershell.exe, wscript.exe, cscript.exe, certutil.exe). This pattern is often indicative of exploitation of a web application to gain command execution on the host.
Detects potential exploitation of CVE-2026-0300 targeting PAN-OS and matches anomalous User-Agent string associated with CL-STA-1132 threat actor.
Detects the spawning of /bin/sh or /bin/bash as a direct child process of ffmpeg, jellyfin, or nextcloud. This behavior is often indicative of exploitation attempts against these media and storage services, potentially leveraging remote code execution vulnerabilities.
Detects the spawning of suspicious shell processes (sh, bash, cmd.exe) by media processing applications like ffmpeg, ffprobe, jellyfin-ffmpeg, jellyfin, or nextcloud. This activity is often indicative of an adversary exploiting a vulnerability in these applications to gain initial access or execute arbitrary commands, potentially leading to further compromise. The rule specifically looks for suspicious command-line arguments that suggest interactive shells, network connections, or direct command execution.
Detects POST requests to vLLM multimodal inference endpoints that contain 'video_url' fields pointing to external resources or specific video file extensions (.jp2, .mov, .mp4). This activity is indicative of exploitation attempts related to CVE-2026-22778, where an attacker might try to inject malicious video URLs to trigger vulnerabilities in the vLLM service.
This rule detects two stages of a potential exploitation chain targeting vLLM multimodal endpoints. Stage 1 identifies POST requests to vLLM API endpoints that contain 'video_url' in the request context, which could indicate an attempt to exploit CVE-2026-22778. Stage 2 detects post-exploitation activity by looking for unexpected child processes (like shell interpreters or download utilities) spawned from vLLM or Python inference processes, suggesting successful remote code execution.
Detects HTTP requests that reference or serve the 'cors_exploit_poc.html' file, which is associated with the MexicanMafia (Operation Escaneo) actor's method of exploiting Cross-Origin Resource Sharing (CORS) misconfigurations. This exploit attempts to hijack active administrative sessions by leveraging CORS with 'withCredentials=true'.
Detects HTTP requests where the URI or request body contains indicators of internal network references (e.g., localhost, 127.0.0.1, or RFC 1918 private IP address ranges). This pattern is consistent with Server-Side Request Forgery (SSRF) attempts, where an attacker tries to force a vulnerable web application to perform unauthorized requests to internal resources.
This rule detects potential exploitation attempts against ServiceNow instances by monitoring network and DNS activity involving a known malicious IP address (51.159.98.241). It identifies high-volume connections or DNS requests related to service-now.com associated with this IP, which may indicate an attacker attempting to leverage unauthenticated Scripted REST resources.
Detects anomalous HTTP POST requests to the '/V1/Update/GetUpdate' endpoint on an MSSQL-hosted application, which is associated with malicious activity linked to the OceanLotus (APT32) threat actor group, specifically the Blazing Furnace campaign.
Detects unauthorized, unauthenticated API activity targeting the ServiceNow 'related_list_edit' Scripted REST resource. The rule specifically alerts on requests originating from the 'Guest' account or where authentication requirements have been disabled, which are known indicators of exploitation.
Page 61 of 102