Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
Detects anomalous, unauthenticated access to API endpoints commonly associated with table enumeration, often targeting ServiceNow interfaces or similar REST APIs. The rule monitors for a high volume of unique API paths or tables requested by a single IP address without an authorization token present, as well as tracking access from known malicious IP addresses.
Detects attempts to access the GCP instance metadata service (metadata.google.internal) by exploiting Server-Side Request Forgery (SSRF) vulnerabilities. The rule looks for URI patterns often used to bypass filters by manipulating the authority component or using specific protocols like 'gcs://' to target internal cloud infrastructure.
This rule monitors web and proxy traffic for patterns indicative of Server-Side Request Forgery (SSRF) attempts. It searches for specific URL parameters designed to manipulate requests toward internal cloud metadata services (e.g., 169.254.169.254), exploit protocol schemes like 'gcs://', or leverage URL parsing discrepancies such as unauthorized authority or fragment-at-sign confusion to bypass security filters.
This rule detects potential Server-Side Request Forgery (SSRF) probing attempts against web applications where unauthenticated requests contain a URL parameter used to request external or internal resources. It flags high-volume probing activity and correlates the source IP with concurrent anomalous Azure Active Directory (Azure AD) sign-in events from the same source, such as failed logins or high-risk sign-in attempts.
This rule detects potential Server-Side Request Forgery (SSRF) activity by identifying suspicious patterns in web application access logs. It monitors for high-diversity parameter values within URL query strings (e.g., 'url', 'path', 'target', 'file', 'src', 'dest', 'uri', 'redirect') that deviate from normal behavior, combined with indicators like mixed HTTP response codes (2xx and 4xx) and high request volumes from a single source IP to a specific request path. Such behavior is characteristic of an adversary iteratively probing or brute-forcing internal paths or resources via an application-level vulnerability.
Detects Server-Side Request Forgery (SSRF) attempts targeting the Google Cloud Platform (GCP) metadata server (169.254.169.254). The rule inspects RequestURL and RequestContext fields for indicators of metadata API access, URL parameter manipulation, authority confusion payloads, and encoding bypass techniques often used to access cloud instance metadata for unauthorized credential or information harvesting.
Detects attempts to bypass URL validation and access sensitive GCP metadata endpoints (169.254.169.254 or metadata.google.internal) using a double-slash (//) prefix injection pattern within URL parameters. This technique is often used in Server-Side Request Forgery (SSRF) attacks to read local resources or metadata credentials from Cloud Run or other GCP compute services.
Detects Server-Side Request Forgery (SSRF) attempts directed at the Google Cloud Platform (GCP) instance metadata service endpoints. The rule monitors HTTP request logs from proxies or web servers, identifying requests that contain suspicious metadata hostnames or IP addresses combined with sensitive API paths typically used for exfiltrating cloud instance identity tokens.
This rule detects attempts to exploit a path traversal vulnerability (CVE-2026-49506) in the Dell Wyse Management Suite API. The rule inspects HTTP requests for directory traversal sequences such as '..' or URL-encoded equivalents, which could allow an unauthorized attacker to access files or directories outside the intended scope on the web server.
Detects web traffic where the referrer header contains keywords associated with gaming or educational themes (such as 'bioshock', 'game', 'puzzle', 'math', 'quiz') combined with access attempts to sensitive URI paths (like '/code', '/token', '/secret', '/private', '/api-key') resulting in a redirect status (301-308). This behavior pattern is often indicative of automated reconnaissance or exploitation attempts using non-standard or obfuscated referrers to bypass simple security filters.
This rule detects potential Remote Code Execution (RCE) exploitation attempts targeting Dell Wyse Management Suite (WMS) by identifying abnormally large POST requests containing JSON payloads directed at specific management paths (/WMS/ or /wyse/). This behavior is indicative of an exploit attempt against CVE-2026-41120.
This rule monitors for HTTP POST requests containing 'class.module.classLoader', which is a characteristic payload component used to exploit the Spring4Shell vulnerability (CVE-2022-22965) in Spring Framework applications. This vulnerability allows for remote code execution (RCE) by manipulating class loader properties.
Detects HTTP requests containing a UNION SELECT pattern in the URI query string, which is a common indicator of a SQL injection attempt aimed at exfiltrating data or manipulating database queries.
Detects inbound HTTP requests containing common Cross-Site Scripting (XSS) patterns, such as the <script> HTML tag or the 'javascript:' URI scheme, which are indicative of attempts to execute arbitrary client-side code.
Detects HTTP requests attempting to access sensitive internal IP addresses (RFC-1918) or cloud metadata services (e.g., 169.254.169.254) which are common indicators of Server-Side Request Forgery (SSRF) exploitation attempts.
Detects attempts to exploit the Log4Shell vulnerability (CVE-2021-44228) by identifying JNDI lookup strings (e.g., ${jndi:ldap://, ${jndi:rmi://, ${jndi:dns://) within HTTP request headers, a technique used to trigger remote code execution in vulnerable Java applications using the Log4j library.
Detects attempts to exploit the Shellshock vulnerability (CVE-2014-6271) by inspecting HTTP request headers for the characteristic function definition syntax '() { :;'. This pattern is commonly used in malicious payloads to trigger command execution via environment variables in CGI scripts.
This rule detects common Cross-Site Scripting (XSS) patterns within the HTTP URI, specifically looking for script tags, javascript: URI handlers, and common event handlers (onerror/onload) that are frequently used in XSS injection attacks.
This rule detects attempts to inject malicious JavaScript code via HTTP URI requests. It uses PCRE pattern matching to identify common XSS indicators such as <script> tags, JavaScript event handlers (onerror, onload), and attempts to access document.cookie, which are indicative of stored or reflected Cross-Site Scripting (XSS) attack patterns.
Detects common SQL injection patterns within the HTTP URI query string. The rule monitors established network traffic to web servers and uses regex matching to identify attempts to use SQL keywords like UNION SELECT, OR 1=1 boolean-based attacks, blind SQL injection techniques (sleep/benchmark), and attempts to access information_schema metadata tables.
Detects network requests to Microsoft 365 Copilot Enterprise Search containing suspicious HTML tags or prompt injection keywords in the query parameter, indicating a potential Parameter-to-Prompt (P2P) injection attempt (CVE-2026-42824). Specifically looks for HTML image tags (<img src=), the variable '$TITLE', or the Bing SSRF endpoint 'bing.com/images/searchbyimage' within the URL-decoded 'q' parameter.
Page 62 of 102