Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
Detects classic SQL injection attack patterns within incoming HTTP requests, such as UNION SELECT statements, boolean-based tautologies (1=1), table dropping commands, or common URL-encoded quote characters.
This rule detects potential scanning behavior (port or host sweeps) against specific, commonly targeted service ports (e.g., 443, 80, 8080) and correlates it with suspicious HTTP URI path requests associated with common exploit attempts (e.g., OWA, ECP, or management API paths).
Detects suspicious child processes spawned by an AutoGen Studio agent process. This behavior is indicative of the AutoJack exploit chain, where an attacker leverages an unauthenticated MCP WebSocket endpoint (/api/mcp/ws/) to execute arbitrary OS commands on the host by passing base64-encoded StdioServerParams.
Detects evidence of RustDesk session permission bypass exploitation. The rule monitors for the presence of known Proof-of-Concept (PoC) file artifacts, suspicious child processes spawned by RustDesk, use of elevated tokens by RustDesk-initiated processes, compilation of PoC tools using cargo, and outbound network connections from RustDesk to known relay ports.
Detects anomalous behavior associated with the PHP 8.5.7 SOAP remote code execution (RCE) vulnerability. The detection monitors for PHP/PHP-FPM processes spawning suspicious child processes (e.g., shell, python, powershell), the creation of specific exploitation marker files (e.g., php857_rce, rpoc.php), and suspicious command-line patterns indicative of payload execution or command-based exploitation techniques.
Detects web server processes (e.g., httpd, nginx) spawning common shell interpreters (sh, bash, cmd.exe) that execute suspicious commands often used in reconnaissance or download stages of an attack, such as 'whoami', 'wget', or 'curl'. This behavior is characteristic of an exploited web application being used as a staging or command-and-control pivot point.
This rule monitors web request URLs and associated messages for common SQL injection characters and sequences, such as quotes and semicolons. It specifically targets requests involving the 'apiuser' account to identify potential attempts to manipulate or exploit backend database queries.
Detects exploitation of the Flowise MCP environment variable case-sensitivity bypass vulnerability. Adversaries leverage this flaw to circumvent denylist validation by supplying lowercase or mixed-case variable names (e.g., node_options), facilitating malicious code preloading via '--require', unauthorized environment secret exfiltration, or spawning child processes from the Flowise application.
Monitors GitHub audit logs for suspicious or high-risk activities within CI/CD pipelines, including actions triggered by forks, workflow approvals, branch policy overrides, self-hosted runner registration, and sensitive secret access.
Detection rule monitoring for indicators of compromise related to SolarWinds Serv-U, including anomalous Content-Encoding headers, unexpected child process execution, large file staging indicative of data exfiltration (Cl0p-style), outbound exfiltration, SQL injection artifacts, and unauthorized LDAP/Active Directory object enumeration by the Serv-U process.
Detects anomalous network traffic patterns indicative of two distinct techniques: P2P injection into Microsoft 365 Copilot search queries and Server-Side Request Forgery (SSRF) leveraging Bing's image search functionality for data exfiltration.
This rule monitors network traffic for suspicious patterns indicating exploitation of LocalStack environments. It detects three primary malicious activities: Velocity Template Language (VTL) injection targeting reflection methods (e.g., ProcessBuilder) for RCE; unauthorized manipulation of API Gateway resources (e.g., creating or modifying deployments) accompanied by IAM scope bypass techniques; and direct execution of RCE-style API triggers against known LocalStack port 4566.
Detects attempts to exploit the Squidbleed vulnerability by monitoring 'squid.exe' process command lines for keywords related to FTP default configuration exploitation, specifically 'Safe_ports', 'CONNECT', 'PORT', 'PASV', '21', and 'tcp_outgoing_address'. This indicates an adversary trying to bypass security controls or exfiltrate data via FTP.
Detects a potential privilege escalation attempt in MyBB where a user with limited Administrator Control Panel (ACP) permissions modifies a user account to join the 'Administrator' group (ID 4) by POSTing to the 'user-users' module.
Detects Server-Side Template Injection (SSTI) and subsequent Remote Code Execution (RCE) attempts within the Floci API Gateway environment. The rule monitors for suspicious child processes spawned by the Floci JVM (e.g., shell execution), the creation of specific RCE proof-of-concept marker files, and the execution of associated exploitation tooling or IAM-bypass command arguments.
Detects execution of MyBB exploitation scripts, specifically targeting the 'mybb_limited_acp_to_admin' PoC, or evidence of a web server process (PHP) spawning suspicious shell or interpreter child processes, suggesting post-exploitation activity on a MyBB platform.
Detects inbound network connections from external, non-private IP addresses to local ports 6081 and 6082. These ports are used by the PAN-OS User-ID Authentication Portal, which is actively targeted by CVE-2026-0300.
Detects attempts to generate SQL injection payloads by abusing Ollama servers, specifically targeting unauthenticated HTTP POST requests to /api/generate or /api/chat on port 11434. The rule looks for SQL injection indicators and VAPT framework specific strings within the request context, URI, or user agent.
Detects unauthenticated network connections to AutoGen Studio's Management Control Plane (MCP) WebSocket paths. AutoGen Studio's AuthMiddleware explicitly skips authentication for '/api/mcp/*' and '/api/ws/*' paths, typically on port 8081. This rule identifies attempts to access these paths without authentication, which could indicate reconnaissance or exploitation attempts against a misconfigured or vulnerable AutoGen Studio instance.
Detects signs of HTTP request smuggling attempts targeting nghttpx or similar proxies. The rule monitors for a specific poisoning precondition where an HTTP/1.1 Upgrade request contains both an 'Upgrade' header and a 'Content-Length' header, which can be leveraged to desynchronize the connection and smuggle subsequent requests (e.g., GET /poisoned).
Detects OS command execution spawned by a Java process, potentially indicating successful exploitation of Velocity template injection (e.g., in Flowise or Floci) where java.lang.ProcessBuilder is leveraged to execute malicious commands.
Page 63 of 102