Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
This rule detects potential remote code execution (RCE) exploitation targeting PHP 8.5.7 via the StreamBucket SOAP deserialization vulnerability. It monitors for PHP-related parent processes spawning suspicious child processes (e.g., shells, network utilities, or specific exploit strings) that indicate unauthorized system command execution.
Detects suspicious activities within GitHub repository logs that indicate potential supply chain attacks, including the use of unauthorized workflow names, the creation of orphan snapshot branches, dependabot impersonation attempts, commit messages containing known campaign markers, exposure of internal secrets (HAS_GCR_TOKEN), and the push of suspicious files or configuration modifications.
This rule detects instances where the IIS web server process (w3wp.exe) spawns common command-line interpreters such as cmd.exe or powershell.exe. This activity is a classic indicator of a successful web application exploit, potentially leading to remote code execution.
This rule detects outgoing network connections from the IIS worker process (w3wp.exe) to public-facing URLs that match common Microsoft Office WOPI (Web Application Open Platform Interface) request patterns, but are directed to domains other than trusted Microsoft-affiliated infrastructure. This behavior can be indicative of a Server-Side Request Forgery (SSRF) attempt, where an attacker tries to coerce the server into making unauthorized requests to external resources.
Detects the abuse of SAP RFC function modules SXPG_CALL_SYSTEM and SXPG_COMMAND_INSERT to execute arbitrary OS commands. This activity, observed in the Operation Escaneo campaign, indicates potential unauthorized system command execution via SAP application components, often leveraging specific ZREDTEAM modules or scripts.
Detects unauthorized access attempts to ServiceNow Scripted REST APIs, specifically targeting misconfigured endpoints that do not require authentication. This rule monitors for requests made by the 'guest' user, known malicious IP addresses, or requests missing authorization headers directed at potentially vulnerable APIs like 'related_list_edit'.
Detects unauthorized inbound WebSocket connections from external (non-private) IP addresses to the AutoGen Studio MCP API endpoint at /api/mcp/ws/ on port 8081, followed by the execution of interpreter processes (autogenstudio, uvicorn, or python) on the same host, indicating a potential exploitation of an origin validation bypass for remote code execution.
Detects a potential OS command injection attack targeting AutoGen Studio. The rule correlates a suspicious WebSocket connection to the Model Context Protocol (MCP) endpoint on localhost:8081, specifically containing the 'server_params' parameter, with a subsequent shell process spawning from an AutoGen Studio, Python, or Uvicorn parent process. The shell command line includes common injection characters (e.g., ;, |, &&, ||) and OS enumeration commands (e.g., whoami, id, net user).
Detects Node.js processes associated with NodeBB making outbound network connections to suspicious paths (/users/, /activities/, /inbox, /.well-known/webfinger). This activity may indicate exploitation of the NodeBB ActivityPub plugin (attributedTo UID spoofing), where an attacker forces the application to fetch attacker-controlled URIs.
Detects evidence of the NodeBB ActivityPub UID spoofing proof-of-concept (PoC) script (poc.js). The rule identifies the execution of node processes using specific command-line arguments (--target-base, --actor-origin, --spoof-uid, --recipient-uid) associated with the exploit, as well as Node.js processes making outbound network connections to ActivityPub path components (/inbox, /activitypub) over non-standard network ports. This activity is indicative of vulnerability testing or exploitation attempts.
Detects anomalous child process execution from PHP worker processes (php-fpm, php-cgi, php.exe) that may indicate exploitation of a PHP 8.5.7 stream bucket Use-After-Free (UAF) vulnerability. Attackers can leverage crafted SOAP requests to achieve remote code execution, resulting in the PHP worker spawning command shells (e.g., sh, bash, cmd.exe) or other interpreters (e.g., python, curl) to execute malicious payloads.
Detects exploitation attempts against the Ray AI framework's unauthenticated /api/jobs/ endpoint (CVE-2023-48022). The rule identifies specific Python requests using a known malicious contact address ('rondo2012@atomicmail.io') and detects the delivery of fileless payloads (rondo.wfh.sh) associated with the RondoDox / ShadowRay campaign originating from known malicious infrastructure.
This rule monitors network logs (from proxies and firewalls) for web traffic (HTTP GET requests) containing suspicious JavaScript code injection patterns in the request context or message fields. It specifically looks for common XSS indicators such as <script tags, eval(), document.write(), fromCharCode(), and atob().
Detects attempts to exploit the Squidbleed vulnerability by monitoring 'squid.exe' process command lines for keywords related to FTP default configuration exploitation, specifically 'Safe_ports', 'CONNECT', 'PORT', 'PASV', '21', and 'tcp_outgoing_address'. This indicates an adversary trying to bypass security controls or exfiltrate data via FTP.
Detection rule monitoring for indicators of compromise related to SolarWinds Serv-U, including anomalous Content-Encoding headers, unexpected child process execution, large file staging indicative of data exfiltration (Cl0p-style), outbound exfiltration, SQL injection artifacts, and unauthorized LDAP/Active Directory object enumeration by the Serv-U process.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
This rule detects successful HTTP requests (status 200, 201, 202) directed towards management interfaces (Redfish, CIMC, OSS APIs) by unauthenticated or anonymous users originating from outside the internal network. The rule calculates a risk level based on the variety and frequency of requested paths, flagging potential unauthorized enumeration or exploitation attempts against server infrastructure.
This rule detects successful HTTP requests (status 200, 201, 202) directed towards management interfaces (Redfish, CIMC, OSS APIs) by unauthenticated or anonymous users originating from outside the internal network. The rule calculates a risk level based on the variety and frequency of requested paths, flagging potential unauthorized enumeration or exploitation attempts against server infrastructure.
Detects high-frequency requests (over 30 unique paths within a 5-minute window) to sensitive VPN-related URL paths that result in 403 (Forbidden) or 404 (Not Found) status codes from non-internal IP addresses. This behavior is indicative of an adversary performing directory enumeration or vulnerability scanning on public-facing infrastructure.
Detects high-frequency requests (over 30 unique paths within a 5-minute window) to sensitive VPN-related URL paths that result in 403 (Forbidden) or 404 (Not Found) status codes from non-internal IP addresses. This behavior is indicative of an adversary performing directory enumeration or vulnerability scanning on public-facing infrastructure.
Detects successful (HTTP 200) requests to ServiceNow API endpoints (/api/now/) that lack proper authentication, such as requests by the 'guest' user or requests missing authorization headers or session tokens.
Page 64 of 102