Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
Detects instances where a Java-based application (specifically associated with 'floci' or API Gateway components) spawns suspicious child processes such as shell interpreters (sh, bash, powershell, cmd.exe). This pattern is often indicative of post-exploitation activity following a remote code execution (RCE) attempt against a template engine or web-facing gateway. It also identifies specific file paths related to documented 'floci' POCs and RCE payloads.
Detects ImageMagick processes (magick, convert, mogrify) spawning Ghostscript binaries (gs, gswin64c) from non-standard paths or with suspicious command-line arguments indicative of exploitation attempts, including known proof-of-concept markers.
This rule detects a POST request to the MyBB administrative interface (specifically the user-users module) that contains parameters indicating an attempt to escalate a limited administrative user to a full administrator by assigning the 'usergroup=4' or 'gid=4' identifier, which corresponds to the default Administrator group in MyBB.
Detects potential HTTP Request Smuggling attempts targeting nghttpx proxies. The rule monitors for malicious request patterns involving HTTP/1.1 Upgrade headers combined with a body (Content-Length) designed to poison the request queue, as well as specific path patterns (e.g., /upgrade, /poisoned) or server-agent identification of the nghttp2/nghttpx service.
Detects the spawning of suspicious child processes (cmd.exe, powershell.exe, wscript.exe, cscript.exe, or mshta.exe) from processes related to the Dell Wyse Management Suite (WMS) service. This behavior is indicative of potential exploitation of CVE-2026-41120, a critical remote code execution vulnerability in the WMS application.
Detects the spawning of suspicious child processes (cmd.exe, powershell.exe, wscript.exe, cscript.exe, or mshta.exe) from processes related to the Dell Wyse Management Suite (WMS) service. This behavior is indicative of potential exploitation of CVE-2026-41120, a critical remote code execution vulnerability in the WMS application.
Detects requests to the PeopleSoft listening connector containing loopback, link-local, or private network targets in the URL or captured request fields. This indicates a potential Server-Side Request Forgery (SSRF) attempt.
Detects unauthenticated GET requests to the vulnerable ServiceNow REST API endpoint '/api/now/related_list_edit/create' which was exploited in early June 2026. The detection monitors for requests originating from anonymous or guest users, lacking authorization headers, and returning successful (200) responses.
This rule detects outgoing network connections from the IIS worker process (w3wp.exe) to public-facing URLs that match common Microsoft Office WOPI (Web Application Open Platform Interface) request patterns, but are directed to domains other than trusted Microsoft-affiliated infrastructure. This behavior can be indicative of a Server-Side Request Forgery (SSRF) attempt, where an attacker tries to coerce the server into making unauthorized requests to external resources.
Detects Python executing a web-administration exploit with valid credential input and explicit two-factor bypass logic, matching the AI-assisted semantic trust-flaw exploitation described by GTIG.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
Detects the exploitation of BeyondTrust/Bomgar appliances where the legitimate support processes (bomgar-rep.exe, bomgar-scc.exe) unexpectedly spawn interactive command shells.
Detects instances where AutoGenStudio or MultimodalWebSurfer processes spawn potentially malicious or living-off-the-land (LOLBin) child processes. This behavior may indicate an exploit chain where a web-based RCE leads to arbitrary command execution on the host system.
Monitors web or API gateway logs for POST requests directed at vulnerable vLLM multimodal endpoints containing the 'video_url' parameter. This is the entry point for the CVE-2026-22778 exploit chain.
Detects one external source repeatedly requesting PeopleSoft administrative endpoints across multiple destinations or URLs within fifteen minutes. This activity could indicate an attacker performing reconnaissance or vulnerability scanning against public-facing PeopleSoft applications.
Google Threat Intelligence Group (GTIG) has identified a sophisticated campaign attributed to UNC6508, a People's Republic of China (PRC)-nexus threat actor, targeting institutions in the North American academic, medical, and military research community. While remaining undetected for over a year, the threat actor compromised externally facing web applications, deployed bespoke malware, pivoted to sensitive internal systems, and abused enterprise administrative tools for covert data exfiltration. The threat actor had broad collection aspirations, including sensitive defense intelligence related to national security, Indo-Pacific command operations, artificial intelligence, uncrewed vehicle systems, cyber offensive programs, and medical research.
Detects instances where the Internet Information Services (IIS) worker process (w3wp.exe) spawns a command shell (cmd.exe) or PowerShell (powershell.exe, pwsh.exe). This behavior is highly suspicious as it often indicates a web application compromise or exploit attempt where an adversary has gained remote code execution.
Detects unauthenticated ServiceNow Scripted REST Resource access attributed to Guest user or known attacker IP 51.159.98.241
Detects unauthorized or external access attempts to exposed Ollama API endpoints (port 11434) for generating or chatting, which could be indicative of LLMjacking. The rule identifies requests from known attacker IPs or any external IP, especially if the request count is high.
This rule detects Server-Side Request Forgery (SSRF) attempts originating from Cisco WebDialer by identifying network requests targeting loopback addresses (127.0.0.1, localhost, ::1), cloud instance metadata API addresses (169.254.169.254), private IP ranges (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12), or using 'file://' or 'gopher://' protocols. The rule specifically looks for 'webdialer' in the event_sub_type or action_remote_ip fields to narrow down the source of the request. The XQL view includes actor and causality fields for further investigation.
Detects web requests attempting to exploit CWE-78 in AutoGen MCP via base64 encoded parameters in the URL. Specifically looks for '/api/mcp/ws/' and 'server_params=' within syslog messages.
Page 67 of 102