Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
Detects execution of squid.exe with suspicious command line arguments
Detects attempts to exploit a path traversal vulnerability in SharePoint's Upload.aspx page by looking for requests to 'Upload.aspx' that include both 'List=' and 'RootFolder=' parameters, specifically targeting sensitive catalogs like '_catalogs'. This indicates an attempt to upload files to unauthorized locations.
Detects unauthenticated SQL injection attempts targeting the Ghost CMS Content API by looking for suspicious slug filter ordering syntax (`slug:[` or its URL-encoded equivalent) in the query string. This rule specifically targets a known vulnerability, CVE-2026-26980.
Detects external HTTP POST requests to the Oracle PeopleSoft Environment Management Hub or Integration Broker listening connector. This activity could indicate an attempt to exploit public-facing Oracle PeopleSoft applications.
Detects external HTTP POST requests to vulnerable Oracle PeopleSoft Environment Management Hub (PSEMHUB) and Integration Broker endpoints. This behavior is associated with UNC6240 (ShinyHunters) zero-day exploitation of CVE-2026-35273.
Detects network connections to IP addresses and domains associated with ShinyHunters' infrastructure, observed during the Oracle PeopleSoft data theft campaign.
Detects Server-Side Request Forgery (SSRF) attempts targeting Cisco WebDialer by identifying network connections or process command lines that include WebDialer and attempt to access loopback addresses (127.0.0.1, localhost, ::1), link-local addresses (169.254.169.254), private IP ranges (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12), or 'file://' and 'gopher://' schemes. This rule leverages UDM for principal and target context.
Detects Server-Side Request Forgery (SSRF) attempts targeting Cisco WebDialer by identifying network connections or process command lines that include WebDialer and attempt to access loopback addresses (127.0.0.1, localhost, ::1), link-local addresses (169.254.169.254), private IP ranges (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12), or 'file://' and 'gopher://' schemes. This rule leverages UDM for principal and target context.
Detects SQL injection patterns in HTTP requests
This rule detects potential prompt injection attempts targeting AI systems by looking for specific keywords related to AI models (gpt, claude, copilot) in HTTP logs, combined with suspicious characters or commands commonly used in injection attacks (e.g., <script>, javascript:, eval(). The rule triggers if 5 or more such attempts are observed from a single IP within an hour.
Identifies the presence of the known ITScape (CVE-2026-46316) proof-of-concept executable by its SHA256 hash. This vulnerability enables a critical guest-to-host escape affecting ARM64 infrastructure.
This rule looks for signs that someone is abusing an older Check Point VPN login method that has known security flaws. Successful abuse can give remote access without proper credentials. Patch and monitor VPN gateways if this appears. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects potential prompt injection attempts targeting AI systems by looking for specific keywords related to AI models (gpt, claude, copilot) in HTTP logs, combined with suspicious characters or commands commonly used in injection attacks (e.g., <script>, javascript:, eval(). The rule triggers if 5 or more such attempts are observed from a single IP within an hour.
Detects suspicious child processes spawned by Langflow or n8n workflow services, indicating potential unauthenticated Remote Code Execution (RCE) exploitation. The rule specifically looks for these applications (or their underlying node/python processes) spawning common shell processes (cmd.exe, powershell.exe, bash, etc.) which then execute commands typically associated with RCE payload retrieval or execution (wget, curl, Invoke-WebRequest, base64, iex, Invoke-Expression).
Detects network connections to known ShinyHunters infrastructure, including specific IP addresses and DNS queries for 'azurenetfiles.net', which has been linked to their operations targeting Oracle PeopleSoft servers via gadget chain exploitation.
Detects cross-site scripting attempts in HTTP requests
Detects Java or WebLogic processes spawning command interpreters on an application server, which may indicate successful remote code execution.
This rule detects management log entries in Cisco SD-WAN that indicate a potentially malicious file path being used during a CSV upload. Such crafted uploads have been exploited in real-world attacks to execute commands on network appliances. Detection of this activity suggests a compromise attempt or successful exploitation. It is recommended to block and audit the source account, investigate the user's recent activities (e.g., new software installations, clicked links), and involve the security team for further analysis.
This rule detects potential SQL Injection attempts by monitoring IIS web server logs (W3CIISLog) for URI queries containing common SQL keywords such as 'union', 'select', or 'drop'. It aggregates these attempts by client IP address over one-hour intervals and flags any IP address with 5 or more such attempts within that hour.
Detects the creation or modification of suspicious web-related script files (PHP, ASPX, JSP, SHTML) in common web server directories, excluding activities from legitimate web server processes. This rule aims to identify potential webshell deployment or other post-exploitation activities, specifically linked to APT28's targeting of Roundcube webmail servers.
Detects high volumes of network connections directed at Domain Controller RPC and authentication ports from a single source. This may indicate reachability testing, scanning, or exploitation attempts associated with CVE-2026-41089 (Netlogon RCE).
Page 68 of 102