Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
Detects HTTP requests attempting to access known vulnerable endpoints or submit potentially malicious serialized data payloads to specific vulnerable WordPress plugins identified in recent CVEs (CVE-2025-7697, CVE-2025-7384, CVE-2025-6464, CVE-2025-6742). This rule specifically looks for common PHP serialized object ('O:') or array ('a:') syntax indicators within the URI query string when targeting known vulnerable plugin paths.
Detects attempts to bypass the UniFi OS authentication gateway by exploiting a path traversal vulnerability. The rule looks for requests to the '/api/auth/validate-sso/' endpoint containing URL-encoded path traversal sequences like '..%2f' or '..%2e'. This indicates an attacker is trying to access internal resources or bypass authentication mechanisms.
Detects exploitation of CVE-2026-42864, an unauthenticated SSRF in the FireFighter incident management application. Attackers can coerce the application to fetch arbitrary URLs, potentially exfiltrating AWS metadata credentials (IMDS) as Jira attachments.
Detects error-log indicators of active CVE-2026-42945 (NGINX Rift) exploitation attempts
reported from May 2026: worker processes exiting on signal 11 after crafted requests against
vulnerable rewrite configurations. Pair with access-log URI anomaly rules on internet-facing NGINX.
reported from May 2026: worker processes exiting on signal 11 after crafted requests against
vulnerable rewrite configurations. Pair with access-log URI anomaly rules on internet-facing NGINX.
This rule detects attempts to exploit Apache Struts OGNL (Object-Graph Navigation Language) injection vulnerabilities. It specifically looks for HTTP requests where the 'Content-Type' header contains the sequence '%{', which is characteristic of OGNL expressions used in injection attacks against Apache Struts.
This rule detects attempts to exploit the Log4Shell vulnerability (CVE-2021-44228) by looking for the specific JNDI injection string "${jndi:" within HTTP URI requests. This pattern is commonly used by attackers to trigger remote code execution in vulnerable Log4j versions.
Detects both specific Indicators of Compromise (IOCs) and generic anomalous authentication activity associated with the exploitation of the PAN-OS GlobalProtect authentication bypass vulnerability (CVE-2026-0257).
This rule detects potential file inclusion attempts by monitoring IIS web server logs for URI queries containing keywords like 'file=', 'path=', or 'input='. It then aggregates these attempts by client IP address over one-hour intervals and alerts if 10 or more such attempts are observed from a single IP within that timeframe, indicating a possible attack.
This rule detects potential XML External Entity (XXE) injection attempts by looking for specific XML-related keywords ('<?xml' or 'DOCTYPE') within the URI query string of IIS web server logs. It triggers an alert if three or more such attempts are observed from the same IP address within a one-hour window, indicating a possible automated scanning or attack.
This rule detects potential file inclusion attempts by monitoring IIS web server logs for URI queries containing keywords like 'file=', 'path=', or 'input='. It then aggregates these attempts by client IP address over one-hour intervals and alerts if 10 or more such attempts are observed from a single IP within that timeframe, indicating a possible attack.
This rule detects potential XML External Entity (XXE) injection attempts by looking for specific XML-related keywords ('<?xml' or 'DOCTYPE') within the URI query string of IIS web server logs. It triggers an alert if three or more such attempts are observed from the same IP address within a one-hour window, indicating a possible automated scanning or attack.
Detects generic anomalous authentication or unexpected session creation indicative of an authentication bypass vulnerability (CVE-2026-0257) in PAN-OS GlobalProtect. Needs specific endpoint/URI tuning based on actual CVE details once available.
Detects exploitation attempts of the PAN-OS GlobalProtect authentication bypass vulnerability (CVE-2026-0257) by monitoring for specific Indicators of Compromise (IOCs) including source IPs, machine names, and MAC addresses.
This rule detects when public or anonymous access is enabled for an Azure Storage Account. This configuration change can lead to potential data exposure, as it allows unauthenticated users to access blobs within the storage account. The rule specifically looks for 'STORAGEACCOUNTS/WRITE' or 'STORAGEACCOUNTS/BLOBSERVICES/WRITE' operations that successfully modify the storage account configuration to allow public access.
Detects the initial access attempt for the Oracle E-Business Suite vulnerability CVE-2025-61882. This involves a crafted POST request to the UiServlet component containing a malicious XML payload.
Detects the execution of a malicious Java process spawned by the Metasploit Confluence plugin, which is often used for remote code execution (RCE) via Confluence vulnerabilities. The rule looks for java.exe spawned from the Confluence directory with specific command-line arguments containing a classpath pointing to the user's Temp folder with a ~spawn prefix and a Payload class.
Detects web requests containing common SQL injection payloads or specific PoC metacharacters embedded within JSON:API filter array keys targeting Drupal CVE-2026-9082. The rule specifically looks for requests to Drupal's JSON:API that include 'filter[' and '[condition][value][' in the URI query, combined with SQL injection indicators such as '--', 'UNION', 'SELECT', '$$', '.$', or 'RAPTORMARKER42'.
This rule detects attempts at path traversal vulnerabilities by looking for the string "../../../" in HTTP URIs. This pattern is commonly used by attackers to navigate directory structures outside of the intended web root.
This rule detects attempts to inject client-side scripts, commonly known as Cross-Site Scripting (XSS), by looking for the string "<script>" within the HTTP URI of network traffic. This is a common indicator of an attacker trying to execute malicious scripts in a user's browser.
This rule detects attempts at SQL Injection by looking for the specific string "' OR '1'='1" within the HTTP URI. This string is a common payload used in SQL injection attacks to bypass authentication or extract data by always evaluating to true.
This rule detects attempts at SQL Injection using the 'UNION SELECT' statement within HTTP URI requests. It specifically looks for the case-insensitive string 'UNION SELECT' in the URI of HTTP traffic flowing to the server.
Page 69 of 102