Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
This rule detects attempts to exploit a vulnerability in ShareFile (CVE-2026-2699/CVE-2026-2701) by monitoring for HTTP GET requests to the `/ConfigService/api/StroageZoneConfig` URI path with a `h=` query parameter. This pattern is indicative of an attacker trying to leak API secrets.
This rule detects exploitation attempts against Oracle WebLogic servers by identifying HTTP requests that target known WebLogic administrative or internal endpoints and simultaneously contain indicators of command execution payloads within the URL. Specifically, it looks for URLs containing '/console/', '/wls-wsat/', '/bea_wls_internal/', or '/_async/' combined with keywords like 'cmd=', 'bash', 'powershell', 'wget', 'curl', 'base64', 'IEX', or 'Runtime.getRuntime'. The rule also requires the source IP to be different from the target IP, indicating an external attacker. This pattern is typical of Remote Code Execution (RCE) exploitation attempts, including those targeting vulnerabilities like CVE-2026-21962.
Detects cases where a source previously blocked by AWS WAF later receives a successful ALLOW, indicating a possible bypass attempt or rule tuning requirement after high-volume scanning.
Detects HTTP GET requests to the vulnerable Citrix NetScaler /wsfed/passive?wctx endpoint, specifically looking for the malformed query string used in CVE-2026-3055 exploitation where 'wctx' is present without an associated value or '=' symbol. This rule combines common network appliance and web server logs to identify potential exploit attempts.
Detects suspicious WebLogic HTTP requests with command execution indicators, specifically targeting known WebLogic endpoints and looking for patterns indicative of Remote Code Execution (RCE) payloads. The rule also correlates this activity with external IP addresses.
Detects exploitation attempts against Oracle WebLogic via suspicious HTTP requests and command execution patterns. The rule identifies WebLogic-specific endpoints combined with RCE payload indicators such as cmd, bash, powershell, wget, curl, or encoded payloads within the URI query.
This detection identifies attempts to exploit CVE-2026-33017, a code injection vulnerability in Langflow, by looking for specific URL paths associated with the vulnerability ('/api/v1/build_public_tmp/') combined with indicators of scanning tools like 'nuclei' in the user agent or cookie fields. It aims to detect reconnaissance or exploitation attempts against vulnerable Langflow instances.
Detects HTTP POST requests targeting the Langflow public flow build endpoint, which is vulnerable to unauthenticated Remote Code Execution (CVE-2026-33017).
Detects exploitation attempts of CVE-2026-21962 (Critical - CVSS 10.0) in Oracle WebLogic Server Proxy Plug-in. The vulnerability allows unauthenticated attackers to bypass access controls via path traversal (patterns like /_proxy/ or /wl_proxy/ + weblogic/..; + ProxyServlet) and header spoofing (WL-Proxy-Client-IP pointing to localhost/127.0.0.1). Successful exploitation can lead to unauthorized access, data modification or full compromise of the backend WebLogic Server.
Detects SessionReaper webshell activity on Magento e-commerce platforms, including process execution from suspicious media directories.
Identifies suspicious URI request patterns potentially indicative of CVE-2026-4681 exploitation attempts against PTC PLM solutions. This rule looks for these specific patterns within web traffic logs from various sources (access logs, IIS, Apache).
This rule detects an inbound HTTP POST request targeting the Langflow AI pipeline application, specifically looking for attempts to exploit CVE-2026-33017. The detection logic focuses on specific URI paths and keywords within the HTTP request body that indicate an attempt to inject code, such as 'import '.
Detects User-Agent rotation behavior from a single Source IP (c-ip) associated with more than 3 distinct
User-Agent (c-useragent) values within a 5-minute window. This behavior is characteristic of the Nuclei
'-random-agent' flag, which allows the scanner to bypass WAF (Web Application Firewall) detections by
using a different, valid browser User-Agent string for each request.
User-Agent (c-useragent) values within a 5-minute window. This behavior is characteristic of the Nuclei
'-random-agent' flag, which allows the scanner to bypass WAF (Web Application Firewall) detections by
using a different, valid browser User-Agent string for each request.
This rule detects an inbound HTTP POST request targeting the Langflow AI pipeline application, specifically looking for attempts to exploit CVE-2026-33017. The detection logic focuses on specific URI paths and keywords within the HTTP request body that indicate an attempt to inject code, such as 'import '.
Detects HTTP POST requests targeting the Langflow public flow build endpoint, which is vulnerable to unauthenticated Remote Code Execution (CVE-2026-33017).
Detects access to the claude.com open redirect endpoint pointing to external domains. Attackers can abuse this trusted domain to bypass ad validation and email filters to deliver malicious payloads, such as prompt injections.
Detects instances where the telnetd process spawns the login binary with the '-f' flag. This behavior is indicative of exploitation of CVE-2026-24061, which allows an attacker to bypass authentication by injecting arguments into the login process via a crafted USER environment variable.
Detects BigQuery queries using CONCAT with CHR functions to dynamically build cross-project paths, bypassing dot filters. High-fidelity indicator of LeakyLooker-style SQL injection.
Detects attempts to exploit a remote code execution vulnerability (CVE-2025-40553) in SolarWinds Web Help Desk. Attackers use hex-encoded escape sequences (`\xNN`) and other JSON parsing gotchas to bypass security filters and achieve deserialization of malicious objects.
This rule is meant to catch a very specific web request pattern tied to the SolarWinds Web Help Desk issue described in the report. The attack sends a crafted request to a known application path and includes a small group of values that are unusual in normal traffic but important in the exploit chain. The rule stays tight by requiring the request method, the path, and the special body values together. That matters because web applications often have busy and messy traffic, and loose matching on only one keyword would create noise. In plain language, this rule tries to spot a request that is not just using the help desk site, but is trying to abuse it to make the server handle attacker-controlled data in a dangerous way. It is best used as a high-confidence lead for review rather than a generic web alert. When it fires, it should be treated as a focused sign of attempted abuse rather than normal help desk.
Detects the complete CVE-2026-21902 exploitation chain against Juniper Junos OS Evolved On-Box Anomaly Detection Framework. Requires all four steps: command creation, DAG creation, DAG instance scheduling, and commit.
Page 71 of 102