Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
Detects HTTP POST requests to the SolarWinds Web Help Desk (WHD) AjaxProxy endpoint that contain hex-encoded JSON keys or values (e.g., `\xNN`).
Attackers use this technique to bypass security filters and achieve remote code execution, as detailed in the exploit chain for CVE-2025-40552 and CVE-2025-40553.
Attackers use this technique to bypass security filters and achieve remote code execution, as detailed in the exploit chain for CVE-2025-40552 and CVE-2025-40553.
Detects attempts to exploit the authentication bypass vulnerability (CVE-2026-29000) in the pac4j-jwt library. An attacker can craft a JWE token containing an unsigned PlainJWT, which causes the library to skip signature verification. This is often indicated by a successfully authenticated token with an 'alg' (algorithm) claim of 'none'. This detection requires application logs to be configured to record the claims of successfully authenticated JWTs.
Intellexa PREYHUNTER - HTTP
Suricata
Intellexa PREYHUNTER - HTTP response contains distinctive iOS build/artifact strings
Detects the Microsoft SharePoint worker process (w3wp.exe) spawning suspicious child processes often used for post-exploitation activity, such as command shells or scripting engines. This behavior is a strong indicator of a webshell execution, as seen in the ToolShell exploitation campaigns.
Triofox CVE-2025-12480
Suricata
Triofox CVE-2025-12480 - localhost Host header to admin setup pages
Detects the Apache ActiveMQ process (java.exe or wrapper.exe) spawning a command shell or web utility. This behavior is a strong indicator of post-exploitation activity following the exploitation of vulnerabilities like CVE-2023-46604, often used as an entry point for ransomware like LockBit 5.0.
This rule detects activity associated with a specific threat actor targeting FortiGate devices. It identifies network connections to known threat actor infrastructure IPs, attempts to access FortiGate management ports (443, 8443, 10443, 4443) over TCP, and successful administrative or VPN authentications from the threat actor's IPs in Fortinet/FortiGate logs. Additionally, it looks for DCSync-style directory replication access (event ID 4662) in Windows Security logs, indicating potential Active Directory compromise.
Detects attempts to inject path traversal or SQL-like syntax into the 'kid' (Key ID) parameter of a JSON Web Token (JWT) header. This may indicate an attempt to manipulate the server's key retrieval process to force signature validation with an improper key, potentially leading to an authentication bypass.
This rule detects when public or anonymous access is enabled for an Azure Storage Account. This configuration change can lead to potential data exposure, as it allows unauthenticated users to access blobs within the storage account. The rule specifically looks for 'STORAGEACCOUNTS/WRITE' or 'STORAGEACCOUNTS/BLOBSERVICES/WRITE' operations that successfully modify the storage account configuration to allow public access.
This detection is designed to help you find activity related to Triofox CVE-2025-12480 (Host header localhost). It is based on the specific threat intelligence in the reference, so it focuses on concrete, easy-to-verify signals rather than vague patterns. It uses exact indicators and tightly scoped behaviors described in the referenced threat intelligence. A match does not automatically prove a compromise, and it does not prove the activity was successful, but it is a strong reason to investigate because the signal lines up with published reporting. When this fires, start by confirming which host, account, or server produced the event and whether the behavior is expected for that system. If it is not expected, preserve the relevant logs and files, check for repeated attempts over time, and look for nearby signs such as new admin accounts, unusual remote access, or suspicious downloads. Treat a match as a scoping signal and pivot to other telemetry around the same host, account, and time window. Use the reference link to document why you treated the alert as significant and to support incident notes.
Detects potential JSON Web Token (JWT) authentication bypass attempts where the algorithm in the token header is explicitly set to "none". A vulnerable server might skip signature validation for such tokens, allowing an attacker to forge arbitrary claims and potentially gain unauthorized access or escalate privileges.
Detects HTTP requests to the 'compcheckresult.cgi' script containing the unique parameter 'vXm8DtMJG'. This pattern is a strong indicator of the RESURGE webshell, which is injected into the CGI script on compromised Ivanti Connect Secure devices to allow for remote command execution.
Detects the Java process, commonly associated with Apache ActiveMQ, spawning certutil.exe to download a file from a remote URL. This behavior is a strong indicator of initial compromise via vulnerabilities like CVE-2023-46604.
Detects the execution of high-risk discovery or collection tools, such as vssadmin.exe, ntdsutil.exe, wevtutil.exe, certutil.exe, adfind.exe, dsquery.exe, klist.exe, or nltest.exe, when spawned by a BeyondTrust/Bomgar Remote Support session process (bomgar-scc.exe). This activity is indicative of post-exploitation behavior, potentially linked to intrusions described in CVE-2026-1731.
Detects when the BeyondTrust remote support client process ('bomgar-scc.exe' or 'bomgar-scc') spawns a shell or a common reconnaissance/downloader tool. This behavior is a strong indicator of post-exploitation activity related to vulnerabilities like CVE-2026-1731, where an attacker gains code execution and begins to explore the compromised system.
Detects HTTP requests to vulnerable Ivanti EPMM endpoints containing URI patterns associated with active exploitation of CVE-2026-1281 and CVE-2026-1340. The rule looks for specific URI paths and the presence of a 'gPath' parameter, which is indicative of an exploitation attempt.
This rule detects Windows Admin Center (WAC) creating a listening connection on its default port (6516) on internet-facing devices, specifically when the WAC version is not '2.6.4'. This could indicate an unpatched or vulnerable version of WAC exposed to the internet, potentially making it susceptible to exploitation.
Detects exploitation attempts of CVE-2026-22769 by identifying PUT requests directed at the Tomcat Manager application deployment endpoint. This is used by UNC6201 to deploy malicious WAR files containing the SLAYSTYLE webshell.
Detects suspicious web requests to the Tomcat Manager on Dell RecoverPoint appliances. This technique is used by UNC6201 to exploit CVE-2026-22769 and upload malicious WAR files.
Detects HTTP GET requests to Ivanti EPMM endpoints containing the 'gPath' parameter, which is indicative of exploitation attempts against CVE-2026-1281 and CVE-2026-1340.
Detects potential exploitation attempts against a buffer overflow vulnerability (CVE-2026-2329) in Grandstream VoIP phones. This rule identifies web requests targeting the vulnerable API endpoint '/cgi-bin/api.values.get' with an overly long query string (>64 bytes) or the use of multiple colons (>=3) which could indicate a ROP chain attempt. The detection is based on DeviceNetworkEvents from Microsoft Defender for Endpoint.
Page 72 of 102