Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
Detects the SolarWinds Web Help Desk service process (java.exe) launching shell or installer processes to download payloads from suspicious domains. This behavior is consistent with the exploitation of CVE-2025-26399 as reported by Huntress.
Detects potential exploitation of Apache bRPC command injection vulnerability (CVE-2025-60021) via the /pprof/heap endpoint.
This rule detects suspicious child processes spawned by 'WsusService.exe', which is indicative of successful exploitation of a vulnerability like CVE-2025-59287. The rule specifically looks for the WSUS service initiating common command-line utilities such as cmd.exe, powershell.exe, curl.exe, wget.exe, certutil.exe, bitsadmin.exe, and msiexec.exe, which are often used for post-exploitation activities like command execution, downloading additional payloads, or system manipulation. The severity is dynamically assigned based on the spawned process, with download utilities like curl.exe, certutil.exe, and bitsadmin.exe being flagged as 'Critical'.
Detects network traffic on TCP port 18789, the default gateway port for OpenClaw. Monitoring for unauthorized external access to this port helps identify exposed admin dashboards or exploitation.
The rule detects attempts to exploit Ivanti EPMM vulnerabilities CVE-2025-4427 and CVE-2025-4428. Specifically, it looks for unauthenticated or suspicious requests to the `/api/v2/featureusage` endpoint that contain parameters indicative of exploitation, such as `format` parameters with values like `${`, `Runtime`, `exec`, or `getRuntime`.
Detects HTTP POST requests to n8n webhook endpoints containing patterns associated with CVE-2026-25049, a type confusion vulnerability leading to Remote Code Execution. The detection looks for specific JavaScript destructuring or property access patterns used to bypass sanitization.
This rule detects attempts at command injection within the username field during authentication on Palo Alto firewalls. It specifically looks for patterns indicative of shell injection, including backtick-wrapped payloads (relevant to CVE-2024-9474), command separators like ';', '&&', '||', command substitution using '$()', directory traversal attempts ('../', './'), and the presence of common command-line utilities such as 'wget', 'curl', 'chmod', 'sh', 'bash', and 'nc' within the authentication message. The detection is based on system logs that record user authentication attempts.
Detects DNS lookups to known Out-of-Band Application Security Testing (OAST) domains. These are often used by attackers to verify successful exploitation of vulnerabilities like SSRF or RCE.
Detects the SolarWinds Web Help Desk service process (java.exe or wrapper.exe) spawning shell processes or the MSI installer to download and execute remote payloads. This behavior is a key indicator of post-exploitation activity related to CVE-2025-26399.
This detection identifies common web attack patterns including SQL Injection (SQLi), Cross-Site Scripting (XSS), and Local File Inclusion (LFI) by inspecting URL and POST data for specific malicious patterns. It looks for indicators such as script tags, onerror/onload attributes, javascript: URIs, alert() functions for XSS; SQL keywords like UNION SELECT, xp_cmdshell, sp_configure, and common SQLi bypass patterns for SQLi; and directory traversal sequences (../../, ..%2f..%2f), and sensitive file paths like /etc/passwd, /windows/win.ini, php://filter for LFI.
Detects incoming network traffic from external IP addresses to common AI agent and model gateway ports (e.g., Ollama, vLLM, ClawdBot). This could indicate an exposed, unauthenticated service vulnerable to hijacking, potentially leading to unauthorized access or data exfiltration.
Detects inbound network connections from external (non-loopback, non-private) IP addresses to ports commonly used by Clawdbot/Moltbot gateways (3000, 8080, 16007). An exposed gateway is a significant security risk that can allow unauthorized remote administrative control over the AI agent.
Detects exploitation attempts and worm-like scanning behavior targeting Next.js applications, characteristic of the EtherRAT malware. The rule identifies web requests with the 'x-middleware-subrequest' header (CVE-2025-29927) or scanning of sensitive paths like '/_next/data/' from internal sources.
Detects incoming network traffic from external IP addresses to common AI agent and model gateway ports (e.g., Ollama, vLLM, ClawdBot). This could indicate an exposed, unauthenticated service vulnerable to hijacking, potentially leading to unauthorized access or data exfiltration.
Detects the execution of the 'login' process with the '-f' flag, which skips authentication. When spawned by 'telnetd', this is a strong indicator of exploitation of CVE-2026-24061, a critical authentication bypass vulnerability.
Detects attempts to exploit the Apache bRPC heap profiler command injection vulnerability, CVE-2025-60021. This is done by monitoring for HTTP GET requests to the `/pprof/heap` endpoint where the `extra_options` parameter contains shell metacharacters indicative of an RCE attempt.
Detects instances where the telnetd process spawns the login binary with the '-f' flag. This behavior is indicative of exploitation of CVE-2026-24061, which allows an attacker to bypass authentication by injecting arguments into the login process via a crafted USER environment variable.
This rule detects suspicious Node.js activity potentially related to EtherRAT's React2Shell exploitation (CVE-2025-55182) and fileless execution. It looks for combinations of fileless Node.js execution patterns (using -e, --eval, or --input-type=module with common modules like require, import, fetch, http) alongside Ethereum RPC queries (eth_call, eth_getStorageAt, infura.io, alchemy.com, cloudflare-eth). It also identifies scenarios where Node.js is downloaded from nodejs.org and then persistence mechanisms are set up via .bashrc, .profile, .bash_profile, systemd, or cron. Another detection path involves fileless Node.js execution combined with systemd or cron persistence. The rule specifically targets Linux environments and process creation events.
This attack shares a lot of similarities with ClickFix/FileFix, AiTM phishing, and OAuth Consent Phishing. You can think of this as a browser-native ClickFix attack that phishes an OAuth token on a target app by getting the victim to copy and paste a URL containing OAuth key material into a phishing page.
Detects an anomalously high rate of network connections to a MongoDB server from a single source IP, a pattern associated with the exploitation of MongoBleed (CVE-2025-14847).
This rule detects inbound network connections to internet-facing devices on ports other than 80 (HTTP) or 443 (HTTPS). This could indicate an adversary attempting to establish command and control, exfiltrate data, or exploit services running on non-standard ports.
Page 73 of 102