Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
Detects attempts to exploit the ServiceNow 'BodySnatcher' vulnerability (CVE-2025-12420) by invoking the internal 'AIA-Agent Invoker AutoChat' topic to execute arbitrary AI agents.
Detects MongoDB instances with a vulnerable configuration where 'zlib' is enabled for network message compression. This configuration makes the server vulnerable to MongoBleed (CVE-2025-14847).
Detects high-volume vulnerability and spyware threat activity originating from external (UNTRUSTED) sources targeting public-facing IP addresses.
This detection identifies potential exploitation attempts, scanning activity, and malicious payload delivery by monitoring PAN-OS threat logs where severity is not informational and the subtype indicates vulnerability or spyware.
The rule triggers when:
A source IP generates ≥100 reset-both actions within 1 hour (indicative of blocked exploit or aggressive scanning), or
A source IP generates ≥10 non-reset actions within 1 hour (indicative of potentially successful or partially successful attempts)
Enrichment includes ASN, country, organization, and city to support attribution, threat hunting, and blocking decisions.
This detection identifies potential exploitation attempts, scanning activity, and malicious payload delivery by monitoring PAN-OS threat logs where severity is not informational and the subtype indicates vulnerability or spyware.
The rule triggers when:
A source IP generates ≥100 reset-both actions within 1 hour (indicative of blocked exploit or aggressive scanning), or
A source IP generates ≥10 non-reset actions within 1 hour (indicative of potentially successful or partially successful attempts)
Enrichment includes ASN, country, organization, and city to support attribution, threat hunting, and blocking decisions.
This rule detects an attempt to exploit an XML External Entity (XXE) vulnerability in GeoServer's Web Map Service (WMS) GetMap function. The detection logic looks for HTTP POST requests to the '/wms?' endpoint containing 'request=GetMap' in the URI, and specific XML elements like '<StyledLayerDescriptor>', '<!DOCTYPE', '<!ENTITY', and 'SYSTEM' within the request body, along with a URL-like pattern '://' indicating an attempt to fetch external content.
Detects HTTP POST requests to n8n '/form/*' endpoints where the Content-Type header is 'application/json'. This indicates an attempt to exploit the Content-Type confusion vulnerability (CVE-2026-21858) to achieve arbitrary file read and subsequent remote code execution.
The rule detects potential exploitation attempts by identifying a single source IP that generates a high number of connection events (>= 100) but a very low rate of client metadata exchanges (<= 10%). This pattern, combined with a high connection rate, is strong evidence of an anomalous interaction consistent with a network-based vulnerability scan or exploitation attempt.
Detects HTTP POST requests containing WDDX XML payloads that attempt to exploit a deserialization vulnerability in Adobe ColdFusion (CVE-2023-26359). The attack leverages a JNDI injection with the 'com.sun.rowset.JdbcRowSetImpl' gadget chain.
This query identifies devices that have accepted inbound web traffic (ports 80/443) where the accepting process is IIS worker (w3wp.exe) or IIS Express (iisexpress.exe). It focuses on public IPv4 sources (excluding RFC1918/private, loopback, and IPv6), helping you surface internet-exposed web servers that are actively receiving external connections.
This rule detects successful administrative logins to Fortinet devices (FortiGate, FortiWeb, FortiProxy, FortiSwitchManager) that leverage the FortiCloud SSO mechanism from an IP address not on an allowlist. This could indicate exploitation of CVE-2025-59718 and CVE-2025-59719, which allow for an authentication bypass.
Detects potential exploitation of Oracle E-Business Suite vulnerability CVE-2025-61882, which allows for unauthenticated remote code execution. This rule looks for specific web request URIs, post-exploitation process activity, and known indicators of compromise (IOCs).
Detects exploitation of a remote code execution vulnerability (CVE-2025-61882) in Oracle E-Business Suite. The attack involves an authentication bypass followed by the upload and execution of a malicious XSLT template, leading to command execution and potential web shell deployment.
Detects multiple large POST requests to Next.js or React Server Component (RSC) endpoints from the same source IP. This pattern can indicate attempts to exploit unsafe deserialization vulnerabilities like React2Shell (CVE-2025-55182) by sending a crafted, oversized payload.
Detects potential exploitation attempts against Next.js applications vulnerable to CVE-2025-66478 (React2shell). The rule looks for POST requests to Next.js Server Action endpoints with an unusually large request body, which may indicate a malicious payload designed to trigger a deserialization RCE.
Detects React2Shell exploitation attempts via prototype pollution and Node.js
gadget invocation. Covers vulnerability scanning, gadget testing, and active
RCE exploitation.
gadget invocation. Covers vulnerability scanning, gadget testing, and active
RCE exploitation.
Detects attempts to exploit CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) by identifying Prototype Pollution vectors (__proto__, constructor) specifically targeting the React Flight protocol (RSC headers/params). Covers both clear-text and common JSON escape sequences. The rule also correlates with 500 errors to identify potential successful exploitation or blind probing attempts.
Detects attempts to exploit CVE-2025-55182 (Next.js/React) via Server Actions. Target is identified by the 'Next-Action' header or 'RSC' markers, combined with JSON prototype pollution vectors in the body.
Detects attempts to exploit CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) utilizing data from the Imperva WAF leveraging vm#, child_process#, util_#, & fs_# indicators.
Detects potential exploitation attempts against Next.js applications vulnerable to CVE-2025-66478 (React2shell). The rule looks for POST requests to Next.js Server Action endpoints with an unusually large request body, which may indicate a malicious payload designed to trigger a deserialization RCE.
Detects attempts to exploit CVE-2025-55182 by injecting prototype pollution vectors ("__proto__", "constructor") into React Server Component (RSC) or Next.js Server Action requests. This vulnerability allows for Remote Code Execution via object serialization flaws.
Detects attempts to exploit a path traversal vulnerability (CVE-2025-64446) in FortiWeb. Attackers send a crafted POST request to create a new administrative user by targeting a specific URI and including keywords in the request body indicative of new admin creation.
Detects HTTP requests targeting the Oracle Identity Manager REST API that contain known authentication bypass suffixes, such as `?WSDL` or `;.wadl`. This indicates an attempt to exploit the initial authentication bypass stage of the CVE-2025-61757 exploit chain.
Page 74 of 102