Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
Detects the ToolShell exploit chain used against SharePoint servers. This exploit involves a POST request to ToolPane.aspx with a spoofed Referer header pointing to SignOut.aspx, which is a key indicator of this specific attack.
Microsoft Entra ID Protection can provide a broad range of risk detections that can be used to identify suspicious activity in your organization.
This KQL detection rule identifies and prioritizes high-fidelity user risk events in Azure AD. It focuses on high-fidelity risk event types, filtering out known, noisy, or low-fidelity events to ensure alerts are accurate, actionable, and reliable.
This KQL detection rule identifies and prioritizes high-fidelity user risk events in Azure AD. It focuses on high-fidelity risk event types, filtering out known, noisy, or low-fidelity events to ensure alerts are accurate, actionable, and reliable.
This rule detects web requests targeting SharePoint endpoints associated with the ToolShell exploit chain (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771). This activity is linked to the threat actor CL-CRI-1040 (also known as Storm-2603). The rule specifically looks for requests to "/_layouts/15/ToolPane.aspx" or "/_layouts/15/SignOut.aspx" that also contain suspicious strings indicative of command execution or file manipulation attempts, such as "cmd.exe", "powershell", "whoami", "ipconfig", "systeminfo", "&cmd=", or "&file=".
Detects HTTP requests attempting to exploit several IoT device vulnerabilities leveraged by the ShadowV2 botnet to spread. This rule looks for specific URI paths and command injection payloads associated with known CVEs.
Detects potential command injection attempts against Citrix NetScaler ADC and Gateway devices. This detection is based on the patterns described in a hypothetical proof-of-concept for CVE-2025-7775, which involves injecting shell commands and referencing sensitive system paths in HTTP requests.
Detects exploitation attempts targeting a code injection vulnerability in XWiki's SolrSearch macro (CVE-2025-24893). Attackers can inject malicious Groovy code through specially crafted requests to the SolrSearch endpoint, leading to unauthenticated remote code execution.
Detects the RedTail cryptominer targeting exposed Docker APIs by looking for specific HTTP request patterns, including the 'libredtail-http' user agent and 'docker.selfrep' parameter in the request body.
Detects attempts to exploit the Triofox authentication bypass vulnerability (CVE-2025-12480) by sending a request with a 'localhost' Host header from an external IP address to access administrative pages. This allows an attacker to create a new administrative account.
Hack Tool User Agent
Sigma
Detects suspicious user agent strings user by hack tools in proxy logs
ET WEB_SPECIFIC_APPS VMware Workspace ONE Access OAuth2TokenResourceController ACS Authentication Bypass (CVE-2022-22956)
ET WEB_SPECIFIC_APPS Oracle E-Business Suite (EBS) Authentication Bypass (SyncServlet) (CVE-2025-61882)
ET WEB_SPECIFIC_APPS Adobe ColdFusion Unauthenticated Remote Code Execution (CVE-2023-29300)
This rule detects attempts to exploit an insecure deserialization vulnerability (CVE-2025-53690) in Sitecore Experience Platform via exposed ASP.NET MachineKeys. It specifically looks for HTTP POST requests to '/sitecore/blocked.aspx' containing a '__VIEWSTATE' parameter with a highly encoded string, indicative of a crafted ViewState payload used in deserialization attacks.
ET WEB_SPECIFIC_APPS Oracle E-Business Suite (EBS) Template Manager Template Copy (CVE-2025-61882)
This rule detects an attempt to exploit a critical vulnerability (CVE-2025-31324) in SAP NetWeaver Visual Composer's Metadata Uploader. The exploit leverages unauthenticated HTTP GET or HEAD requests to the '/developmentserver/metadatauploader' URI, combined with specific characters in the URI parameters (semicolon, dollar sign, backtick, pipe, or their URL-encoded equivalents) that indicate an attempt to execute arbitrary commands. This vulnerability allows an unauthenticated attacker to achieve remote command execution on the affected SAP system.
ET WEB_SPECIFIC_APPS Oracle E-Business Suite (EBS) Unauthenticated Template Manager Template Preview (CVE-2025-61882)
ET WEB_SPECIFIC_APPS Oracle E-Business Suite (EBS) Template Manager Template File Add (CVE-2025-61882)
This rule detects an attempted exploitation of an insecure deserialization vulnerability (CVE-2025-10035) in Fortra GoAnywhere MFT. Specifically, it looks for HTTP POST requests to the '/goanywhere/lic/accept/' URI containing the string 'bundle=' in the request body, which is indicative of an attempt to trigger the vulnerability.
This rule detects attempts to exploit CVE-2021-20021, an unauthenticated arbitrary user creation vulnerability in SonicWall Email Security. The rule specifically looks for HTTP POST requests to the '/createou' URI with 'data=' in the request body, indicating an attempt to create a new organizational unit or user.
This rule detects an attempted remote code execution (RCE) vulnerability in Microsoft SharePoint, specifically CVE-2024-38018. The detection is based on an HTTP POST request targeting the `/_vti_bin/webpartpages.asmx` URI with a specific content pattern in the request body: `|3c|AttachedPropertiesShared|3e 2f|wE`. This pattern indicates an attempt to exploit a deserialization vulnerability within SharePoint's SPThemes functionality.
ET WEB_SPECIFIC_APPS Django Privilege Escalation via SQLi (CVE-2025-64459)
Page 75 of 102