Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
ET WEB_SPECIFIC_APPS IPFire vpnmain.cgi REMARK Parameter Cross Site Scripting Attempt (CVE-2025-34305)
ET WEB_SPECIFIC_APPS IPFire connscheduler.cgi ACTION_COMMENT Parameter Cross Site Scripting Attempt (CVE-2025-34305)
ET WEB_SPECIFIC_APPS IPFire dhcp.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34305)
ET WEB_SPECIFIC_APPS IPFire fwhosts.cgi PROT Parameter Cross Site Scripting Attempt (CVE-2025-34302)
ET WEB_SPECIFIC_APPS Tenda RouteStatic page Parameter Buffer Overflow Attempt (CVE-2025-12271)
ET WEB_SPECIFIC_APPS Adobe Commerce & Magento SessionReaper Unauthenticated Remote Code Execution (CVE-2025-54236)
ET WEB_SPECIFIC_APPS Adobe ColdFusion Access Control Bypass (CVE-2023-38205)
ET WEB_SPECIFIC_APPS Wavlink login.cgi pagelogin Parameter Buffer Overflow Attempt (CVE-2025-61128)
ET WEB_SPECIFIC_APPS Tenda openNetworkGateway wpapsk_crypto2_4g Parameter Buffer Overflow Attempt (CVE-2025-12619)
ET WEB_SPECIFIC_APPS IPFire mail.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34316)
ET WEB_SPECIFIC_APPS IPFire qos.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34310)
ET WEB_SPECIFIC_APPS IPFire firewalllogip.dat pienumber Parameter Cross Site Scripting Attempt (CVE-2025-34307)
ET WEB_SPECIFIC_APPS Tenda VirtualSer page Parameter Buffer Overflow Attempt (CVE-2025-12265)
ET WEB_SPECIFIC_APPS ASMAX CGI script system Parameter Command Injection Attempt (CVE-2009-5156)
ET WEB_SPECIFIC_APPS TVT queryDevInfo Information Disclosure (CVE-2024-7339)
ET WEB_SPECIFIC_APPS Tenda SetFirewallCfg firewallEn Parameter Buffer Overflow Attempt (CVE-2025-8810, CVE-2025-29358, CVE-2025-1851, CVE-2024-2809)
ET WEB_SPECIFIC_APPS D-Link SetWifiDownSettings Multiple XML Tags Buffer Overflow Attempt (CVE-2023-43235)
ET WEB_SPECIFIC_APPS Tenda addressNat Multiple Parameters Buffer Overflow Attempt (CVE-2025-12272)
This rule detects attempts to exploit CVE-2024-30043, a vulnerability in Microsoft SharePoint's SPXmlDataSource that allows for XML External Entity (XXE) injection. The rule specifically looks for HTTP responses containing SharePoint XML data source declarations and a 'DataFile' attribute with a path that starts with 'file://', 'smb://', or '\\', indicating an attempt to fetch local or network files.
This rule detects attempts to exploit a buffer overflow vulnerability in the 'index' parameter of the '/goform/WifiWpsStart' endpoint on Tenda Wifi routers. The detection is triggered by HTTP POST requests to this specific URI containing 'index=' followed by a string of 100 or more characters, indicating an attempt to overflow the buffer. This vulnerability could lead to denial of service or arbitrary code execution.
ET WEB_SPECIFIC_APPS Tenda SysRunCmd getui Parameter Buffer Overflow Attempt (CVE-2025-12622)
Page 77 of 102