Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
ET WEB_SPECIFIC_APPS IPFire urlfilter.cgi BE_NAME Parameter Command Injection Attempt (CVE-2025-34312)
ET WEB_SPECIFIC_APPS IPFire time.cgi UPDATE_VALUE Parameter Cross Site Scripting Attempt (CVE-2025-34308)
ET WEB_SPECIFIC_APPS Atlassian Confluence Server-Side Request Forgery (CVE-2021-26072)
ET WEB_SPECIFIC_APPS Kaseya VSA Authenticated SQL Injection in exportFldr (CVE-2021-30117)
ET WEB_SPECIFIC_APPS Tenda SafeMacFilter page Parameter Buffer Overflow Attempt (CVE-2025-12234)
ET WEB_SPECIFIC_APPS Ilevia index.php error Parameter Cross Site Scripting Attempt
ET WEB_SPECIFIC_APPS ICTBroadcast Command Injection (CVE-2025-2611)
ET WEB_SPECIFIC_APPS Gladinet CentreStack and Triofox Local File Inclusion (CVE-2025-11371)
ET WEB_SPECIFIC_APPS Planet formPingCmd Multiple Parameters Command Injection Attempt (CVE-2025-54405, CVE-2025-54406)
ET WEB_SPECIFIC_APPS LILIN dvr_box Server Parameter Command Injection Attempt (CVE-2025-34132)
ET WEB_SPECIFIC_APPS Tenda SetIpMacBind Multiple Parameters Buffer Overflow Attempt (CVE-2025-9089, CVE-2025-1853, CVE-2024-40417, CVE-2023-41556, CVE-2023-40902, CVE-2023-40896)
ET WEB_SPECIFIC_APPS D-Link web_keyword.data Multiple Parameters Buffer Overflow Attempt
ET WEB_SPECIFIC_APPS D-Link wan_ping.data wan_ping Parameter Buffer Overflow Attempt
ET WEB_SPECIFIC_APPS D-Link jingx.data Multiple Parameters Buffer Overflow Attempt
ET WEB_SPECIFIC_APPS D-Link hictlist_show.data enable Parameter Buffer Overflow Attempt
ET WEB_SPECIFIC_APPS D-Link dns_more_check.data enable Parameter Buffer Overflow Attempt
ET WEB_SPECIFIC_APPS D-Link ipportFilter sip_address Parameter Buffer Overflow Attempt (CVE-2023-43240)
This rule detects attempts to exploit multiple command injection vulnerabilities (CVE-2025-9149, CVE-2025-10958, CVE-2025-10960, CVE-2025-10961) in Wavlink wireless.cgi. The detection is based on HTTP POST requests to '/cgi-bin/wireless.cgi' with specific parameters ('Guest_ssid', 'macAddr', or 'delete_list') followed by command injection characters such as semicolon, newline, or backtick.
ET WEB_SPECIFIC_APPS IPFire dns.cgi TLS_HOSTNAME Parameter Cross Site Scripting Attempt (CVE-2025-34317)
ET WEB_SPECIFIC_APPS IPFire dnsforward.cgi REMARK Parameter Cross Site Scripting Attempt (CVE-2025-34305)
ET WEB_SPECIFIC_APPS IPFire weakeonlan.cgi CLIENT_COMMENT Parameter Cross Site Scripting Attempt (CVE-2025-34305)
Page 78 of 102