Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
ET WEB_SPECIFIC_APPS Ivanti Connect Secure CRLF Injection Remote Code Execution Attempt (CVE-2024-37404)
This rule detects attempts to exploit a known authentication bypass vulnerability in Commvault via QCommand Argument Injection. The detection specifically looks for HTTP POST requests to the '/commandcenter/api/Login' endpoint with specific content in the request body, including '_localadmin__' and 'commserver', along with a PCRE match for '-cs' preceded by a space or URL-encoded space, indicating an attempt to inject arguments.
This rule detects an attempted Server-Side Request Forgery (SSRF) via External XML Entity (XXE) injection targeting Xerox FreeFlow Core. The detection is based on HTTP POST requests containing specific XML and entity declarations indicative of an XXE attack, followed by a SYSTEM entity referencing an HTTP URL, which is characteristic of an SSRF attempt.
ET WEB_SPECIFIC_APPS Guetebruck param.cgi group Parameter SQL Injection Attempt (CVE-2025-12463)
ET WEB_SPECIFIC_APPS IPFire ovpnclients.dat CONNECTION_NAME Parameter SQL Injection Attempt (CVE-2025-34304)
ET WEB_SPECIFIC_APPS Tenda SafeUrlFilter page Parameter Buffer Overflow Attempt (CVE-2025-12233)
ET WEB_SPECIFIC_APPS Tenda webExcptypemanFilter page Parameter Buffer Overflow Attempt (CVE-2025-12273)
ET WEB_SPECIFIC_APPS better-auth Unauthenticated API Key Creation (CVE-2025-61928)
ET WEB_SPECIFIC_APPS Nagios Log Server Admin API Credential Disclosure (CVE-2025-44823)
ET WEB_SPECIFIC_APPS Brickcom camerainfo.cgi a Parameter Information Disclosure Attempt (CVE-2017-9238)
ET WEB_SPECIFIC_APPS Brickcom configfile.dump action Parameter Information Disclosure Attempt (CVE-2017-9238)
ET WEB_SPECIFIC_APPS OptiLink/GPON admin/formTracert target_addr Parameter Command Injection Attempt (CVE-2025-34049)
ET WEB_SPECIFIC_APPS TVT language Command Injection Attempt (CVE-2025-34036)
This rule detects attempts to exploit a buffer overflow vulnerability in Tenda routers via the `/goform/exeCommand` endpoint. Specifically, it looks for HTTP POST requests to this URI where the `cmdinput` parameter contains an unusually long string (100 characters or more) which is indicative of an attempt to overflow a buffer.
This rule detects attempts to exploit a command injection vulnerability in the DCN ip_block.php script. It specifically looks for HTTP POST requests to '/function/audit/newstatistics/ip_block.php' with an 'ip' parameter in the request body that contains command injection characters such as semicolons, newlines, backticks, pipes, or dollar signs.
This rule detects attempts to exploit an authentication bypass vulnerability (CVE-2025-54253) in Adobe Experience Manager Forms. The detection is based on specific HTTP URI patterns and content within the request, including '/adminui/updateLicense1.do', 'login. ', and 'debug=command', which are indicative of an exploit attempt against the application.
This rule detects attempts to exploit an XML External Entity (XXE) injection vulnerability in Adobe Experience Manager Forms. The detection logic specifically looks for HTTP POST requests to the '/edcws/services/urn:EDCLicenseService' URI containing '<EDCSecurity>' and '<!ENTITY' patterns in the request body, along with a PCRE regex to identify the XXE payload structure.
This rule detects attempts to exploit an insecure deserialization vulnerability (CVE-2025-49533) in Adobe Experience Manager Forms. The detection is based on specific HTTP URI patterns and content within the request body, looking for '/FormServer/servlet/GetDocumentServlet' followed by 'serDoc=' and 'H4sIAA', which are indicators of a serialized object being sent to the server.
This rule detects attempts to exploit a buffer overflow vulnerability in the `SetNetControlList` function of Tenda routers. Specifically, it looks for HTTP POST requests to the `/goform/SetNetControlList` URI where the `list` parameter in the request body is excessively long (100 characters or more). This vulnerability (CVE-2025-9087, CVE-2025-29215, CVE-2025-1897) could lead to denial of service or arbitrary code execution.
This rule detects an attempt to exploit a buffer overflow vulnerability (CVE-2025-9297) in Tenda networking equipment. Specifically, it looks for HTTP POST requests to the '/goform/wxportalauth' URI where the 'type' parameter in the request body contains a string of 100 or more characters, indicating a potential buffer overflow attempt.
This rule detects attempts to exploit a command injection vulnerability in B-Link devices, specifically targeting the `/goform/set_hidessid_cfg` endpoint with the `enable` parameter. Attackers can inject commands by manipulating the `enable` parameter in a POST request, indicated by the presence of command separators like semicolon, newline, backtick, pipe, or dollar sign.
Page 80 of 102