Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
This analytic identifies the creation of suspicious .aspx or .ashx files in known drop locations for Exchange exploitation. Specifically, it targets paths associated with HAFNIUM group activity and vulnerabilities like ProxyShell and ProxyNotShell. This activity is a strong indicator of web shell deployment, a common method for persistent access and remote code execution. Successful exploitation could lead to unauthorized access, arbitrary command execution, and privilege escalation within the Exchange environment.
The following analytic identifies attempts to access the Remote ShellServlet on a web server, specifically targeting Confluence servers vulnerable to CVE-2023-22518 and CVE-2023-22515. It leverages web data to detect URLs containing "*plugins/servlet/com.jsos.shell/*" with a status code of 200. This activity is significant as it is commonly associated with web shells and other malicious behaviors, potentially leading to unauthorized command execution. If confirmed malicious, attackers could gain remote code execution capabilities, compromising the server and potentially the entire network.
This analytic detects unexpected outbound network connections initiated by known webserver processes such as `httpd.exe`, `nginx.exe`, or `tomcat.exe` to common file sharing or public content hosting services like GitHub, Discord CDN, Transfer.sh, or Pastebin. Webservers are rarely expected to perform outbound downloads, especially to dynamic or anonymous file hosting domains. This behavior is often associated with server compromise, where an attacker uses a reverse shell, webshell, or injected task to fetch malware or tools post-exploitation. The detection leverages Cisco Network Visibility Module flow data, enriched with process context, to identify this highly suspicious behavior.
The analytic detects long URLs containing multiple SQL commands, indicating a potential SQL injection attack. This detection leverages web traffic data, specifically targeting web server destinations with URLs longer than 1024 characters or HTTP user agents longer than 200 characters. SQL injection is significant as it allows attackers to manipulate a web application's database, potentially leading to unauthorized data access or modification. If confirmed malicious, this activity could result in data breaches, unauthorized access, and complete system compromise. Immediate investigation and validation of alerts are crucial to mitigate these risks.
This analytic detects the creation or modification of network interfaces on Cisco devices, which could indicate an attacker establishing persistence or preparing for lateral movement. After gaining initial access to network devices, threat actors like Static Tundra often create new interfaces (particularly loopback interfaces) to establish covert communication channels or maintain persistence. This detection specifically looks for the configuration of new interfaces, interface state changes, and the assignment of IP addresses to interfaces. These activities are particularly concerning when they involve unusual interface names or descriptions containing suspicious terms.
This analytic provides comprehensive monitoring of configuration changes on Cisco devices by analyzing archive logs. Configuration archive logging captures all changes made to a device's configuration, providing a detailed audit trail that can be used to identify suspicious or malicious activities. This detection is particularly valuable for identifying patterns of malicious configuration changes that might indicate an attacker's presence, such as the creation of backdoor accounts, SNMP community string modifications, and TFTP server configurations for data exfiltration. By analyzing these logs, security teams can gain a holistic view of configuration changes across sessions and users, helping to detect sophisticated attack campaigns like those conducted by threat actors such as Static Tundra.
This analytic detects oversized Cisco Smart Install (SMI) protocol messages by inspecting traffic to TCP port 4786 within the Network_Traffic data model. Abnormally large SMI payloads have been associated with exploitation and protocol abuse (e.g., CVE-2018-0171; activity reported by the "Static Tundra" threat actor). Monitoring message sizes over time can help identify possible attempts at remote code execution, denial of service, or reconnaissance against Cisco devices exposing Smart Install.
This analytic detects network traffic to TCP port 4786, which is used by the Cisco Smart Install protocol. Smart Install is a plug-and-play configuration and image-management feature that helps customers to deploy Cisco switches. This protocol has been exploited via CVE-2018-0171, a vulnerability that allows unauthenticated remote attackers to execute arbitrary code or cause denial of service conditions. Recently, Cisco Talos reported that a Russian state-sponsored threat actor called "Static Tundra" has been actively exploiting this vulnerability to compromise unpatched and end-of-life network devices. Monitoring for traffic to this port can help identify potential exploitation attempts or unauthorized Smart Install activity.
Detects an exploit attempt against Sitecore vulnerability CVE-2025-53690. This rule correlates an HTTP POST request to '/sitecore/blocked.aspx' with a subsequent 'ViewState verification failed' Windows Event Log (EID 1316) from the same source IP and target host.
Detects attempts to exploit the Sitecore Experience Platform HTML cache poisoning vulnerability (CVE-2025-53693). Attackers can send a crafted HTTP request to a specific XAML handler to poison the HTML cache, leading to website defacement or client-side code execution.
Detects attempts to exploit the Citrix NetScaler RCE vulnerability (CVE-2025-7775) by identifying a specific POST request to a vulnerable endpoint, followed by a GET request to verify code execution.
Detects suspicious child processes spawned by Citrix or Commvault services, which may indicate exploitation for initial access (T1190), as seen in MURKY PANDA campaigns involving CVE-2023-3519 and CVE-2025-3928.
Detects SQL injection attempts targeting FortiWeb (CVE-2025-25257) in HTTP GET requests to /api/fabric/device/status. The rule identifies known exploit payloads in the Authorization header, generic SQL injection patterns, and SQL statements like DROP, DELETE, INSERT, UPDATE, CREATE. It also detects known malicious source IPs targeting the vulnerable endpoint.
This analytic detects activity associated with "Static Tundra" threat actor abuse of the Cisco Smart Install (SMI) protocol using Cisco Secure Firewall Intrusion Events. It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify occurrences of Smart Install exploitation and protocol abuse, including denial-of-service and buffer overflow attempts. The detection triggers when multiple Cisco Smart Install-related Snort signatures are observed in a short period from the same source, which is indicative of active exploitation or reconnaissance against Cisco devices that expose SMI.
This detection rule identifies potential exploitation attempts of CVE-2024-36401, a JXPath injection vulnerability in GeoServer. Attackers can send malicious WFS, WMS, or WPS requests to achieve remote code execution. The rule looks for common GeoServer service paths and request types combined with Java code execution strings in web server or network logs.
Detects potential Remote Code Execution (RCE) on a FortiWeb device, possibly related to CVE-2025-25257. The rule correlates a suspicious web request to a potential 'fabric' endpoint with a subsequent shell or utility process launch by the web server process on the same device.
Detects payloads associated with the exploitation of GeoServer vulnerability CVE-2024-36401. This rule identifies both the initial shell script downloaders and the subsequent Dart-based ELF executables.
Detects attempts to exploit FortiWeb Pre-Auth SQL Injection leading to Remote Code Execution (CVE-2025-25257) via the /api/fabric/device/status endpoint. The rule specifically looks for SQL injection payloads, including boolean-based and INTO OUTFILE techniques, within the Authorization header of HTTP requests.
Detects attempts to exploit a remote code execution vulnerability (CVE-2024-36401) in GeoServer. Attackers leverage crafted JXPath queries in WFS, WMS, or WPS requests to execute arbitrary commands via Java's getRuntime().exec() method.
Detects a variety of post-exploitation techniques observed in attacks leveraging SonicWall vulnerabilities (CVE-2024-40766). These techniques are associated with the Akira ransomware group and include defense evasion, credential access, and data staging.
Detects potential exploitation attempts against Ivanti Connect Secure devices for vulnerability CVE-2025-22457. This vulnerability is actively exploited in the wild. Attackers can send an abnormally long string composed of digits and periods in the 'X-Forwarded-For' HTTP header to trigger a stack-based buffer overflow, which can lead to remote code execution.
Page 84 of 102