Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
Detects potential exploitation of FortiWeb CVE-2025-25257, a pre-authentication SQL injection vulnerability. This rule identifies an SQL injection attempt against the '/api/fabric/device/status' endpoint, followed by either a suspicious Python file drop in a library directory or a request to a specific CGI script used to trigger the payload.
This rule detects successful network connections from external (internet) IP addresses to common Industrial Control System (ICS) ports, such as Modbus (502) and EtherNet/IP (44818). This activity could indicate unauthorized access attempts, reconnaissance, or exploitation of internet-exposed ICS assets. The rule specifically filters for allowed/accepted/permitted connections and excludes connections from RFC 1918 private IP addresses and a configurable list of authorized external IPs.
Detects attempts to exploit CVE-2025-32433, a remote code execution vulnerability in the Erlang/OTP SSH daemon. The exploit involves sending SSH connection protocol messages (codes >= 80) before authentication is complete.
This analytic leverages alerts from Splunk AppDynamics SecureApp to identify and monitor exploit attempts targeting business applications. It specifically looks for vulnerabilities in web applications, including injection attacks (SQL, API abuse), deserialization vulnerabilities, remote code execution attempts, LOG4J, and zero-day attacks. These attacks typically aim to gain unauthorized access, exfiltrate sensitive data, or disrupt application functionality. Splunk AppDynamics SecureApp provides real-time detection by analyzing application-layer events and correlating attack behavior with known vulnerability signatures, categorizing attack severity, providing visibility into attacker tactics, and generating risk-based scoring and contextual alerts.
Detects attempts to exploit multiple buffer overflow vulnerabilities (CVE-2025-8184, CVE-2025-8169, CVE-2025-8168) in D-Link DIR-513 routers via the 'curTime' parameter in formSetWan endpoints.
CVE-2025-53770 is a critical zero-day vulnerability in on-premise Microsoft SharePoint Server, actively exploited in the wild, allowing unauthenticated remote code execution (RCE) with a CVSS score of 9.8. This means attackers can execute arbitrary code on a vulnerable server without needing login credentials.
Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation. This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.
This rule detects potential SQL injection attempts by looking for specific keywords and patterns within the 'cs_uri_query' field of Cloudflare WAF logs. These patterns, such as 'UNION SELECT', '' OR 1=1', 'information_schema', and '--', are commonly used in SQL injection attacks to extract information, bypass authentication, or comment out parts of SQL queries. The rule aims to identify malicious requests targeting web applications that could lead to unauthorized database access or manipulation.
Detects the creation of specific files (spinstall.aspx, spinstall?.aspx, debug_dev.js) within SharePoint's Web Server Extensions template layouts directory. This activity is indicative of successful exploitation of CVE-2025-53770, a zero-day vulnerability in SharePoint that allows remote code execution.
Detects network traffic to or from IP addresses known to be associated with the active exploitation of the SharePoint vulnerability CVE-2025-53770.
Detects malicious files (web shells, backdoors, and tools) associated with the exploitation of SharePoint vulnerabilities (e.g., CVE-2025-53770) by the threat actor Storm-2603. This rule matches known file hashes.
This rule detects exploitation attempts against SharePoint servers, specifically targeting CVE-2025-53770 (ToolShell). It has two parts: one for suspicious process creation (cmd.exe spawning powershell.exe from w3wp.exe) and another for malicious web request patterns in IIS logs (POST requests to /_layouts/15/ToolPane.aspx with specific query parameters and referrer).
Detects exploitation attempts of the SharePoint ToolShell 0-day (CVE-2025-53770) using known IOCs and behavior patterns
Microsoft Releases Guidance on Exploitation of SharePoint Vulnerability (CVE-2025-53770)
The following analytic detects potential post-exploitation activity related to the Microsoft SharePoint CVE-2025-53770 vulnerability. After successful exploitation via the ToolPane.aspx endpoint, attackers typically deploy a webshell named "spinstall0.aspx" in the SharePoint layouts directory. This detection identifies GET requests to this webshell, which indicates active use of the backdoor for command execution, data exfiltration, or credential/key extraction. Attackers commonly use these webshells to extract encryption keys, authentication tokens, and other sensitive information from the compromised SharePoint server.
The analytic detects potential exploitation attempts against Microsoft SharePoint Server vulnerability CVE-2025-53770, also known as "ToolShell". This detection monitors for POST requests to the ToolPane.aspx endpoint with specific DisplayMode parameter, which is a key indicator of the exploit. This vulnerability allows unauthenticated remote code execution on affected SharePoint servers, enabling attackers to fully access SharePoint content, file systems, internal configurations, and execute code over the network.
Detects access to vulnerable SharePoint components potentially being exploited in CVE-2025-53770 through IIS web server logs. CVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.
Detects potential exploitation attempts of the SharePoint vulnerability CVE-2025-53770 by looking for POST requests to ToolPane.aspx with a specific referrer.
This detection identifies the creation or modification of the "spinstall0.aspx" webshell file in Microsoft SharePoint directories. This file is a known indicator of compromise associated with the exploitation of CVE-2025-53770 (ToolShell vulnerability). Attackers exploit the vulnerability to drop webshells that provide persistent access to compromised SharePoint servers, allowing them to execute arbitrary commands, access sensitive data, and move laterally within the network.
Detects potential exploitation of CVE-2025-53770, a zero-day vulnerability in SharePoint that allows remote code execution. The rule identifies indicators such as suspicious command lines discovered in post-exploitation activities, specifically looking for `w3wp.exe` as a parent process executing encoded commands or referencing `spinstall0.aspx` within SharePoint layout paths.
Device Triage
Page 85 of 102