Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
Looks for exploitation attempt of CVE-2025-53770
This detection identifies potential exploitation attempts of CVE-2025-5777 (CitrixBleed 2), a memory disclosure vulnerability in Citrix NetScaler ADC and Gateway. The vulnerability is triggered by sending POST requests with incomplete form data to the /p/u/doAuthentication.do endpoint, causing the device to leak memory contents including session tokens and authentication materials. This search looks for POST requests to the vulnerable endpoint that may indicate scanning or exploitation attempts.
Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation.
This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.
This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.
This rule detects attempts at Local File Inclusion (LFI) or Remote File Inclusion (RFI) vulnerabilities by analyzing web server logs for specific patterns in the request URI. It looks for directory traversal sequences ('../'), attempts to access common sensitive files like '/etc/passwd', or patterns indicating file inclusion via HTTP or file:// protocols.
Detects HTTP POST requests containing suspicious parameters or headers used by GoldMelody's in-memory IIS modules. Attackers leverage ASP.NET ViewState deserialization to execute payloads in memory, often passing commands and data via non-standard HTTP parameters and headers within POST requests.
KQL Query
Detects TTPs and IOC´s associated with a cryptomining campaign that exploits exposed Java Debug Wire Protocol (JDWP) services. Attackers gain remote code execution to download and execute a dropper script (`logservice.sh`), which in turn deploys a modified XMRig miner disguised as `logrotate`. The malware establishes persistence through multiple methods, including systemd services, cron jobs, and shell startup scripts.
Detects exploitation attempts of CVE-2025-0108 via crafted path traversal requests targeting PAN-OS web management interface.
KQL Query from file: Sentinel All-In-One IP ThreatHunt
KQL Query
KQL Query from file: Detecting Palo Alto Firewall Exploits
KQL Query from file: Conditional Access Report
KQL Query from file: Threat Hunting BYOVD Scenarios
KQL Query
KQL Query
KQL Query
KQL Query from file: Threat Hunting Nation State Actors
KQL Query
KQL Query from file: KQL to check Azure API spray attacks
KQL Query from file: Perimeter Defense - Attack Surface Reduction
KQL Query from file: CVE-2024-7971 Patch Prioritization
Page 86 of 102