Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
This detection identifies potential exploitation attempts of the CVE-2024-5806 vulnerability in Progress MOVEit Transfer. It looks for log entries indicating failures to access the certificate store, which can occur when an attacker attempts to exploit the authentication bypass vulnerability. This behavior is a key indicator of attempts to impersonate valid users without proper credentials. While certificate store access failures can occur during normal operations, an unusual increase in such events, especially from unexpected sources, may indicate malicious activity.
This analytic detects potential exploitation attempts against VMWare vRealize Network Insight, specifically targeting the CVE-2023-20887 vulnerability. It monitors web traffic for HTTP POST requests directed at the vulnerable endpoint "/saas./resttosaasservlet." Identifying this behavior is crucial for a SOC as it indicates an active exploit attempt. If confirmed malicious, the attacker could execute arbitrary code, leading to unauthorized access, data theft, or further network compromise.
Detects suspicious child processes spawned by the CrushFTP service that may indicate exploitation of remote code execution vulnerabilities such as CVE-2025-31161, where attackers can achieve RCE through crafted HTTP requests. The detection focuses on commonly abused Windows executables (like powershell.exe, cmd.exe etc.) that attackers typically use post-exploitation to execute malicious commands.
Detects potential exploitation attempts of CVE-2024-3400, an OS command injection vulnerability in Palo Alto GlobalProtect. The rule looks for suspicious strings indicating directory traversal or command injection within Palo Alto GlobalProtect logs.
Detects instances where an HTTP service on an OpenCanary honeypot has received a GET request. This indicates an adversary is interacting with the honeypot, likely as part of reconnaissance or initial access attempts.
This rule detects HTTP POST login attempts against an OpenCanary honeypot. OpenCanary is a honeypot designed to mimic various services to detect unauthorized access attempts. A 'logtype' of 3001 specifically indicates an HTTP service login attempt via a form POST, suggesting an adversary is trying to gain initial access or credentials by interacting with the emulated service.
This rule detects indicators of potential exploitation of CVE-2023-27997, a critical Fortigate SSL VPN vulnerability. It specifically looks for GET or POST requests to '/remote/hostcheck_validate' or '/remote/logincheck' URIs that also contain the 'enc=' parameter in the query string. These patterns are associated with attempts to exploit the vulnerability.
Detects exploitation attempts of the OWASSRF variant targeting Exchange servers. This variant uses the OWA endpoint to access the PowerShell backend endpoint, indicated by specific URI patterns and HTTP methods. The rule filters out common legitimate user agents to reduce false positives.
Detects exploitation activity of CVE-2023-46747, an unauthenticated remote code execution vulnerability in F5 BIG-IP. The rule looks for specific POST requests to '/mgmt/tm/util/bash' containing keywords related to form submission and user creation within the F5 BIG-IP Traffic Management User Interface (TMUI).
Detects potential exploitation attempts of CVE-2023-4966, a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability. The rule specifically looks for GET requests to '/oauth/idp/.well-known/openid-configuration' that result in a 200 HTTP status code, indicating a successful attempt to access this specific endpoint which is part of the vulnerability exploitation chain.
Detects exploitation activity targeting CVE-2023-46747, an unauthenticated remote code execution vulnerability in F5 BIG-IP. The rule specifically looks for POST requests to '/mgmt/tm/util/bash' containing hex-encoded or plain text strings related to '/tmui/Control/form' and 'form_page=%2ftmui%2fsystem%2fuser%2fcreate.jsp', which are indicators of the exploit attempting to create a new user.
Detects potential exploitation attempt of CVE-2023-4966, a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability, via proxy logs. This vulnerability allows for the disclosure of sensitive information, such as session tokens.
Detects exploitation attempts of CVE-2023-4966, a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability. The rule specifically looks for GET requests to '/oauth/idp/.well-known/openid-configuration' with an unusually long 'cs-host' header string, which is characteristic of the exploit.
Detects exploitation attempts of CVE-2023-22518 in Confluence Data Center / Confluence Server. This vulnerability allows an attacker to create admin accounts and execute arbitrary commands. The rule specifically looks for suspicious child processes like bash, curl, or wget being spawned by the Confluence Java process.
This rule detects file modifications to ASPX and ASHX files within the root of the 'App_Extensions' directory by the 'ScreenConnect.Service.exe' process. This activity is indicative of exploitation of CVE-2024-1708, a ZipSlip vulnerability in ConnectWise ScreenConnect versions prior to 23.9.8, which allows for path traversal and arbitrary file write.
Detects exploitation attempts of CVE-2023-4966, a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability. The detection logic specifically looks for GET requests to '/oauth/idp/.well-known/openid-configuration' with an unusually long host header string (150 characters or more) in proxy logs. This pattern is indicative of the 'Citrix Bleed' exploit.
Detects exploitation attempts of the OWASSRF vulnerability targeting Microsoft Exchange servers using publicly available Proof-of-Concept (POC) code. This exploit leverages the Outlook Web Access (OWA) endpoint to gain access to the PowerShell backend endpoint, indicated by specific URI patterns, HTTP method, user-agent, and a successful HTTP status code.
Detects exploitation attempts of CVE-2023-22518 in Confluence Data Center / Confluence Server, where an attacker can exploit vulnerable endpoints to create admin accounts and execute arbitrary commands. Specifically, this rule looks for suspicious child processes like cmd.exe or powershell.exe being spawned by Tomcat processes associated with Confluence.
Detects exploitation attempts of CVE-2023-22518 in Confluence Data Center and Confluence Server. This vulnerability allows an attacker to exploit specific endpoints to potentially create administrator accounts and execute arbitrary commands. The rule identifies POST requests to known vulnerable URIs associated with setup and restore actions, or server information, which are indicative of an exploitation attempt.
Detects exploitation attempts of CVE-2023-22518, an improper authorization vulnerability in Confluence Data Center and Server. Attackers can exploit vulnerable endpoints to create admin accounts or execute arbitrary commands. The rule specifically looks for POST requests to known vulnerable URIs associated with setup and restore functionalities.
Detects potential exploitation attempts of an undocumented Windows Server pre-authentication Remote Code Execution (RCE) vulnerability. The rule specifically looks for a new 'svchost.exe' process being created by another 'svchost.exe' process, both running with the '-k DHCPServer' command line argument, and under a Network Service account (covering multiple language settings). This pattern indicates an unusual execution flow that could be indicative of an RCE exploit targeting the DHCP Server service.
Page 95 of 102