Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
This rule detects the creation of a new process where the parent process is 'svchost.exe' with the command line containing '-k RPCSS'. This specific parent process signature is associated with the Remote Procedure Call (RPC) service. The rule aims to identify unusual child processes spawned by the RPC service, which could indicate an exploitation attempt of vulnerabilities like CVE-2022-26809. It's considered a 'long shot' detection, meaning it targets anomalous behavior rather than a direct exploit signature.
Detects suspicious DNS queries to external service interaction domains often used for out-of-band interactions after successful RCE
Detects an attempt to leverage the vulnerable servlet "mboximport" for an unauthenticated remote command injection in Zimbra Collaboration Suite Email Server, specifically targeting CVE-2022-27925. The rule looks for POST requests to the '/service/extension/backup/mboximport' endpoint with specific query parameters ('account-name', 'ow', 'no-switch', 'append') and then checks for subsequent requests to '/zimbraAdmin/*.jsp' with a 200 status code, indicating potential successful exploitation and web shell access.
Detects errors in NodeJS applications related to process execution, specifically looking for the keyword 'node:child_process'. These errors, especially if triggered by user input, may indicate an attempted Remote Code Execution (RCE) vulnerability exploitation.
Detects a process spawned by the terminal service server process (termsvcs), which could indicate an exploitation attempt of CVE-2019-0708, commonly known as BlueKeep. The rule specifically looks for processes where the parent command line contains both 'svchost.exe' and 'termsvcs', while filtering out legitimate processes like rdpclip.exe, csrss.exe, wininit.exe, and winlogon.exe.
Detects exploitation of the DNS RCE vulnerability (CVE-2020-1350) by monitoring for suspicious sub-processes spawned by the `dns.exe` service. This rule specifically looks for processes created by `dns.exe` that are not common or expected system processes, indicating potential post-exploitation activity after successful exploitation of the vulnerability.
Detects possible successful exploitation of CVE-2021-26858 (ProxyLogon) by monitoring for the creation of non-standard files by the Exchange Server's Unified Messaging service (UMWorkerProcess.exe). This activity could indicate the dropping of web shells or other malicious content post-exploitation.
Detects the spawning of suspicious child processes by an Atlassian Confluence server, specifically looking for shell interpreters (sh, bash, dash, ksh, zsh, csh, fish), curl, wget, or python being executed as child processes of the Confluence Java process. This behavior is indicative of successful exploitation of CVE-2022-26134, a critical remote code execution vulnerability in Atlassian Confluence. The rule focuses on the post-exploitation phase where an attacker would execute commands on the compromised server.
Detects exploitation attempts targeting Pulse Secure VPN appliances via CVE-2019-11510. Specifically, it looks for requests to a URI path containing '/dana/html5acc/guacamole/', which is indicative of an attacker attempting to access the Guacamole component of the Pulse Secure appliance.
Detects exploitation attempts targeting the F5 BIG-IP vulnerability CVE-2020-5902. The rule looks for specific URI query patterns indicative of directory traversal within the '/tmui/' or '/hsqldb' paths, which are known to be vulnerable.
Detects the exploitation of the VMware vSphere Remote Code Execution vulnerability (CVE-2021-21972) by identifying HTTP POST requests to the '/ui/vropspluginui/rest/services/uploadova' endpoint. This specific URI indicates an attempt to upload a malicious OVA file, which is the vector for the RCE.
Detects attempts to exploit the Atlassian Bitbucket Command Injection vulnerability (CVE-2022-36804) via the archive API. The rule specifically looks for requests to the '/rest/api/latest/projects/' endpoint containing 'prefix=' and the command injection payload '%00--exec' in the URI query.
Detects potential exploitation attempts of CVE-2023-2283, an authentication bypass vulnerability in libSSH. The exploitation method causes an error message indicating that keys for curve25519 could not be generated. This error message serves as a sign of an exploitation attempt, not necessarily a successful exploitation.
Detects process execution related exceptions in JVM based applications, which can often indicate Remote Code Execution (RCE) attempts. The rule specifically looks for keywords like 'Cannot run program', 'java.lang.ProcessImpl', and 'java.lang.ProcessBuilder' in application error logs.
This rule detects attempts to exploit CVE-2019-3398, a path traversal vulnerability in Confluence. The detection logic specifically looks for HTTP POST requests to '/upload.action' containing the path traversal sequence 'filename=../../../../'. This pattern indicates an attempt to upload a file to an arbitrary location on the server, which is characteristic of the CVE-2019-3398 exploitation.
Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability (CVE-2020-10189) by monitoring for suspicious child processes spawned by the Java executable associated with Desktop Central. This exploitation often leads to the execution of command-line utilities for further compromise.
Detects a potential exploitation attempt of CVE-2023-25717, a Remote Code Execution vulnerability via an unauthenticated HTTP GET Request, in Ruckus Wireless Admin. The rule looks for specific URI query parameters including '/forms/doLogin', 'login_username', 'password', and the presence of '$(' or its URL-encoded version '%24%28', which are indicative of command injection.
This rule detects potential local file read vulnerabilities in JVM-based applications by looking for specific keywords in application error logs. It triggers when a 'FileNotFoundException' occurs in conjunction with path traversal payloads like '/../../..'. This combination suggests an attacker is attempting to read arbitrary files from the system by manipulating input paths, which could lead to sensitive information disclosure.
Detects potential XML External Entity (XXE) exploitation attempts in JVM-based applications by looking for specific XML parsing error keywords in application error logs. These errors, such as 'SAXParseException' and 'DOMException', can indicate that an attacker is trying to manipulate XML input to access local files, perform server-side request forgery (SSRF), or execute other malicious actions. The rule is designed to identify issues where an application expects to work with XML and the parser might not be initialized safely.
Detects exploitation attempts against the Oracle WebLogic server vulnerability CVE-2021-2109. The rule specifically looks for GET requests containing 'com.bea.console.handles.JndiBindingHandle', 'ldap://', and 'AdminServer' in the URI query, which are indicators of an attempted JNDI injection via LDAP.
Detects exploitation attempts targeting the VMware View Planner vulnerability, CVE-2021-21978. This vulnerability allows for arbitrary file upload due to an unrestricted file upload flaw in the 'upload' function, specifically within the 'wsgi_log_upload.py' script. Attackers can leverage this to upload malicious files, potentially leading to remote code execution.
Page 98 of 102