Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
296 detections
Filters
Last updated
All Time
Detection languages
106
82
51
17
14
Contributors
78
53
49
19
17
Categories
193
87
58
58
49
Platforms
136
116
82
26
14
Products / Services
82
78
53
28
26
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
13
12
10
8
8
IDS Classtypes
39
17
12
7
3
IDS Protocols
35
24
10
8
4
Detects the creation of processes where the command line contains keywords such as 'cve' or 'vulnerability'. This could indicate attempts to exploit known vulnerabilities, perform vulnerability research, or execute tools related to vulnerability assessment.
Audit CVE Event
Sigma
Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.
This rule detects potential lateral movement attempts originating from IIS web servers (identified by 'w3wp.exe' as the initiating process) to other internal IP addresses using common lateral movement ports (SMB, RDP, WinRM, SSH). It specifically looks for successful network connections from an IIS server to a private IP address on one of the specified ports, where the remote IP is not the local IP.
Detects potential exploitation of CVE-2021-1675 / CVE-2021-34527 (PrintNightmare) via anomalous SMB access to the IPC$ share targeting the "spoolss" named pipe (AccessMask: 0x3).
This pattern is associated with RPC-based abuse of the Windows Print Spooler service, which may allow remote code execution or privilege escalation with SYSTEM privileges.
This pattern is associated with RPC-based abuse of the Windows Print Spooler service, which may allow remote code execution or privilege escalation with SYSTEM privileges.
Detects a Java process spawning a command shell to download a file using the certutil.exe utility. This behavior was observed in the exploitation of Apache ActiveMQ (CVE-2023-46604), where the threat actor used this technique to download a secondary payload.
Detects potential exploitation attempts against a buffer overflow vulnerability (CVE-2026-2329) in Grandstream VoIP phones. This rule identifies web requests targeting the vulnerable API endpoint '/cgi-bin/api.values.get' with an overly long query string (>64 bytes) or the use of multiple colons (>=3) which could indicate a ROP chain attempt. The detection is based on DeviceNetworkEvents from Microsoft Defender for Endpoint.
This rule set detects potential post-exploitation activity and exploitation attempts targeting Ivanti EPMM (formerly MobileIron Core). The first rule, `ivanti_epmm_java_spawns_shell`, identifies suspicious process creation where a Java or Tomcat process (parent process) spawns a shell process (cmd.exe, bash, sh, or powershell.exe). This behavior is indicative of an attacker gaining remote code execution and using the compromised Java/Tomcat process to execute system commands. The second rule, `ivanti_epmm_http_featureusage_exploit`, detects HTTP requests to the `/api/v2/featureusage` endpoint that contain parameters indicative of Expression Language (EL) injection or format string abuse, specifically looking for `format=` along with keywords like `${`, `Runtime`, `exec`, or `getRuntime` in the URL. This suggests an attempt to exploit a vulnerability in the Ivanti EPMM application to achieve remote code execution.
Detects the GNU telnetd service spawning the login binary with the '-f' flag, which is used to skip authentication. This is the primary indicator of the CVE-2026-24061 exploitation. This detection requires process creation logging on Linux, which can be enabled via tools like Sysmon for Linux.
Detects the exploitation of CVE-2026-24061, a critical authentication bypass vulnerability in GNU telnetd. The rule identifies when the 'telnetd' process spawns '/usr/bin/login' with the '-f' flag, which skips authentication and grants the attacker remote access.
Detects attempts to exploit an authentication bypass vulnerability in the Inetutils Telnet daemon. Attackers inject the '-f' flag into the 'USER' environment variable during Telnet negotiation to gain unauthorized shell access.
This rule detects activities associated with the EtherRAT self-propagating worm, specifically its module for scanning and exploiting vulnerable Next.js applications. It looks for combinations of mass port scanning tools (nmap, masscan, zmap, nc) targeting common web ports, logging of Next.js scan activities, `curl` commands with specific `Next-Action` headers indicative of Next.js exploitation, `node` or `nodejs` processes performing network connections to private IP ranges, and command lines containing patterns related to prototype pollution exploitation (e.g., `__proto__`, `constructor.prototype`). The rule correlates these activities to identify potential exploitation attempts against Next.js applications using the React2Shell vulnerability (CVE-2025-55182) and subsequent lateral movement or payload delivery.
Detects process crashes within the Samsung 'libimagecodec.quram.so' library, which could indicate an exploitation attempt related to the LANDFALL spyware (CVE-2025-21042, CVE-2025-21043).
Detects potential exploitation of Motex LANSCOPE Endpoint Manager (CVE-2025-61932). This rule identifies when a process listening on TCP port 443 receives an inbound connection and subsequently spawns a suspicious child process (like cmd.exe or powershell.exe), a behavior consistent with exploiting a remote service vulnerability.
This advanced hunting query detects CISA Alert (AA22-117A) 2021 Top Routinely Exploited Vulnerabilities https://www.cisa.gov/uscert/ncas/alerts/aa22-117a
This rule detects attempts to exploit CVE-2025-49706 in SharePoint by observing POST requests to a vulnerable aspx path, which could result in code execution or server compromise. Specifically, it looks for HTTP POST requests to URLs containing '/_layouts/1(5|6)/ToolPane.aspx' and 'DisplayMode=Edit' and 'a=/ToolPane.aspx', combined with a referrer URL ending in '/_layouts/1(5|6)/signout.aspx'. This combination of indicators suggests an attempt to leverage the vulnerability for unauthorized access or code execution.
This rule detects attempts to exploit CVE-2025-49706 in SharePoint by observing POST requests to a vulnerable aspx path, which could result in code execution or server compromise.
MCP Remote RCE Via Oauth
YARA-L
Detects potential remote code execution via a malicious OAuth URL in the mcp-remote proxy tool, indicative of CVE-2025-6514 exploitation.
Detects potential misuse of AI model APIs by correlating process creation, network activity, and non-standard AI service ports.
Covers Ollama, OpenAI, Azure OpenAI, Anthropic, Google Gemini, Mistral, Cohere, Copilot, OpenRouter, Together, and Perplexity.
Covers Ollama, OpenAI, Azure OpenAI, Anthropic, Google Gemini, Mistral, Cohere, Copilot, OpenRouter, Together, and Perplexity.
Detects scenarios where an attacker attempts to exploit the Zerologon vulnerabiliy which triggers, bsides others things, a password reset on a domain controller.
This rule detects attempts to exploit known CVEs on the network where the targeted device is identified as vulnerable to that specific CVE. It correlates network inspection signatures with vulnerability management data to identify high-confidence exploitation attempts.
This analytic detects activity associated with "Static Tundra" threat actor abuse of the Cisco Smart Install (SMI) protocol using Cisco Secure Firewall Intrusion Events. It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify occurrences of Smart Install exploitation and protocol abuse, including denial-of-service and buffer overflow attempts. The detection triggers when multiple Cisco Smart Install-related Snort signatures are observed in a short period from the same source, which is indicative of active exploitation or reconnaissance against Cisco devices that expose SMI.
Page 11 of 15