Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
29 detections
Filters
Last updated
All Time
Detection languages
15
8
3
2
1
Contributors
7
5
5
4
2
Categories
19
12
7
4
4
Platforms
14
7
7
5
4
Products / Services
6
5
5
5
5
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
2
2
2
1
1
IDS Classtypes
2
IDS Protocols
2
Detects potential Server-Side Template Injection (SSTI) attacks targeting the Flocci API Gateway using Velocity Template Language (VTL). The rule monitors for malicious VTL patterns in network traffic, subsequent OS command execution, anomalous file creation indicating RCE, and IAM scope bypass patterns in cloud environment logs.
Detects Server-Side Template Injection (SSTI) attempts targeting the Floci API Gateway, specifically looking for Velocity Template Language (VTL) payloads intended to trigger Remote Code Execution via 'java.lang.ProcessBuilder', along with indicators of an IAM credential scope bypass.
Detects potential Velocity Template Language (VTL) injection attacks targeting API Gateway environments. The rule identifies suspicious payloads in HTTP request bodies or URLs that attempt to leverage Java-based classes (e.g., ProcessBuilder) for code execution. It also monitors for IAM scope bypass attempts, abnormal HTTP method/path combinations associated with API Gateway control-plane operations, and evidence of shell/system commands being spawned from API Gateway-related parent processes.
Detects attempts to exploit Velocity Template Language (VTL) injection vulnerabilities in the Floci API Gateway, specifically targeting MOCK integration configurations on port 4566. The rule monitors for the injection of malicious Java objects via response templates, deployment of these templates, and the execution of the RCE payload via a specific API endpoint path, including potential IAM enforcement bypass attempts.
Detects remote code execution (RCE) attempts targeting Flowise/floci API Gateway services through Velocity Template Language (VTL) server-side template injection. The rule monitors for malicious payload patterns involving Java class reflection (e.g., ProcessBuilder) and unauthorized access attempts through API Gateway endpoints, including potential IAM scope bypass signatures.
Detects Log4Shell JNDI injection attempts
Detects Server-Side Template Injection (SSTI) and subsequent Remote Code Execution (RCE) attempts within the Floci API Gateway environment. The rule monitors for suspicious child processes spawned by the Floci JVM (e.g., shell execution), the creation of specific RCE proof-of-concept marker files, and the execution of associated exploitation tooling or IAM-bypass command arguments.
Detects the instantiation of the Shell.Explorer.1 COM object via OLE in RTF documents, which is indicative of an attempt to exploit CVE-2026-21509 (PRISMEX). This vulnerability allows for potential arbitrary code execution.
Detects Microsoft Word making an outbound network connection and subsequently spawning the Equation Editor process (EQNEDT32.EXE). This behavior is associated with the exploitation of CVE-2017-11882 via a malicious remote template.
This rule detects HTTP requests originating from Microsoft Office Word that are attempting to fetch remote templates with specific file extensions (.dotx, .dotm, .dot). This behavior can be indicative of malicious documents attempting to retrieve external content, often used in phishing or malware delivery campaigns to bypass security controls or fetch additional stages of an attack.
Detects Office documents fetching remote templates for template injection attacks
This rule detects attempts to inject remote office templates via HTTP. It specifically looks for HTTP traffic flowing to the client that contains both 'attachedTemplate' and 'http' (case-insensitive) in the file data, indicating a potential attempt to load a remote template.
Detects SSTI attempts sent via GET requests in access logs
This rule detects potential exploitation attempts targeting Ivanti EPMM vulnerabilities (CVE-2025-4427/4428) and subsequent post-exploitation activities. It has two main parts:
1. Web Request Analysis: It identifies web requests to the `/api/v2/featureusage` endpoint that contain suspicious patterns indicative of command injection or expression language injection attempts.
2. Process Creation Analysis: It looks for unusual process creations where Java or Tomcat-related processes (`java.exe`, `javaw.exe`, `catalina.bat`, `catalina.sh`) spawn command-line interpreters (`cmd.exe`, `bash`, `sh`, `powershell.exe`) or processes whose command lines contain keywords like `sliver` or `implant`, suggesting the deployment of malicious implants or sleeper shells.
1. Web Request Analysis: It identifies web requests to the `/api/v2/featureusage` endpoint that contain suspicious patterns indicative of command injection or expression language injection attempts.
2. Process Creation Analysis: It looks for unusual process creations where Java or Tomcat-related processes (`java.exe`, `javaw.exe`, `catalina.bat`, `catalina.sh`) spawn command-line interpreters (`cmd.exe`, `bash`, `sh`, `powershell.exe`) or processes whose command lines contain keywords like `sliver` or `implant`, suggesting the deployment of malicious implants or sleeper shells.
Detects Microsoft Word making an outbound network connection and subsequently spawning the Equation Editor process (EQNEDT32.EXE). This behavior is associated with the exploitation of CVE-2017-11882 via a malicious remote template.
KQL Query from file: CVE-2025-21298 Zero-Click RCE
This query visualises total emails with Malware detections over time summarizing the data daily by Malware detection technologies/controls used for detecting unknown-unique malware.
Detects set value ms-msdt MSProtocol URI scheme in Registry that could be an attempt to exploit CVE-2022-30190.
This query visualises total emails with Phish detections over time summarizing the data daily by Phish detection technologies/controls used for detecting unknown-unique phish
Detects set value ms-msdt MSProtocol URI scheme in Registry that could be an attempt to exploit CVE-2022-30190.
This query helps reviewing malicious email detections by detection methods
Page 1 of 2