Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
31 detections
Filters
Last updated
All Time
Detection languages
20
9
1
1
Contributors
6
5
4
3
3
Categories
16
14
6
4
3
Platforms
14
12
7
3
2
Products / Services
8
7
5
4
3
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
3
2
1
1
1
IDS Classtypes
1
IDS Protocols
1
Detects repeated PHP memory exhaustion (OOM) errors combined with segmentation faults or session warnings within a short timeframe, which may indicate application instability, resource exhaustion attacks, or exploitation attempts.
Detects inbound UDP traffic on port 443 (QUIC) targeting known HTTP/3-capable server processes (such as Caddy, Traefik, Cloudflared) followed closely by the termination or crash of that process, which may indicate an exploit attempt or vulnerability leading to denial of service.
Detects an inbound QUIC/UDP port 443 burst targeting a Bun process (bun.exe or bun) from external IP addresses, followed by the process going completely silent on the network within a short time window. This pattern correlates with potential exploitation or denial-of-service conditions involving network parsing anomalies.
Detects repeated PHP memory exhaustion (OOM) errors combined with segmentation faults or session warnings within a short timeframe, which may indicate application instability, resource exhaustion attacks, or exploitation attempts.
Detects repeated crashes or restarts of the Citrix NetScaler packet engine (nsppe) correlated with a concurrent spike in inbound DTLS traffic. This pattern is indicative of potential memory-overflow exploitation attempts (consistent with CVE-2026-88772) targeting the VPN virtual server functionality, leading to a Denial of Service (DoS) condition.
This rule detects potential exploitation of CVE-2026-86134, a NULL pointer dereference vulnerability in WatchGuard Fireware. It identifies a burst of authentication-related requests (login, authd, management) targeting a device, followed by system logs indicating a service crash, daemon restart, or core dump within a short correlation window. This behavior is indicative of a Denial of Service attack.
This rule detects potential exploitation of CVE-2026-86134, a NULL pointer dereference vulnerability in WatchGuard Fireware. It identifies a burst of authentication-related requests (login, authd, management) targeting a device, followed by system logs indicating a service crash, daemon restart, or core dump within a short correlation window. This behavior is indicative of a Denial of Service attack.
This rule detects potential exploitation of CVE-2026-86134, a NULL pointer dereference vulnerability in WatchGuard Fireware. It identifies a burst of authentication-related requests (login, authd, management) targeting a device, followed by system logs indicating a service crash, daemon restart, or core dump within a short correlation window. This behavior is indicative of a Denial of Service attack.
Detects anomalous process behavior potentially related to the RoguePlanet exploit or Poseidon-like thread I/O saturation techniques. This rule identifies processes performing high-frequency file creation in the system temporary directory using UUID-formatted filenames while simultaneously spawning a large number of threads, a pattern often used to widen race conditions for Time-of-Check Time-of-Use (TOCTOU) exploitation.
Detects opportunistic lock (oplock) placement on wermgr.exe alternative data streams or volume shadow copy paths. This behavior is associated with the RoguePlanet exploit chain, which attempts to pause the Microsoft Defender service (MsMpEng.exe) by creating a Time-of-Check to Time-of-Use (TOCTOU) race condition during the quarantine process.
Detects high-frequency file creation or modification events within directories matching the 'RP_<UUID>' naming pattern in Windows temporary folders. This behavior is indicative of Poseidon generator/worker threads attempting to cause I/O saturation to exploit Time-of-Check Time-of-Use (TOCTOU) vulnerabilities in security products like Microsoft Defender (MsMpEng.exe).
Detects segmentation faults or memory corruption crashes in vLLM components associated with media decoding, indicated by specific keywords in syslog messages. This rule aims to identify potential exploitation attempts related to CVE-2026-22778.
Detects Shellshock bash CGI exploitation attempts
CVE-2026-42945, dubbed "NGINX Rift," is a critical (CVSS 9.2) heap buffer overflow vulnerability in the ngx_http_rewrite_module of NGINX Open Source, NGINX Plus, and related products. It is triggered when a specific rewrite configuration pattern—using an unnamed PCRE capture (e.g., $1) with a replacement string containing a question mark (?)—is combined with a subsequent rewrite, if, or set directive. Exploitation can lead to reliable worker process crashes (Denial of Service) and, under certain conditions such as disabled ASLR, unauthenticated Remote Code Execution (RCE)
Detects Windows Error Reporting (Event ID 1000) events associated with lsass.exe crashes. Memory corruption exploits, such as CVE-2026-41089 (Netlogon RCE), often cause service instability. Monitoring for lsass.exe crashes can reveal failed exploitation attempts or other critical system issues.
Detects Shellshock bash CGI exploitation attempts
This rule detects attempts to exploit applications for denial of service by looking for the string "${jndi:" (case-insensitive) within the HTTP URI. This pattern is commonly associated with JNDI injection vulnerabilities, which can be leveraged for various attacks, including denial of service. The rule is configured to trigger an alert if 10 such attempts are observed from the same destination IP within 30 seconds.
Audit CVE Event
Sigma
Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.
Detects multiple crashes from key iOS system processes within a short time window. This pattern is indicative of a failed memory corruption attempt, consistent with the sandbox escape and privilege escalation techniques used by the DarkSword exploit kit.
Detects network connections to Hugging Face to download a large Large Language Model (LLM) module, a technique used by the SURXRAT Android RAT to induce network lag and degrade device performance.
Detects the creation of a symbolic link or junction point by a non-elevated process where the target is a critical system file or directory. This is a key step in exploits like CVE-2025-0921, where a privileged process is tricked into writing to a sensitive location by following a malicious link.
Page 1 of 2