Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
26 detections
Filters
Last updated
All Time
Detection languages
12
3
3
2
2
Contributors
7
4
3
3
3
Categories
15
9
6
6
5
Platforms
17
7
5
4
2
Products / Services
9
3
3
3
3
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
2
1
IDS Classtypes
2
1
IDS Protocols
3
Detects outbound HTTP requests to known domains or domains following a specific URI pattern associated with the delivery of SilverFox malware payloads.
Detects text/report artifacts (markdown, JSON, plain text) produced by an autonomous AI-driven vulnerability research pipeline that decompiles binaries, traces cross-references, hypothesizes memory-safety flaws, and generates/debugs proof-of-concept exploits
Detects text/report artifacts (markdown, JSON, plain text) produced by an autonomous AI-driven vulnerability research pipeline that decompiles binaries, traces cross-references, hypothesizes memory-safety flaws, and generates/debugs proof-of-concept exploits
Detects text/report artifacts (markdown, JSON, plain text) produced by an autonomous AI-driven vulnerability research pipeline that decompiles binaries, traces cross-references, hypothesizes memory-safety flaws, and generates/debugs proof-of-concept exploits
Detects the Hermes Agent/DeepSeek autonomous CVE-research pivot pattern — proxy traffic showing both a GitHub trending-PoC search sorted by stars and a CVSS/exploitability scoring pipeline query, indicating autonomous vulnerability research and target re-selection after a failed exploitation attempt.
Detects the presence of known exploit harness files or the execution of Python scripts and binaries associated with libssh2 publickey subsystem heap overflow and arbitrary free exploits (including proof-of-concept code and reproduction harnesses).
Detects the creation or modification of opportunistic locks (oplocks) involving Wermgr.exe copies located within Volume Shadow Copies or temporary directories using specifically crafted file streams (:WDFOO). This activity is a known technique used to perform Time-of-Check Time-of-Use (TOCTOU) race condition attacks to suspend security software or hold open race windows to evade detection by Windows Defender.
Detects instances where the OpenVPN Connect process spawns unexpected child processes. This behavior is consistent with the exploitation of OpenVPN ACE (Access Control Exploitation) vulnerabilities, where a malicious OpenVPN server pushes an 'echo' directive that decodes to a command and executes upon disconnection, bypassing client-side script execution restrictions.
This rule detects the presence and execution of files associated with the proof-of-concept (PoC) exploit for CVE-2026-55200, a remote code execution vulnerability in libssh2. The rule monitors for specific exploit binary names and directory structures commonly used by security researchers or attackers to test or exploit this vulnerability.
Detects potential exploitation of CVE-2026-20127 on SD-WAN controllers, specifically unauthorized SSH authentication to the vmanage-admin account followed by suspicious NETCONF activity, usage of unauthorized tenant list CSV files, or execution of suspicious tenant-upload scripts.
This rule detects potential container escape attempts utilizing Linux system calls such as 'unshare' or 'clone' with flags indicative of namespace manipulation (CLONE_NEWUSER, CLONE_NEWNET). It also detects the execution of suspected malicious binaries or traffic manipulation tools associated with 'packet_edit_meme' or 'act_pedit' activities, which are common in Linux-based exploitation scenarios.
This rule detects events generated by Microsoft Defender for Endpoint's Attack Surface Reduction (ASR) rules in either Audit or Block mode.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
Detects access to underground exploit kit purchase or sales platforms
This rule detects the download of known exploit kits by inspecting HTTP URI patterns. It specifically looks for the strings 'rig', 'fallout', 'spelevo', or 'purplefox' followed by 'kit' (case-insensitive) within the HTTP URI. The detection is triggered on traffic flowing to the client that is part of an established connection.
Detects access to platforms selling zero-day vulnerability intelligence
This rule detects specific JavaScript obfuscation patterns used by the Coruna exploit kit framework. The kit was observed being used by multiple threat actors, including UNC6353 and UNC6691. The rule looks for two distinct patterns in process command lines: a map/join/fromCharCode obfuscation pattern and an integer XOR obfuscation pattern, typically executed by JavaScript-enabled processes like web browsers or scripting hosts.
Intellexa PREYHUNTER - HTTP
Suricata
Intellexa PREYHUNTER - HTTP response contains distinctive iOS build/artifact strings
KQL Query from file: Detecting Palo Alto Firewall Exploits
KQL Query
KQL Query
'This hunting query looks in Azure Web Application Firewall data to find possible SpringShell Exploitation Attempt (CVE-2022-22965).
The Spring Framework is one of the most widely used lightweight open-source framework for Java. To exploit the vulnerability attackers can
send a specially crafted query to a web server running the Spring Core framework to change the target of logging facility and create a new
malicious JSP file in a location accessible by http requests. Attackers then make requests to the malicious backdoor to run system commands.
Reference: https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/'
The Spring Framework is one of the most widely used lightweight open-source framework for Java. To exploit the vulnerability attackers can
send a specially crafted query to a web server running the Spring Core framework to change the target of logging facility and create a new
malicious JSP file in a location accessible by http requests. Attackers then make requests to the malicious backdoor to run system commands.
Reference: https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/'
Page 1 of 2