Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
38 detections
Filters
Last updated
All Time
Detection languages
26
6
2
2
1
Contributors
8
7
4
4
3
Categories
19
16
13
10
5
Platforms
28
13
5
5
4
Products / Services
14
5
4
3
3
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
CVEs
1
1
1
1
IDS Classtypes
2
IDS Protocols
1
1
Detects instances of GitLab and Ruby running vulnerable software versions based on software inventory checks against fixed release versions.
Detects anomalous child process spawning from common web browsers or productivity applications (e.g., Office, Acrobat) on hosts that have recently communicated with known LLM or code-generation APIs. This behavioral correlation is intended to identify the potential execution of AI-generated exploit code.
Detects endpoint behavior consistent with AI-assisted exploit development, characterized by the execution of reverse engineering and vulnerability research tools (e.g., IDA Pro, Ghidra, AFL) interleaved with frequent outbound network connections to LLM APIs, followed by the local compilation of a new executable or DLL.
Detects endpoint behavior consistent with AI-assisted exploit development, characterized by the execution of reverse engineering and vulnerability research tools (e.g., IDA Pro, Ghidra, AFL) interleaved with frequent outbound network connections to LLM APIs, followed by the local compilation of a new executable or DLL.
Detects anomalous child process spawning from common web browsers or productivity applications (e.g., Office, Acrobat) on hosts that have recently communicated with known LLM or code-generation APIs. This behavioral correlation is intended to identify the potential execution of AI-generated exploit code.
Detects endpoint behavior consistent with AI-assisted exploit development, characterized by the execution of reverse engineering and vulnerability research tools (e.g., IDA Pro, Ghidra, AFL) interleaved with frequent outbound network connections to LLM APIs, followed by the local compilation of a new executable or DLL.
Detects repeated, suspicious HTTP requests targeting sensitive management or administrative interfaces (e.g., /admin, /wp-admin, /cgi-bin) that utilize obfuscated, unusually encoded payloads. This activity is consistent with automated attempts to exploit recently disclosed vulnerabilities where traditional WAF/IDS signatures have been bypassed or failed to trigger high-confidence alerts.
This rule aggregates vulnerability data from Microsoft Defender for Endpoint (Threat and Vulnerability Management) over the last 7 days. It groups vulnerable devices by CVE ID and severity level, providing an overview of known software weaknesses currently present across the fleet.
This rule identifies devices within the environment that are susceptible to CVE-2026-81963. It correlates vulnerability data with knowledge base information to flag the software, vendor, version, severity level, and the availability of public exploits for this specific vulnerability.
This rule identifies devices running specific outdated and vulnerable versions of WordPress (6.9.0 through 7.0.1) using data from the DeviceTvmSoftwareInventory table. Identifying these versions is critical for vulnerability management and patching, as these versions may be susceptible to known security exploits.
Detects the creation of processes where the command line contains keywords such as 'cve' or 'vulnerability'. This could indicate attempts to exploit known vulnerabilities, perform vulnerability research, or execute tools related to vulnerability assessment.
Detects the creation of processes where the command line contains keywords such as 'cve' or 'vulnerability'. This could indicate attempts to exploit known vulnerabilities, perform vulnerability research, or execute tools related to vulnerability assessment.
Detects responses from vLLM (or similar services) that leak a Python Imaging Library (PIL)/Pillow heap address through BytesIO exception text. This indicates Stage 1 of the CVE-2026-22778 ASLR bypass vulnerability, where memory addresses are exposed, which could be used by an attacker to bypass Address Space Layout Randomization (ASLR). The rule looks for specific error messages containing '_io.BytesIO object at 0x' followed by a hexadecimal address.
Detects downloads of CVE exploit proof-of-concept code
This rule detects suspicious JavaScript or HTML files that attempt to cloak browser fingerprints by manipulating WebGL renderer information, timezone settings, touch support, and tampering with the browser console or developer tools. It specifically looks for the co-occurrence of keywords related to these techniques within file names or the effective username associated with the file event.
Detects downloads of CVE exploit proof-of-concept code
Detects the creation of processes where the command line contains keywords such as 'cve' or 'vulnerability'. This could indicate attempts to exploit known vulnerabilities, perform vulnerability research, or execute tools related to vulnerability assessment.
This rule detects network connections to known vulnerability intelligence purchase platforms (zerodium.com, crowdfense.com, exodus.gl). These platforms are often used by threat actors to acquire zero-day exploits or other vulnerabilities. Accessing these sites could indicate an organization or individual is attempting to purchase or sell such intelligence, which can be a precursor to malicious activity or a violation of organizational policy.
Detects the creation of processes where the command line contains keywords such as 'cve' or 'vulnerability'. This could indicate attempts to exploit known vulnerabilities, perform vulnerability research, or execute tools related to vulnerability assessment.
This can be used as an alert that can be sent when a severe vulnerability affects your onboarded devices.
This rule identifies 'chokepoint' devices within an environment based on their high number of inbound and outbound connections (at least 2 each). It then enriches these chokepoint devices with vulnerability and misconfiguration remediation recommendations from Microsoft Defender for Endpoint (MDE) TVM and Exposure Graph. The rule prioritizes remediation based on the calculated 'ChokepointScore' (InboundCount * OutboundCount) and indicates if the device has active exploits. This helps security teams focus remediation efforts on critical assets that could significantly impact the network if compromised.
Page 1 of 2