Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
1
1
1
Contributors
1
1
1
Categories
1
1
1
1
1
Platforms
1
1
1
Products / Services
1
1
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects critical log entries on MikroTik RouterOS devices that contain 'flagged' status messages following a system upgrade or maintenance. This pattern is indicative of potential post-exploitation activity or post-update integrity warnings identified in recent vulnerabilities affecting RouterOS.
This rule detects attempts to patch a Cisco IOS router image remotely via SSH. It specifically looks for the string "copy tftp flash" within TCP traffic destined for port 22 (SSH) on the home network, indicating a potential attempt to modify the router's operating system image from a TFTP server.
This detection identifies failed file download attempts on ESXi hosts by looking for specific error messages in the system logs. These failures may indicate unauthorized or malicious attempts to install or update components—such as VIBs or scripts
