Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,918 detections
Filters
Last updated
All Time
Detection languages
2,238
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
807
765
577
Platforms
1,844
1,022
856
814
658
Products / Services
988
596
477
456
383
MITRE Techniques
18,116
15,636
12,583
8,393
6,224
4,918
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
ET WEB_SPECIFIC_APPS Kaseya VSA Authenticated SQL Injection in exportFldr (CVE-2021-30117)
ET WEB_SPECIFIC_APPS Tenda SafeMacFilter page Parameter Buffer Overflow Attempt (CVE-2025-12234)
ET WEB_SPECIFIC_APPS Ilevia index.php error Parameter Cross Site Scripting Attempt
ET WEB_SPECIFIC_APPS ICTBroadcast Command Injection (CVE-2025-2611)
ET WEB_SPECIFIC_APPS Gladinet CentreStack and Triofox Local File Inclusion (CVE-2025-11371)
ET WEB_SPECIFIC_APPS Planet formPingCmd Multiple Parameters Command Injection Attempt (CVE-2025-54405, CVE-2025-54406)
ET WEB_SPECIFIC_APPS LILIN dvr_box Server Parameter Command Injection Attempt (CVE-2025-34132)
ET WEB_SPECIFIC_APPS Tenda SetIpMacBind Multiple Parameters Buffer Overflow Attempt (CVE-2025-9089, CVE-2025-1853, CVE-2024-40417, CVE-2023-41556, CVE-2023-40902, CVE-2023-40896)
ET WEB_SPECIFIC_APPS D-Link web_keyword.data Multiple Parameters Buffer Overflow Attempt
ET WEB_SPECIFIC_APPS D-Link wan_ping.data wan_ping Parameter Buffer Overflow Attempt
ET WEB_SPECIFIC_APPS D-Link jingx.data Multiple Parameters Buffer Overflow Attempt
ET WEB_SPECIFIC_APPS D-Link hictlist_show.data enable Parameter Buffer Overflow Attempt
ET WEB_SPECIFIC_APPS D-Link dns_more_check.data enable Parameter Buffer Overflow Attempt
ET WEB_SPECIFIC_APPS D-Link SetWLanRadioSecurity Multiple XML Tags Buffer Overflow Attempt (CVE-2023-44839, CVE-2022-46569)
ET WEB_SPECIFIC_APPS D-Link ipportFilter sip_address Parameter Buffer Overflow Attempt (CVE-2023-43240)
ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (guiasexo .com)
This rule detects attempts to exploit multiple command injection vulnerabilities (CVE-2025-9149, CVE-2025-10958, CVE-2025-10960, CVE-2025-10961) in Wavlink wireless.cgi. The detection is based on HTTP POST requests to '/cgi-bin/wireless.cgi' with specific parameters ('Guest_ssid', 'macAddr', or 'delete_list') followed by command injection characters such as semicolon, newline, or backtick.
Detects malformed DNG/TIFF image files used to deliver the LANDFALL Android spyware. These files contain an appended ZIP archive which holds the malicious components.
Detects suspicious access to multiple Azure Storage Accounts using a Shared Access Signature (SAS) token from a single external IP address. This pattern can indicate the use of a compromised, potentially overly permissive, SAS token for reconnaissance or lateral movement.
ET WEB_SPECIFIC_APPS IPFire dns.cgi TLS_HOSTNAME Parameter Cross Site Scripting Attempt (CVE-2025-34317)
ET WEB_SPECIFIC_APPS IPFire dnsforward.cgi REMARK Parameter Cross Site Scripting Attempt (CVE-2025-34305)
Page 146 of 235