Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,918 detections
Filters
Last updated
All Time
Detection languages
2,238
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
807
765
577
Platforms
1,844
1,022
856
814
658
Products / Services
988
596
477
456
383
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
4,918
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
This rule detects attempts to exploit a critical authentication bypass vulnerability (CVE-2025-54309) in CrushFTP's WebInterface. The exploit leverages an alternative channel to bypass authentication, specifically targeting the '/WebInterface/function/' URI with a 'command=login' parameter and a 'crushadmin' string in the 'as2-to' HTTP header. Successful exploitation could lead to unauthorized administrative access.
This rule detects attempts to exploit a command injection vulnerability (CVE-2025-57105) in D-Link devices. Specifically, it looks for HTTP GET requests to '/mng_platform.asp' where the 'addr' parameter contains characters commonly used for command injection, such as semicolons, newlines, backticks, pipes, or dollar signs, which could lead to arbitrary command execution on the device.
This rule detects an attempt to exploit a buffer overflow vulnerability (CVE-2025-9299) in Tenda routers. The exploit targets the `/goform/getMasterPassengerAnalyseData` endpoint via an HTTP POST request, specifically looking for an overly long 'time' parameter in the request body, which could lead to a buffer overflow.
Detects strong indicators of a successful device code phishing attack.
Detects malformed DNG/TIFF image files used to deliver the LANDFALL Android spyware. These files contain an appended ZIP archive which holds the spyware components.
Detects the occurrence of numerous space characters in RunMRU registry paths, which may indicate execution via phishing lures using clickfix techniques to hide malicious commands in the Windows Run dialog box from naked eyes.
Detects a spike in undeliverable emails, this can be an early indication of a targeted phishing campaign or a compromised user account.
Detects malformed DNG/TIFF image files containing an embedded ZIP archive, a technique used to deliver the LANDFALL Android spyware.
Detects the creation of a Keras model file (.keras) that contains suspicious file paths or URLs. This may indicate an attempt to exploit CVE-2025-12058 for local file inclusion or server-side request forgery (SSRF).
Detects the occurrence of numerous space characters in TypedPaths registry paths, which may indicate execution via phishing lures using file-fix techniques to hide malicious commands. This technique is often used to bypass security controls that might inspect the command line for malicious strings.
Detect the patten execution of the the brazilian malware Zapgrande
Detects when a successful multi-factor authentication (MFA) occurs due to the use of a bypass code in Cisco Duo. Bypass codes are temporary passcodes created by administrators for specific users to access Duo-protected applications, typically used as backup codes when users cannot use their enrolled devices. This rule identifies instances where such a bypass code facilitates a successful authentication.
This rule detects the usage of default credentials on assets by correlating vulnerability scan results from Qualys. Specifically, it looks for a predefined list of Qualys vulnerability IDs (QIDs) that indicate the presence of default credentials. The rule aims to identify systems that have not had their default passwords changed, which is a critical security hygiene practice.
Detects the use of command-line download tools to write a file with a web-related extension to a common web server directory. This behavior is consistent with webshell deployment, as seen in Sandworm campaigns.
Detects when a user creates a new secret within GitHub for an organization, environment, codespace, or repository. This activity is critical to monitor as secrets often contain sensitive credentials (e.g., API keys, tokens) that, if compromised or misused, can lead to unauthorized access, privilege escalation, or persistence within the GitHub environment. The rule specifically looks for audit log actions indicating the creation of these secrets.
Detects the creation of command-line interpreters (cmd.exe, powershell.exe) as child processes of Windows Server Update Services (WSUS) related process wsusservice.exe or w3wp.exe (WsusPool). This behavior is a key indicator of exploitation for critical remote code execution vulnerabilities such as CVE-2025-59287, where attackers spawn shells to conduct reconnaissance and further post-exploitation activities.
Detects when changes are made to the SSH certificate configuration of a GitHub organization, specifically the creation of an SSH certificate authority or the disabling of the requirement for members to use SSH certificates.
One of the ongoing threats that I feel we face daily is the use of multiple plugins and add-ons across various sites from devices so I focus on identifying common platforms where users might connect and utilize different features. I started with WordPress plugins to gather information and monitor user activity, particularly to stay informed about any connections to specific WordPress sites that employ unknown plugins.
Additionally, if you have installed a WordPress site on any of your devices and it is integrated with Microsoft Defender for Endpoint, this query can be adapted to detect the plugins in use by the users connectives —both from within and externally. It can also help identify potential attacks and vulnerabilities, such as outdated plugin versions.
Additionally, if you have installed a WordPress site on any of your devices and it is integrated with Microsoft Defender for Endpoint, this query can be adapted to detect the plugins in use by the users connectives —both from within and externally. It can also help identify potential attacks and vulnerabilities, such as outdated plugin versions.
Detects the addition of a new VPN SSL Web Portal on a Fortinet FortiGate Firewall. This activity can be an indicator of an adversary establishing persistence or initial access, especially when observed in conjunction with other modifications to VPN SSL settings. Attackers might add new web portals to maintain access to the network or to create new entry points.
This rule detects when an organization owner disables Dependabot alerts for private repositories or Dependabot security updates for all repositories within GitHub. Dependabot performs scans to detect insecure dependencies and sends alerts, so disabling these features can increase an organization's exposure to vulnerabilities.
This rule detects changes to self-hosted GitHub Actions runner configurations. These changes include actions such as removing a self-hosted runner from an organization or repository, creating or removing runner groups, and adding, removing, or updating runners within a runner group. Such modifications can indicate administrative actions related to CI/CD infrastructure, which should be validated for legitimacy.
Page 150 of 235