Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
This rule detects the use of weak or commonly abused passwords directly within command-line interfaces. Threat actors often use this method to create new user accounts with easily guessable or known compromised passwords. The rule specifically looks for a predefined list of weak passwords appearing in the command line of a process creation event.
This rule detects attempts to exploit CVE-2010-5278, a directory traversal vulnerability in MODx Revolution. Specifically, it looks for requests to `/manager/controllers/default/resource/tvs.php` with a `class_key` parameter containing a directory traversal sequence (`../../../../../../../../../../`) followed by `windows/win.ini%00`, indicating an attempt to read the `win.ini` file on a Windows server.
Detects exploitation attempts targeting CVE-2020-0688, a remote code execution vulnerability in Microsoft Exchange Server. The rule specifically looks for requests to '/ecp/default.aspx' containing '__VIEWSTATEGENERATOR=' and '__VIEWSTATE=' in the query string, which are indicators of the exploit.
This rule detects exploitation attempts using the Pulse Connect Secure (PCS) vulnerability CVE-2021-22893. The detection logic looks for specific URI query patterns commonly associated with this exploit.
Detects suspicious access to specific URLs associated with the exploitation of the ADSelfService Plus vulnerability CVE-2021-40539. Attackers have been observed targeting these URLs to exploit the vulnerability.
Detects exploitation attempts of Sitecore Experience Platform Pre-Auth RCE CVE-2021-42237. This vulnerability allows for remote code execution without authentication. The rule specifically looks for POST requests to the '/sitecore/shell/ClientBin/Reporting/Report.ashx' endpoint that result in a 200 HTTP status code, indicating a successful interaction with the vulnerable component.
Detects URL patterns indicative of ProxyShell exploitation attempts against Microsoft Exchange servers. The rule looks for specific URI query strings and HTTP status codes (401) that are characteristic of both failed and successful exploitation attempts.
Detects URL patterns and status codes that indicate a successful ProxyShell exploitation attack against Microsoft Exchange servers. The rule looks for requests to '/autodiscover.json' combined with specific URI paths like '/powershell', '/mapi/nspi', or '/EWS', and successful HTTP status codes (200 or 301).
Detects attempts to exploit the VMware Workspace ONE Access Authentication Bypass vulnerability (CVE-2022-31656). This vulnerability allows a malicious actor with network access to the UI to obtain administrative access without authentication by sending a specially crafted URI query.
Detects attempts to exploit an Apache Spark server via CVE-2022-33891, which is a shell command injection vulnerability, by looking for specific patterns in web server query strings.
This rule detects common SQL exception types in Python applications as defined by PEP 249. These exceptions (DataError, IntegrityError, ProgrammingError, OperationalError) indicate issues during database operations, which could range from malformed queries to database connectivity problems or constraint violations. While often benign, repeated or unusual occurrences of these errors could signal application vulnerabilities being exploited (e.g., SQL injection attempts leading to syntax errors) or other malicious database interactions.
This rule detects anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser. This indicates a potential compromise of user credentials or an attempt to bypass authentication mechanisms.
Detects attempts to exploit Apache Spark shell command injection vulnerabilities, specifically CVE-2022-33891, by monitoring for suspicious command-line executions involving 'id -Gn' as a child process of a bash shell. This indicates an attacker successfully injecting commands into the Spark environment.
This rule detects a specific threading-related error message in Apache HTTP Server error logs. The error message indicates an issue with priority changes for pthreads, specifically an assertion failure related to `__pthread_tpp_change_priority`. This could be indicative of an underlying problem with the Apache server's threading model, potentially caused by misconfigurations, incompatible modules, or resource exhaustion. While the rule itself doesn't directly detect an attack, such errors could be exploited or could be a symptom of a system under stress or compromise.
This rule detects successful attempts to exploit the IIS shortname vulnerability, which allows enumeration of folders when IIS uses an old .Net Framework. The detection logic looks for HTTP GET or OPTIONS requests to URIs containing '~1' and ending with 'a.aspx', combined with successful HTTP status codes (200 or 301). This pattern is indicative of a successful fuzzing scan for the IIS shortname vulnerability.
Detects the creation of files with '.one' or '.onepkg' extensions in suspicious or uncommon locations, which could indicate the abuse of OneNote attachments for malware delivery. The rule specifically excludes files created by the legitimate OneNote application running from its standard installation path.
Detects suspicious execution of Microsoft HTML Help (hh.exe) when it is launched from unusual or temporary directories, or with command-line arguments indicating potential malicious activity. Adversaries often abuse hh.exe to execute malicious code embedded within Compiled HTML (CHM) files, leveraging it as a living-off-the-land binary to bypass defenses and execute payloads. The rule specifically looks for hh.exe being executed from common temporary or user download paths, which are frequently used for initial access or staging.
Detects suspicious child processes spawned by the SQL Server process (sqlservr.exe). This activity is highly indicative of successful exploitation, such as Remote Code Execution (RCE) or SQL Injection, where an attacker leverages the SQL Server to execute arbitrary commands on the underlying operating system. The rule specifically looks for common system utilities and scripting interpreters that are often used by attackers for reconnaissance, persistence, or further compromise.
Detects the exploitation of the Microsoft Exchange vulnerability CVE-2020-0688, which is a remote code execution vulnerability. The rule specifically looks for an 'Error' level EventID 4 from the 'MSExchange Control Panel' provider, combined with the presence of '__VIEWSTATE=' in the event data, indicating an attempt to exploit the vulnerability via the Eventlog.
Detects exploitation attempts targeting the TerraMaster TOS vulnerability CVE-2020-28188. This rule specifically looks for GET requests to '/include/makecvs.php' with a '?Event=' parameter, combined with common command injection payloads such as 'curl', 'wget', '.py', '.sh', 'chmod', or '_GET' in the URI query.
Detects the exploitation of the Microsoft Exchange ProxyToken vulnerability (CVE-2021-33766), which is an authentication bypass. The rule looks for specific URI query patterns and HTTP POST methods combined with a 500 HTTP status code, indicating a potential exploitation attempt against the Exchange Control Panel (ECP) or related services.
Page 231 of 235