Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE.
Java Payload Strings
Sigma
Detects possible Java payloads in web access logs
Detects path traversal exploitation attempts
Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation
Detects potential JNDI Injection exploitation. Often coupled with Log4Shell exploitation.
Detects XML parsing issues, if the application expects to work with XML make sure that the parser is initialized safely.
Detects SQL error messages that indicate probing for an injection attack
Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell.
SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
Detects an issue in apache logs that reports threading related errors
Detects potential SQL injection attempts via GET requests in access logs.
Detects external disk drives or plugged-in USB devices.
Detects suspicious file type dropped by an Exchange component in IIS
Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which could be a sign of ProxyShell exploitation
Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)
Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.
Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.
Detects a suspicious program execution in Outlook temp folder
Alerts on trust record modification within the registry, indicating usage of macros
Detects suspicious Django web application framework exceptions that could indicate exploitation attempts
Generic rule for SQL exceptions in Python according to PEP 249
Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts
Page 233 of 235