Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,577
8,388
6,215
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
This rule monitors network logs (from proxies and firewalls) for web traffic (HTTP GET requests) containing suspicious JavaScript code injection patterns in the request context or message fields. It specifically looks for common XSS indicators such as <script tags, eval(), document.write(), fromCharCode(), and atob().
Detects evidence of successful cache poisoning exploitation in Next.js applications by identifying specific marker files ('VULNERABILITY_CONFIRMED.marker' and 'evidence.json') created in conjunction with active 'next start' or 'next build' processes. This pattern aligns with Proof of Concept (PoC) code targeting object argument collisions.
Detects incoming HTTP requests to Microsoft Exchange servers containing malicious X-AnonResource-Backend or X-BEResource headers, which are indicative of an attempt to exploit the ProxyLogon SSRF vulnerability (CVE-2021-26855).
Detects attempts to exploit the Log4Shell vulnerability (CVE-2021-44228) by monitoring HTTP headers for JNDI lookup strings. The rule inspects traffic for malicious patterns like '${jndi:ldap://', '${jndi:rmi://', or '${jndi:dns://', which are used to trigger remote code execution in vulnerable Java applications.
Detects attempts to exploit Apache Struts vulnerabilities by identifying OGNL (Object-Graph Navigation Language) expressions (starting with %{ or ${) within the Content-Type HTTP header, combined with requests to .action or .do endpoints.
Detects attempts to exploit the ProxyShell vulnerability (CVE-2021-34473) in Microsoft Exchange servers. The rule identifies malicious path traversal sequences, specifically utilizing encoding techniques like double URL encoding (%25) or dot-dot-slash characters within requests to the Autodiscover service, aimed at bypassing security controls.
Detects network exploitation attempts related to the Log4j vulnerability (CVE-2021-44228), where an adversary sends an HTTP request containing a JNDI lookup string (e.g., ldap://, rmi://, dns://) designed to trigger a remote code execution via vulnerable Log4j libraries.
Detects HTTP POST requests containing patterns associated with the Spring4Shell vulnerability (CVE-2022-22965). The rule specifically looks for payloads manipulating 'class.module.classLoader' or 'class.classLoader.resources.dirContext' to achieve Remote Code Execution (RCE) on vulnerable Spring Framework applications.
This rule monitors for HTTP POST requests containing 'class.module.classLoader', which is a characteristic payload component used to exploit the Spring4Shell vulnerability (CVE-2022-22965) in Spring Framework applications. This vulnerability allows for remote code execution (RCE) by manipulating class loader properties.
Detects incoming HTTP requests to Microsoft Exchange servers containing malicious X-AnonResource-Backend or X-BEResource headers, which are indicative of an attempt to exploit the ProxyLogon SSRF vulnerability (CVE-2021-26855).
Detects successful network or explicit credential logons (4624/4648) on Windows workstations where the username or workstation name contains keywords associated with Tenable Nessus scanning activity, indicating an authenticated vulnerability scan.
Detects Active Directory logons (Event IDs 4624, 4768, 4769) originating from the Fortinet SSL VPN IP pool. In the context of the FortiBleed credential-harvesting campaign, attackers utilize compromised Fortinet VPN credentials to immediately pivot into internal Active Directory environments. Because pure Sigma rules evaluate a single log source, this rule targets the Windows AD telemetry. To achieve the highest fidelity, this rule should be correlated in your SIEM with FortiGate SSL VPN tunnel-up events (e.g., Event Code 32130, 39424) originating from anomalous external IPs for the same principal within a short time window.
Detects the addition of users to specific high-value or sensitive groups in Microsoft Entra ID (Azure AD), which could indicate potential unauthorized privilege escalation or persistence attempts by an attacker.
Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall.
This behavior was observed in pair with modification of VPN SSL settings.
This behavior was observed in pair with modification of VPN SSL settings.
Detects suspicious child processes spawned by Microsoft Office applications (Word, Excel, WordPad, Outlook) which are characteristic of exploitation attempts, such as CVE-2017-0199. The rule monitors for execution of command-line tools (mshta, powershell, cmd, wscript, cscript) known to be used by malicious macro-enabled documents or exploit documents to download and execute secondary payloads.
Detects the execution of child processes (mshta, cmd, powershell, wscript, cscript) spawned by Microsoft Word (winword.exe), which is a common post-exploitation pattern for Remcos RAT delivered via malicious RTF documents utilizing CVE-2017-0199 remote template injection.
Detects potential exploitation of CVE-2017-0199 where Microsoft Office applications (winword.exe or eqnedt32.exe) spawn suspicious child processes (mshta.exe, wscript.exe, cscript.exe, powershell.exe, or cmd.exe) often associated with malicious document-based payloads like Remcos RAT. The rule monitors for both process spawning patterns and command-line arguments indicative of remote payload retrieval.
Detects messages sent within Microsoft Teams from an external tenant that contain potentially malicious indicators, such as URL shorteners, external links, or references to executable file extensions. This rule is designed to identify potential spearphishing or social engineering attempts originating from external Microsoft 365 tenants.
Detects anomalous device code authentication sessions originating from non-corporate IP addresses using common command-line user agents, which are immediately followed by a device registration event by the same user. This pattern is indicative of OAuth device code phishing, where an attacker tricks a user into authorizing a malicious application to access their account.
This rule detects post-exploitation activity on Microsoft Exchange Servers by monitoring for w3wp.exe (IIS worker process) spawning command-line interpreters such as cmd.exe, powershell.exe, or pwsh.exe. This behavior is indicative of an attacker leveraging a web shell, often deployed via the exploitation of vulnerabilities like ProxyLogon (CVE-2021-26855), ProxyNotShell (CVE-2022-41082), or similar remote code execution flaws targeting Exchange endpoints.
This rule detects potentially malicious Wi-Fi network enumeration or profile creation using 'netsh' or 'nmcli', as well as the loading of 'wlanapi.dll' by non-standard, unauthorized processes. Such activities can indicate an attempt by an adversary to discover, connect to, or exfiltrate data via nearby wireless networks.
Page 31 of 235