Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
229 detections
Filters
Last updated
All Time
Detection languages
98
76
22
16
7
Contributors
67
65
42
13
8
Categories
104
61
51
44
34
Platforms
39,897
7,231
6,523
3,864
3,624
229
Products / Services
81
66
63
51
21
MITRE Techniques
93
61
42
27
19
CVEs
18
13
11
10
8
IDS Classtypes
48
11
6
5
3
IDS Protocols
33
28
14
This rule detects attempts to modify Cisco router firmware using ROMMONkit. It specifically looks for TCP traffic to the HOME_NET on port 23 (Telnet) containing the case-insensitive strings "rommon" and "tftpdnld". This combination suggests an attempt to interact with the router's ROM Monitor mode for firmware manipulation, often associated with malicious activities like installing backdoors or persistent malware.
This rule detects attempts to access a web page on an IoT device that contains both 'about' and 'firmware' in its URI, case-insensitively. This could indicate an attacker or researcher attempting to discover firmware details or disclosure pages on IoT devices, potentially as part of a reconnaissance effort.
This rule set detects indicators of compromise associated with the RESURGE activity targeting Ivanti Connect Secure devices, as described by CISA. It looks for specific file hashes, the presence of a covert socket path (.logsrv), and modifications to key Ivanti filesystem artifacts such as LD_PRELOAD, DSUpgrade.pm, coreboot.img, and scanner.py. A match indicates potential compromise and requires further investigation to confirm the asset role, timing of file appearance, and comparison with approved maintenance windows. If hits are found, collect logs and file copies, reduce external exposure, and look for unusual activity like unexpected administrator actions or unfamiliar outbound connections.
Detects attempts to execute the 'dsmain' utility with specific flags (-e, -d, -g) used by RESURGE for AES encryption/decryption of the coreboot RAM disk or to extract the vmlinux kernel image on Ivanti Connect Secure devices.
Detects HTTP requests attempting to exploit several IoT device vulnerabilities leveraged by the ShadowV2 botnet to spread. This rule looks for specific URI paths and command injection payloads associated with known CVEs.
ET WEB_SPECIFIC_APPS Tenda SetFirewallCfg firewallEn Parameter Buffer Overflow Attempt (CVE-2025-8810, CVE-2025-29358, CVE-2025-1851, CVE-2024-2809)
ET WEB_SPECIFIC_APPS Tenda SafeMacFilter page Parameter Buffer Overflow Attempt (CVE-2025-12234)
ET WEB_SPECIFIC_APPS Tenda openSchedWifi Multiple Parameters Buffer Overflow Attempt (CVE-2025-46035)
ET WEB_SPECIFIC_APPS D-Link SetWLanRadioSecurity Key Parameter Command Injection Attempt (CVE-2024-48634)
ET WEB_SPECIFIC_APPS D-Link SetWLanRadioSettings Multiple XML Tags Buffer Overflow Attempt (CVE-2023-44839, CVE-2023-43241)
ET WEB_SPECIFIC_APPS D-Link setMAC macCloneMac Parameter Buffer Overflow Attempt (CVE-2023-43237)
Detects attempts to exploit multiple vulnerabilities (CVE-2025-52905, CVE-2025-52906, CVE-2025-52907) in TOTOLINK X6000R routers. Attackers can leverage argument injection, unauthenticated command injection, and security bypasses through the '/cgi-bin/cstecgi.cgi' endpoint to achieve remote code execution or denial of service.
KQL Query
Goal: Find machines in the last N days where the SystemGuardSecurityLevel value NOW is less than it was BEFORE.
Step 1: Get a list of all security levels in the system where the level is not null.
Step 1: Get a list of all security levels in the system where the level is not null.
Establishes a baseline SystemGuardSecurityLevel and show the devices that are below that baseline.
See https://techcommunity.microsoft.com/t5/Microsoft-Defender-ATP/How-insights-from-system-attestation-and-advanced-hunting-can/ba-p/969252 for full details on this query.
And Device Boot Attestation Info and feel free to ping @DepletionMode or @flyingbluemonki on twitter.
See https://techcommunity.microsoft.com/t5/Microsoft-Defender-ATP/How-insights-from-system-attestation-and-advanced-hunting-can/ba-p/969252 for full details on this query.
And Device Boot Attestation Info and feel free to ping @DepletionMode or @flyingbluemonki on twitter.
Detects exploitation indicators of CVE-2022-42475, a heap-based buffer overflow vulnerability in FortiOS SSL-VPN's sslvpnd daemon. The rule specifically looks for the creation of known malicious files or configuration backups in specific directories, which are artifacts of successful exploitation.
This rule detects the Linux_Trojan_AcidRain malware by identifying specific byte patterns associated with its destructive capabilities. The rule looks for functions related to destroying files using ioctls, overwriting files, and redundant reboot attempts, indicating the presence of the AcidRain wiper malware.
Yara rule that detects AcidRain trojan.
Yara rule that detects KillDisk ransomware.
Page 11 of 11