Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
576 detections
Filters
Last updated
All Time
Detection languages
175
168
120
26
25
Contributors
96
80
79
77
61
Categories
297
296
144
138
69
Platforms
347
214
188
27
21
Products / Services
10,665
9,758
6,692
4,421
3,749
576
MITRE Techniques
286
211
161
144
130
CVEs
23
23
11
6
6
IDS Classtypes
15
1
1
1
1
IDS Protocols
19
This rule detects unauthorized requests to the '/api/tokens/import/txt' endpoint, which is associated with the 'Device Code Lab' token management panel. Such activity is indicative of an attacker importing stolen session tokens to maintain persistent access to a compromised environment.
This rule detects potential brute-force or credential stuffing attempts against web application authentication endpoints by monitoring patterns of success and failure. It aggregates requests over 5-minute intervals, calculating a risk score based on high volumes of authentication failures relative to successful requests from individual source IPs targeting sensitive API paths (e.g., auth, session, login, token).
Detects exploitation attempts of the MyBB limited Admin CP-to-Admin privilege escalation vulnerability. The detection looks for unauthorized HTTP POST requests to the user management module that assign the Administrator group (gid=4) to a new user, or access to sensitive super-admin-only modules by accounts that should not have such permissions. It also flags requests containing known PoC artifact identifiers.
Detects unauthenticated HTTP requests to sensitive Gitea endpoints containing the 'X-WEBAUTH-USER' header set to 'admin'. This rule identifies exploitation attempts against misconfigured Docker deployments where 'REVERSE_PROXY_TRUSTED_PROXIES' is improperly set to a wildcard, allowing unauthorized users to impersonate administrative accounts (CVE-2026-20896).
This rule detects potential unauthorized access and environment variable disclosure attempts against the Flowise API, specifically targeting the MCP (Model Context Protocol) endpoints. It monitors for path traversal-like patterns using case variants (e.g., /api/v1/env), unauthorized access to configuration endpoints, and the exposure of sensitive data like API keys, database URLs, and passwords in API responses or request headers.
Detects known suspicious (default) user-agents related to scanning/recon tools
Detects HTTP POST requests containing multipart form data that include suspicious PHP functions commonly associated with webshells, such as eval(), base64_decode(), system(), or passthru(). This indicates a potential attempt to upload or execute a malicious PHP script on a web server.
Detects the creation of files with extensions commonly associated with web shells (.php, .aspx, .jsp) within typical web application directories by common web server processes such as httpd, nginx, php-cgi, and w3wp. This activity is indicative of a potential web shell deployment for persistent access or command execution.
This rule detects post-exploitation activity related to the exploitation of PHP StreamBucket SOAP deserialization vulnerabilities. It monitors for child process execution from PHP web server processes (e.g., php-fpm, php.exe), the creation of specific proof-of-concept (PoC) marker files, and the presence of identified exploit script filenames on disk.
This rule detects potential brute-force or credential stuffing attempts against web application authentication endpoints by monitoring patterns of success and failure. It aggregates requests over 5-minute intervals, calculating a risk score based on high volumes of authentication failures relative to successful requests from individual source IPs targeting sensitive API paths (e.g., auth, session, login, token).
This rule detects potential brute-force or credential stuffing attempts against web application authentication endpoints by monitoring patterns of success and failure. It aggregates requests over 5-minute intervals, calculating a risk score based on high volumes of authentication failures relative to successful requests from individual source IPs targeting sensitive API paths (e.g., auth, session, login, token).
This rule detects HTTP POST requests to the MyBB admin panel (admin/index.php) that attempt to create or modify a user account with membership in the Administrator group (gid=4). The detection requires the presence of an administrator session cookie (adminsid), indicating an attempt by a lower-privileged administrative account to escalate privileges by assigning administrative roles to users.
Detects malicious activity associated with the exploitation of StreamBucket PHP vulnerabilities. The rule monitors for unexpected child processes spawned by PHP/web server processes, the creation of specific exploitation artifact files in /tmp, unauthorized reading of /proc/self memory files by PHP, and inbound SOAP-related HTTP requests.
Detects the execution of known MyBB 'Limited ACP to Admin' proof-of-concept scripts via common python interpreters and identifies suspicious child process spawning behavior from typical web server applications (such as nginx, apache2, and php-fpm). This activity is indicative of post-exploitation attempts or web shell execution via injected plugins or templates.
Detects anomalous external scanning activity against internal web applications by monitoring for multiple requests to sensitive URI paths associated with vulnerability exploitation (e.g., cgi-bin, admin-ajax.php, .env, or command execution endpoints) originating from external IP addresses to internal network space.
Detects anomalous, high-volume API requests to ServiceNow endpoints originating from the same source IP that lack valid authorization headers or session tokens, potentially indicating automated scanning, enumeration, or exploitation attempts.
Detects Server-Side Request Forgery (SSRF) attempts exploiting URL parser differentials. Attackers append a double-slash sequence to a legitimate github.com blob URL to trick the backend into resolving an absolute local filesystem path. The rule specifically targets sensitive paths such as /proc/self/environ, /var/task/, and application source files to perform Local File Read (LFR) or access internal cloud metadata services.
This rule detects anomalous, high-frequency HTTP POST requests directed at sensitive API endpoints related to payment, billing, or administration. By calculating requests per minute and identifying unique source IP behavior, it aims to flag potential automated brute-force attacks, unauthorized API discovery, or data exfiltration attempts against critical system management interfaces.
This rule monitors web server access logs for suspicious activity targeting sensitive Flowise API endpoints (credentials, variables, secretvariable, apikey). It flags two types of threats: 1) Case-bypass evasion attempts, where canonical endpoints are bypassed via non-standard casing while requesting sensitive data (e.g., matching a status 200 on non-canonical casing for sensitive paths), and 2) High-frequency requests indicative of bulk enumeration or directory/wordlist scanning.
Detects exploitation attempts against CVE-2026-33017, an unauthenticated remote code execution vulnerability in Langflow. The rule identifies suspicious HTTP POST requests directed at specific vulnerable API endpoints, looking for common Python code injection payloads (e.g., 'os.system', '__import__', 'subprocess') or the presence of a known dropper payload ('isp.sh') within the URI query. It also flags requests originating from common automation user agents like 'python-requests'.
This rule detects attempts to exploit CVE-2024-36401, a critical remote code execution vulnerability in GeoServer. The rule monitors inbound HTTP requests to GeoServer OWS or WFS endpoints for malicious patterns consistent with OGC filter expression injection, such as attempts to invoke Java Runtime process execution via crafted property names or OGC expressions.
Page 11 of 28