Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
599 detections
Filters
Last updated
All Time
Detection languages
198
163
131
22
20
Contributors
127
91
73
69
62
Categories
331
304
132
129
59
Platforms
340
214
204
30
27
Products / Services
10,665
9,773
6,705
4,421
3,749
599
MITRE Techniques
293
211
151
137
110
CVEs
23
23
10
6
6
IDS Classtypes
13
1
1
1
IDS Protocols
16
This rule detects potential brute-force or credential stuffing attempts against web application authentication endpoints by monitoring patterns of success and failure. It aggregates requests over 5-minute intervals, calculating a risk score based on high volumes of authentication failures relative to successful requests from individual source IPs targeting sensitive API paths (e.g., auth, session, login, token).
This rule detects potential brute-force or credential stuffing attempts against web application authentication endpoints by monitoring patterns of success and failure. It aggregates requests over 5-minute intervals, calculating a risk score based on high volumes of authentication failures relative to successful requests from individual source IPs targeting sensitive API paths (e.g., auth, session, login, token).
Detects outbound HTTP POST requests to dynv6 dynamic DNS providers containing specific multipart form data patterns, including filenames like 'Info.txt', indicative of data exfiltration by the Kimsuky threat group using custom C2 staging scripts.
This rule detects HTTP/1.1 requests containing an Upgrade header (specifically targeting WebSocket upgrades) accompanied by a non-zero Content-Length header. This pattern is characteristic of a request smuggling primitive targeting the nghttpx reverse proxy, where the provided body may be misinterpreted by the backend as a separate, smuggled request due to improper request queue handling.
Detects anomalous lateral movement or network pivoting activity originating from an internet-facing Nginx server. The detection identifies an incoming HTTP POST request from an external IP address followed immediately by an outbound network connection from that same Nginx server to an internal RFC1918 host on the FastCGI port (9000). This behavior is consistent with the 'Velvet Ant' operation's technique of abusing proxy_pass configurations to relay traffic into isolated internal network segments via FastCGI request-chaining.
Detects instances where the fcgiwrap or spawn-fcgi processes, commonly used for Nginx FastCGI handling, are observed spawning system utility binaries (such as uptime, id, ps, who, or hostname) from unconventional locations like /tmp, /var/tmp, /dev/shm, or /home. This behavior is associated with the Velvet Ant threat group for lateral movement and reconnaissance within segmented networks.
This rule detects HTTP POST requests to the MyBB admin panel (admin/index.php) that attempt to create or modify a user account with membership in the Administrator group (gid=4). The detection requires the presence of an administrator session cookie (adminsid), indicating an attempt by a lower-privileged administrative account to escalate privileges by assigning administrative roles to users.
Detects unauthorized HTTP requests to Gitea containing an 'X-WEBAUTH-USER' header set to 'admin'. This targets CVE-2026-20896, where a misconfigured reverse proxy trust setting allows external users to spoof authentication and gain administrative privileges.
Detects malicious activity associated with the exploitation of StreamBucket PHP vulnerabilities. The rule monitors for unexpected child processes spawned by PHP/web server processes, the creation of specific exploitation artifact files in /tmp, unauthorized reading of /proc/self memory files by PHP, and inbound SOAP-related HTTP requests.
Detects the execution of known MyBB 'Limited ACP to Admin' proof-of-concept scripts via common python interpreters and identifies suspicious child process spawning behavior from typical web server applications (such as nginx, apache2, and php-fpm). This activity is indicative of post-exploitation attempts or web shell execution via injected plugins or templates.
Detects anomalous HTTP upgrade requests (h2c, websocket) targeting potentially vulnerable web infrastructure (e.g., nghttpx). The rule correlates abnormal 'Upgrade' header usage, suspicious request paths (/poisoned, /upgrade), and subsequent 400 error codes, which are indicative of HTTP request smuggling attempts aimed at desynchronizing frontend and backend request queues.
Detects malicious HTTP/1.1 Upgrade requests directed at nghttpx that include a Content-Length body. This combination is characteristic of a request smuggling attack, where an attacker injects a smuggled request into the backend connection. By poisoning the backend queue, the attacker can cause the nghttpx proxy to forward sensitive or malicious responses to victim clients sharing the same connection.
Detects anomalous, high-volume API requests to ServiceNow endpoints originating from the same source IP that lack valid authorization headers or session tokens, potentially indicating automated scanning, enumeration, or exploitation attempts.
Detects Server-Side Request Forgery (SSRF) attempts exploiting URL parser differentials. Attackers append a double-slash sequence to a legitimate github.com blob URL to trick the backend into resolving an absolute local filesystem path. The rule specifically targets sensitive paths such as /proc/self/environ, /var/task/, and application source files to perform Local File Read (LFR) or access internal cloud metadata services.
This rule detects anomalous, high-frequency HTTP POST requests directed at sensitive API endpoints related to payment, billing, or administration. By calculating requests per minute and identifying unique source IP behavior, it aims to flag potential automated brute-force attacks, unauthorized API discovery, or data exfiltration attempts against critical system management interfaces.
This rule monitors web server access logs for suspicious activity targeting sensitive Flowise API endpoints (credentials, variables, secretvariable, apikey). It flags two types of threats: 1) Case-bypass evasion attempts, where canonical endpoints are bypassed via non-standard casing while requesting sensitive data (e.g., matching a status 200 on non-canonical casing for sensitive paths), and 2) High-frequency requests indicative of bulk enumeration or directory/wordlist scanning.
Detects exploitation attempts against CVE-2026-33017, an unauthenticated remote code execution vulnerability in Langflow. The rule identifies suspicious HTTP POST requests directed at specific vulnerable API endpoints, looking for common Python code injection payloads (e.g., 'os.system', '__import__', 'subprocess') or the presence of a known dropper payload ('isp.sh') within the URI query. It also flags requests originating from common automation user agents like 'python-requests'.
This rule detects attempts to exploit CVE-2024-36401, a critical remote code execution vulnerability in GeoServer. The rule monitors inbound HTTP requests to GeoServer OWS or WFS endpoints for malicious patterns consistent with OGC filter expression injection, such as attempts to invoke Java Runtime process execution via crafted property names or OGC expressions.
Detects potential Velocity Template Language (VTL) injection attacks targeting API Gateway environments. The rule identifies suspicious payloads in HTTP request bodies or URLs that attempt to leverage Java-based classes (e.g., ProcessBuilder) for code execution. It also monitors for IAM scope bypass attempts, abnormal HTTP method/path combinations associated with API Gateway control-plane operations, and evidence of shell/system commands being spawned from API Gateway-related parent processes.
Detects web server processes (e.g., PHP, IIS, Apache, Nginx) spawning suspicious child processes including shells (cmd.exe, powershell, bash) or network utilities (curl, wget, netcat), which is often indicative of webshell exploitation or post-compromise activity.
Detects the creation of files with extensions commonly associated with web shells (.php, .aspx, .jsp) within typical web application directories by common web server processes such as httpd, nginx, php-cgi, and w3wp. This activity is indicative of a potential web shell deployment for persistent access or command execution.
Page 12 of 29