Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects attempts to exploit a vulnerability in the WordPress Super Forms plugin (CVE-2026-14894). The rule monitors for malicious file upload requests containing embedded PHP code or attempts to bypass filename extensions for PHP files via the super_submit_form AJAX action.
Detects incoming HTTP POST requests targeting the 'admin-ajax.php' endpoint with parameters associated with a malicious file upload exploit against Elementor Pro (CVE-2026-32475). The rule specifically looks for the 'elementor_pro_forms_send_form' action and the presence of PHP file extensions within form fields, indicating an attempt to upload a web shell.
Detects Server-Side Request Forgery (SSRF) attempts against Grafana instances using the 'X-Grafana-URL' header. The rule identifies requests attempting to access internal network ranges, link-local addresses, or cloud metadata endpoints (e.g., 169.254.169.254, localhost) via the Grafana MCP interface, particularly when non-GET HTTP methods are used to potentially mutate internal resources.
Detects incoming Grafana API requests directed at vulnerable mcp-grafana server instances identified by an outdated version (pre-1.1.0). This rule correlates host-level version discovery with application-layer logs containing suspicious 'grafana_api_request' method calls, which may indicate an attempt to exploit Server-Side Request Forgery (SSRF) vulnerabilities.
This rule monitors for internal network connection attempts initiated by the 'mcp-grafana' process to destinations it has not contacted in the previous 14 days. By establishing a baseline of legitimate data source connections, the rule alerts when the process performs a rapid fan-out or discovery against multiple new internal hosts, which may indicate unauthorized network reconnaissance or lateral movement attempts by the Grafana service.
This rule detects potentially malicious modifications to PostgreSQL configuration files or the creation of new library files (.so or .dll) by the PostgreSQL service process. It also flags when the PostgreSQL service process is initiated with command-line arguments referencing 'shared_preload_libraries', which can be abused to load arbitrary code or malicious extensions into the database engine.
Detects anomalous activity originating from PostgreSQL processes, including the spawning of shells (cmd, powershell, sh, bash), access to sensitive files (e.g., /etc/shadow, SSH keys), and file creation outside the standard PostgreSQL data directories, which is consistent with the abuse of SQL functionality like pg_read_file() or lo_export().
Detects when the Postgres service process or account attempts to modify system-level persistence mechanisms, such as scheduled tasks (cron/schtasks) or system services (systemd/startup folders), which are typical behaviors for an adversary using database service context to maintain persistence.
Detects when the PostgreSQL service process (postgres.exe/postgres/postmaster) loads a shared library (.dll or .so) from a non-standard, user-writable directory (e.g., Temp, AppData, /tmp). This behavior is indicative of potential exploitation of vulnerabilities like CVE-2026-6471, where attackers attempt to load malicious plugins via unvalidated logical decoding plugin paths.
This rule monitors for modifications to the PostgreSQL configuration file 'pg_hba.conf', specifically looking for changes that would enable 'trust' authentication, followed by successful database logins using that method within one hour. This behavior is indicative of an attacker modifying authentication rules to gain unauthorized, passwordless access to a database.
Detects the creation or modification of specific files within the /tmp directory, specifically those matching naming patterns associated with 'jasper-log' files or temporary pipe files. These patterns are often associated with temporary storage or data staging activities during post-exploitation or malware execution.
Detects the modification or replacement of critical Linux system daemons (crond, sshd, polkitd, etc.) followed by a service restart or reload. This behavior is indicative of potential trojanization or unauthorized tampering of system processes to establish persistence or inject malicious code.
Detects instances where common web server applications (e.g., Apache, Tomcat, IIS, Nginx) or Java runtime environments spawn suspicious child processes like command shells (cmd.exe, powershell.exe, sh, bash) or network utilities (wget, curl). This behavior often indicates exploitation of a web vulnerability, such as Remote Code Execution (RCE), allowing an adversary to execute commands or download further malicious payloads.
This rule identifies a discrepancy between actual network connections processed by HAProxy and the corresponding entries in its server-side logs. Such inconsistencies can indicate the presence of a malicious backdoor compiled into or injected into the HAProxy process, designed to facilitate C2 traffic while evading standard monitoring by suppressing or omitting logging for those connections.
Detects anomalous outbound network connections from the Grafana MCP (Model Context Protocol) server process to internal private IP address ranges. The rule compares current network activity against a 14-day baseline to filter out known data sources, identifying potentially unauthorized lateral movement or internal network probing via server-side request forgery (SSRF) vulnerabilities.
Detects Server-Side Request Forgery (SSRF) attempts targeting vulnerable versions of Grafana MCP Server (versions < 1.1.0). The rule identifies requests attempting to access sensitive internal or cloud-metadata endpoints (e.g., 169.254.169.254, localhost, internal subnets) via the X-Grafana-URL header.
This rule detects unauthorized or suspicious access to sensitive configuration and credential files (e.g., .aws, .azure, .ssh) by specific DLP (Data Loss Prevention) or automation scripts, and identifies subsequent attempts to expose environment variables or sensitive tokens within process command lines.
Detects the creation of tar archives within the Coder database during a specific window associated with rogue IP activity, where the file creation was performed by a system-level process.
Detects DragonForce ransomware note (readme.txt) referencing known DragonForce Tor negotiation/blog onion addresses
This rule monitors for file and process events involving 'pubspec.yaml' configuration files or specific Flutter-related components such as 'universal_file_viewer' and 'surveyjs_flutter'. This detection logic is designed to track development activities or the inclusion of specific software packages within a Flutter project environment.
Detects network connection attempts or established connections to a specific remote IP (103.141.13.26) on UDP port 3479. This pattern is often associated with command and control infrastructure or unauthorized data communication.
Page 122 of 347