Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
599 detections
Filters
Last updated
All Time
Detection languages
198
163
131
22
20
Contributors
127
91
73
69
62
Categories
331
304
132
129
59
Platforms
340
214
204
30
27
Products / Services
10,665
9,773
6,705
4,421
3,749
599
MITRE Techniques
293
211
151
137
110
CVEs
23
23
10
6
6
IDS Classtypes
13
1
1
1
IDS Protocols
16
This rule detects a high volume (50 or more) of HTTP errors (status codes 400 and above) originating from a single client IP address within a 5-minute time window. This behavior can be indicative of various malicious activities such as brute-force attacks, web application vulnerability scanning, or denial-of-service attempts against a web server.
This rule detects attempts to upload malicious web server modules, plugins, or components. It specifically looks for HTTP PUT requests to URIs containing '/modules/', '/plugins/', or '/components/' and checks the file data for the 'MZ' header, indicating an executable file (likely a Windows executable or DLL). This combination suggests an attacker is trying to upload a malicious executable to a web server's module/plugin directory for persistence or further compromise.
Detects attempts to bypass the UniFi OS authentication gateway by exploiting a path traversal vulnerability. The rule looks for requests to the '/api/auth/validate-sso/' endpoint containing URL-encoded path traversal sequences like '..%2f' or '..%2e'. This indicates an attacker is trying to access internal resources or bypass authentication mechanisms.
Detects error-log indicators of active CVE-2026-42945 (NGINX Rift) exploitation attempts
reported from May 2026: worker processes exiting on signal 11 after crafted requests against
vulnerable rewrite configurations. Pair with access-log URI anomaly rules on internet-facing NGINX.
reported from May 2026: worker processes exiting on signal 11 after crafted requests against
vulnerable rewrite configurations. Pair with access-log URI anomaly rules on internet-facing NGINX.
This rule detects crashes in Nginx worker processes, specifically looking for messages indicating a 'signal 11' or 'SIGSEGV' error. This could be indicative of a vulnerability being exploited (e.g., CVE-2026-42945) or other critical software malfunctions.
This rule detects attempts to drop a systemd timer unit file via a web shell. It specifically looks for HTTP POST requests (flow:to_server) containing both '.timer' and '[Timer]' in the client body, indicating the creation or modification of a systemd timer unit.
Detects the initial access attempt for the Oracle E-Business Suite vulnerability CVE-2025-61882. This involves a crafted POST request to the UiServlet component containing a malicious XML payload.
Detects the specific User-Agent string 'NSIS_InetLoad (Mozilla)' associated with the SessionGate multi-stage loader during its command and control (C2) check-ins. SessionGate is delivered via impersonated open-source tooling websites and gated TDS redirection chains.
Detects HTTP requests containing specific URL query parameter combinations (`ia=` and `df=`) or POST bodies containing `a=iz&b=`, which are unique to the JS.MonoGlyphRAT check-in and beaconing protocol.
Detects outbound network connections from web server processes to steamcommunity.com, which is used by this malware to fetch steganographically encoded C2 payloads from profile comments.
Detects truncated 'whostmgrsession' cookies missing the comma delimiter, which is a necessary step for attackers to inject cleartext CRLF payloads into cPanel session files and bypass authentication. This rule specifically looks for the 'whostmgrsession' cookie in web or proxy logs where the cookie value matches a regex pattern indicating the absence of the expected comma delimiter, a characteristic of the CVE-2026-41940 exploitation.
Detects HTTP POST requests destined for specific PHP endpoints (/res.php, /tele.php) frequently used by the BlobPhish campaign to exfiltrate stolen credentials from memory-resident phishing pages.
Detects network requests to known malicious domains associated with the fake RedAlert Android malware campaign used by pro-Iranian actors, acting as a payload host or C2 endpoint.
Detects SSTI attempts sent via GET requests in access logs
This rule detects suspicious activity involving multiple POST requests to Livewire update endpoints on web servers, followed by the spawning of unusual processes from web server parent processes (php, apache, httpd, nginx, php-fpm). The spawned processes of interest include various shells (sh, bash), command-line tools (curl, wget, python, perl, nc), or commands containing base64 encoding, chmod +x, or /tmp/ paths. This behavior could indicate a web shell compromise or successful exploitation leading to command execution.
This rule detects attempts to exploit a vulnerability in ShareFile (CVE-2026-2699/CVE-2026-2701) by monitoring for HTTP GET requests to the `/ConfigService/api/StroageZoneConfig` URI path with a `h=` query parameter. This pattern is indicative of an attacker trying to leak API secrets.
Detects exploitation attempts against Oracle WebLogic via suspicious HTTP requests and command execution patterns. The rule identifies WebLogic-specific endpoints combined with RCE payload indicators such as cmd, bash, powershell, wget, curl, or encoded payloads within the URI query.
This rule detects network connections and DNS resolution requests to known typosquatted domains used by the TeamPCP threat actor for command and control (C2) and data exfiltration. These domains are associated with a compromised Trivy scanner. Detection indicates successful execution of the compromised scanner and attempted exfiltration.
Detects web requests to Cloudflare workers.dev subdomains containing specific keywords commonly used in the EvilTokens device code phishing campaign. The rule specifically looks for a pattern like '[lure-type]-[3char-id].[username]-[domain]...workers.dev' to identify malicious URLs.
This rule detects network connections and DNS resolution requests to known typosquatted domains used by the TeamPCP threat actor for command and control (C2) and data exfiltration. These domains are associated with a compromised Trivy scanner. Detection indicates successful execution of the compromised scanner and attempted exfiltration.
Detects Zimbra SOAP API requests attempting to enable IMAP access by setting zimbraPrefImapEnabled. This is a known persistence technique used by threat actors (such as in Operation GhostMail) to silently enable mail protocols, bypassing the web UI to maintain access using stolen app-specific passwords.
Page 19 of 29