Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,535 detections
Filters
Last updated
All Time
Detection languages
3,970
998
596
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,931
2,196
2,017
1,857
1,411
Platforms
39,936
7,266
6,535
3,866
3,647
Products / Services
4,107
2,418
1,585
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
This rule detects an attempt to exploit a critical vulnerability (CVE-2025-31324) in SAP NetWeaver Visual Composer's Metadata Uploader. The exploit leverages unauthenticated HTTP GET or HEAD requests to the '/developmentserver/metadatauploader' URI, combined with specific characters in the URI parameters (semicolon, dollar sign, backtick, pipe, or their URL-encoded equivalents) that indicate an attempt to execute arbitrary commands. This vulnerability allows an unauthenticated attacker to achieve remote command execution on the affected SAP system.
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sanguen .courses)
This rule detects attempts to exploit the Zip Slip vulnerability within TAR archives. Specifically, it looks for the sequence `../` (dot dot slash) within the file data of an inbound TAR archive, which indicates an attempt to write files outside of the intended directory during extraction. This is a common technique used in Zip Slip attacks to achieve directory traversal and potentially overwrite critical system files or place malicious files in arbitrary locations.
ET WEB_SPECIFIC_APPS Oracle E-Business Suite (EBS) Unauthenticated Template Manager Template Preview (CVE-2025-61882)
ET WEB_SPECIFIC_APPS Oracle E-Business Suite (EBS) Template Manager Template File Add (CVE-2025-61882)
ET INFO Remote Monitoring and Management (RMM) Tool in DNS Lookup (gorelo-rmm .azurewebsites .net)
Detects HTTP POST requests to F5 BIG-IP management or shared endpoints that contain long, base64-encoded payloads. Threat actors may use this technique to upload webshells or stage data for exfiltration.
ET MALWARE LeakyStealer CnC Checkin
This rule detects TLS Server Name Indication (SNI) requests for 'store.steampowered.com'. This domain is associated with the Valve Steam Store and its presence in TLS SNI could indicate activity related to information stealers like Vidar Stealer, which has been observed targeting Steam accounts.
This rule detects an attempted exploitation of an insecure deserialization vulnerability (CVE-2025-10035) in Fortra GoAnywhere MFT. Specifically, it looks for HTTP POST requests to the '/goanywhere/lic/accept/' URI containing the string 'bundle=' in the request body, which is indicative of an attempt to trigger the vulnerability.
This rule detects HTTP POST requests to github.com's /login/device/code endpoint that contain a 'client_id=' in the request body. This pattern is indicative of a device code authentication flow, which could be leveraged in phishing attacks (device code phishing) to steal application access tokens.
ET INFO WatchGuard Fireware OS IKEv2 Unauthenticated Vulnerable Version Disclosure (CVE-2025-9242)
This rule detects the 'Zip Slip' vulnerability pattern within TAR archive uploads. Specifically, it looks for the sequence '../' (dot dot slash) in the file data of a TAR archive, which indicates an attempt to traverse directories and potentially write files outside the intended extraction directory. This is a common technique used in Zip Slip attacks to achieve arbitrary file write.
This rule detects HTTP requests to the '.well-known/' directory that include common webshell file extensions (php, cfm, cgi, asp, aspx, jsp, rb, sh, py, pl). This activity is suspicious as the '.well-known/' directory is typically used for standardized metadata files (e.g., for ACME challenges, security.txt) and not for executable scripts. The rule specifically excludes requests from 'Let's Encrypt validation server' to reduce false positives.
This rule detects HTTP traffic originating from a client within the home network to an external Cloudflare tunneling service (specifically, domains ending in '.trycloudflare.com') where the User-Agent header indicates 'Microsoft-WebDAV-MiniRedir'. This combination suggests potential command and control activity or data exfiltration using WebDAV over a Cloudflare tunnel, often employed by adversaries to bypass network restrictions and obscure their infrastructure.
This rule detects attempts to retrieve PowerShell scripts (.ps1) from an external server using WebDAV (PROPFIND method) with a 'Microsoft-WebDAV-MiniRedir/' user agent. This activity is often associated with adversaries attempting to transfer tools or malicious scripts into a compromised environment.
ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (secure .kasindramaharaj .com)
This rule detects attempts to exploit CVE-2021-20021, an unauthenticated arbitrary user creation vulnerability in SonicWall Email Security. The rule specifically looks for HTTP POST requests to the '/createou' URI with 'data=' in the request body, indicating an attempt to create a new organizational unit or user.
ET INFO Observed RMM Domain in DNS Lookup (meshcentral .com)
ET INFO Remote Monitoring and Management (RMM) Tool in DNS Lookup (gorelo .tech)
This rule detects the 'Get-ScheduledTask' PowerShell cmdlet within the HTTP response body, specifically when the HTTP status code is 200. This could indicate an attacker enumerating scheduled tasks on a compromised system via a web-based command and control channel or data exfiltration.
Page 271 of 312