Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,535 detections
Filters
Last updated
All Time
Detection languages
3,970
998
596
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,931
2,196
2,017
1,857
1,411
Platforms
39,934
7,265
6,535
3,865
3,645
Products / Services
4,107
2,418
1,585
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
ET WEB_SPECIFIC_APPS Syrotec/GPON shellCMDExec command Parameter Command Injection Attempt (CVE-2024-46658)
ET WEB_SPECIFIC_APPS Netgear password.cgi http_passwd Parameter Buffer Overflow Attempt (CVE-2023-38925)
ET WEB_SPECIFIC_APPS Tenda WifiExtraSet wpapsk_crypto Parameter Buffer Overflow Attempt (CVE-2025-25663, CVE-2025-10838, CVE-2025-7596, CVE-2025-5799)
ET WEB_SPECIFIC_APPS Tenda SetVirtualServerCfg list Parameter Buffer Overflow Attempt (CVE-2025-29361, CVE-2024-4112, CVE-2024-40416, CVE-2024-10282)
ET WEB_SPECIFIC_APPS Tenda openSchedWifi Multiple Parameters Buffer Overflow Attempt (CVE-2025-46035)
ET WEB_SPECIFIC_APPS Tenda setVlanInfo Multiple Parameters Buffer Overflow Attempt (CVE-2023-46060, CVE-2023-51093)
ET WEB_SPECIFIC_APPS Tenda setAdvPolicyData rebootTime Parameter Buffer Overflow Attempt
ET WEB_SPECIFIC_APPS D-Link thdbase.asp Multiple Parameters Buffer Overflow Attempt
ET WEB_SPECIFIC_APPS D-Link myMusic.cgi Multiple Parameters Command Injection Attempt (CVE-2024-7922)
ET WEB_SPECIFIC_APPS D-Link SetWLanRadioSecurity Key Parameter Command Injection Attempt (CVE-2024-48634)
ET WEB_SPECIFIC_APPS D-Link SetWLanRadioSettings Multiple XML Tags Buffer Overflow Attempt (CVE-2023-44839, CVE-2023-43241)
ET WEB_SPECIFIC_APPS D-Link showMACfilterMAC flag_5g Parameter Buffer Overflow Attempt (CVE-2023-43239)
ET WEB_SPECIFIC_APPS D-Link form2Dhcpip.cgi nvmacaddr Parameter Buffer Overflow Attempt (CVE-2023-43238)
ET WEB_SPECIFIC_APPS Ivanti Connect Secure CRLF Injection Remote Code Execution Attempt (CVE-2024-37404)
ET MALWARE TA569 Middleware Server Domain in TLS SNI (cronapiworkersvc .com)
ET MALWARE Observed DNS Query to Malicious Domain (tamku .shop)
ET INFO DYNAMIC_DNS Query to a *.freeddns .tokyo domain
ET INFO DYNAMIC_DNS Query to a *.itafricagroup .com domain
ET INFO Blockchain RPC Domain in TLS SNI (rpc .ftm .tools)
ET INFO Blockchain RPC Domain in TLS SNI (arbitrum .one)
ET INFO DYNAMIC_DNS HTTP Request to a *.anchorchain .co .za domain
Page 280 of 312