Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,535 detections
Filters
Last updated
All Time
Detection languages
3,970
998
596
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,931
2,196
2,017
1,857
1,411
Platforms
39,934
7,265
6,535
3,865
3,645
Products / Services
4,107
2,418
1,585
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
ET WEB_SPECIFIC_APPS Brickcom camerainfo.cgi a Parameter Information Disclosure Attempt (CVE-2017-9238)
ET WEB_SPECIFIC_APPS Brickcom configfile.dump action Parameter Information Disclosure Attempt (CVE-2017-9238)
ET WEB_SPECIFIC_APPS OptiLink/GPON admin/formTracert target_addr Parameter Command Injection Attempt (CVE-2025-34049)
ET WEB_SPECIFIC_APPS TVT language Command Injection Attempt (CVE-2025-34036)
ET MALWARE TA398 CurlBack_RAT CnC Activity - Upload Results
ET INFO DYNAMIC_DNS HTTP Request to a *.freeddns .me domain
ET INFO DYNAMIC_DNS HTTP Request to a *.destroyerkisscover .com .br domain
ET INFO Observed Observed Commonly Actor Abused Online Service Domain (getenjoyment .net in TLS SNI)
ET EXPLOIT_KIT LandUpdate808 Domain (saeam .com) in TLS SNI
ET EXPLOIT_KIT LandUpdate808 Domain (dolmain .com) in TLS SNI
ET EXPLOIT_KIT LandUpdate808 Domain (forrbes .com) in TLS SNI
ET EXPLOIT_KIT ZPHP Domain in TLS SNI (dotauan .pro)
ET EXPLOIT_KIT ZPHP Domain in TLS SNI (polimakels .com)
This rule detects the presence of the PowerShell cmdlet 'Set-ScheduledTask' within the HTTP response body. This could indicate an attacker using a web-based mechanism to deliver or execute commands related to scheduled task creation or modification on a compromised system, potentially for persistence.
This rule detects the presence of the 'schtasks /query' command within the HTTP response body. This could indicate an attacker enumerating scheduled tasks on a compromised system, potentially as part of reconnaissance or lateral movement activities. The rule specifically looks for 'schtasks' and '/query' (case-insensitive) in HTTP responses with a 200 status code.
This rule detects HTTP traffic where the User-Agent string contains the case-insensitive substring 'iot'. This is often indicative of compromised IoT devices or botnet activity attempting to blend in or identify themselves.
This rule detects attempts to exploit a buffer overflow vulnerability in Tenda routers via the `/goform/exeCommand` endpoint. Specifically, it looks for HTTP POST requests to this URI where the `cmdinput` parameter contains an unusually long string (100 characters or more) which is indicative of an attempt to overflow a buffer.
This rule detects attempts to exploit a command injection vulnerability in the DCN ip_block.php script. It specifically looks for HTTP POST requests to '/function/audit/newstatistics/ip_block.php' with an 'ip' parameter in the request body that contains command injection characters such as semicolons, newlines, backticks, pipes, or dollar signs.
This rule detects attempts to exploit an authentication bypass vulnerability (CVE-2025-54253) in Adobe Experience Manager Forms. The detection is based on specific HTTP URI patterns and content within the request, including '/adminui/updateLicense1.do', 'login. ', and 'debug=command', which are indicative of an exploit attempt against the application.
This rule detects attempts to exploit an XML External Entity (XXE) injection vulnerability in Adobe Experience Manager Forms. The detection logic specifically looks for HTTP POST requests to the '/edcws/services/urn:EDCLicenseService' URI containing '<EDCSecurity>' and '<!ENTITY' patterns in the request body, along with a PCRE regex to identify the XXE payload structure.
This rule detects attempts to exploit an insecure deserialization vulnerability (CVE-2025-49533) in Adobe Experience Manager Forms. The detection is based on specific HTTP URI patterns and content within the request body, looking for '/FormServer/servlet/GetDocumentServlet' followed by 'serDoc=' and 'H4sIAA', which are indicators of a serialized object being sent to the server.
Page 282 of 312