Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,535 detections
Filters
Last updated
All Time
Detection languages
3,970
998
596
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,931
2,196
2,017
1,857
1,411
Platforms
39,937
7,246
6,535
3,864
3,628
Products / Services
4,107
2,418
1,585
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
This rule detects attempts to exploit the Zip Slip vulnerability by identifying the sequence '../' within a ZIP archive being uploaded to a server. This pattern indicates an attempt to write files outside the intended directory, potentially leading to arbitrary file overwrite or remote code execution.
This rule detects the presence of the PowerShell cmdlet 'Start-ScheduledTask' within the HTTP response body. This could indicate an attacker attempting to establish persistence on a compromised system by creating scheduled tasks, potentially delivered via a web-based command and control channel or during an exploit.
This rule detects attempts to exploit a buffer overflow vulnerability in the `SetNetControlList` function of Tenda routers. Specifically, it looks for HTTP POST requests to the `/goform/SetNetControlList` URI where the `list` parameter in the request body is excessively long (100 characters or more). This vulnerability (CVE-2025-9087, CVE-2025-29215, CVE-2025-1897) could lead to denial of service or arbitrary code execution.
This rule detects an attempt to exploit a buffer overflow vulnerability (CVE-2025-9297) in Tenda networking equipment. Specifically, it looks for HTTP POST requests to the '/goform/wxportalauth' URI where the 'type' parameter in the request body contains a string of 100 or more characters, indicating a potential buffer overflow attempt.
This rule detects attempts to exploit a command injection vulnerability in B-Link devices, specifically targeting the `/goform/set_hidessid_cfg` endpoint with the `enable` parameter. Attackers can inject commands by manipulating the `enable` parameter in a POST request, indicated by the presence of command separators like semicolon, newline, backtick, pipe, or dollar sign.
This rule detects inbound network traffic associated with the Braodo Loader malware. It specifically looks for a unique byte sequence and a specific string within the HTTP response body, indicating the download or communication related to this loader.
This rule detects the inbound transfer of a KoiStealer payload over HTTP. It specifically looks for unique string patterns within the HTTP response body that are indicative of the KoiStealer malware, including specific context definitions and keywords like 'CONTEXT_i386', 'CONTEXT_i486', 'CONTEXT_CONTROL', and 'CONTEXT_INTEGER'. This suggests the rule is designed to identify the download of the malware executable or a component of it.
This rule detects the presence of 'activeMQConnectionURL' and 'tcp://' within HTTP response bodies, which is indicative of a Commvault server exposing its hostname or connection details. This information could be leveraged by attackers for reconnaissance or to identify vulnerable Commvault instances.
ET WEB_SPECIFIC_APPS Netgear password.cgi http_passwd Parameter Command Injection Attempt
ET WEB_SPECIFIC_APPS D-Link setMAC macCloneMac Parameter Buffer Overflow Attempt (CVE-2023-43237)
ET MALWARE Observed Malicious Domain (significant-adopted-bearing-own .trycloudflare .com in TLS SNI)
ET MALWARE Observed Malicious Domain (tamku .shoplerter .opnetorologies .net in TLS SNI)
ET MALWARE Observed Malicious Domain (tamku .shop in TLS SNI)
ET INFO Blockchain RPC Domain in TLS SNI (mainnet .optimism .io)
This rule detects attempts to exploit a vulnerability in Xerox FreeFlow Core (CVE-2025-8356) that allows for arbitrary file upload and directory traversal. The detection logic looks for HTTP POST requests with a specific content type ('multipart/related' and 'application/vnd.cip4-jmf+xml') and a 'Content-Disposition: attachment; filename="' header, combined with a PCRE regex matching directory traversal patterns (e.g., '../', '..\'). This indicates an attacker is trying to upload a malicious file or traverse directories on the server.
ET INFO Blockchain RPC Domain in TLS SNI (polygon-rpc .com)
ET ATTACK_RESPONSE Koi Loader/Stealer CnC Config Inbound
Detects network connections to blockchain APIs that are indicative of EtherHiding techniques, specifically those used by UNC5342 to retrieve malicious payloads. It identifies connections to domains containing keywords like 'explorer', 'block', 'cypher', 'eth', 'bit', 'coin', or 'crypto', combined with suspicious URL patterns such as 'eth_call' (a read-only function call for smart contracts) or 'apiKey=freekey' (a common free API key used by threat actors).
This rule detects the presence of the PowerShell cmdlet 'Enable-ScheduledTask' within the HTTP response body. This could indicate an attacker using a web server to deliver or instruct a client to enable a scheduled task, potentially for persistence or privilege escalation. The detection specifically looks for 'enable-scheduledtask' case-insensitively, optionally preceded by '-taskname' or '-taskpath', within a successful HTTP 200 OK response.
This rule detects the presence of 'schtasks' followed by '/delete' and '/tn' (task name) in the HTTP response body with a 200 status code. This could indicate an attacker attempting to delete scheduled tasks on a compromised Windows system, potentially to remove forensic evidence or disrupt legitimate operations. The detection is case-insensitive and uses a PCRE to match the specific command structure.
This rule detects attempts to exploit CVE-2024-30043, a vulnerability in Microsoft SharePoint's SPXmlDataSource. The detection is based on the presence of specific content in HTTP response bodies, including '<!DOCTYPE', '<SharePoint:SPXmlDataSource', and 'DataFile="', combined with a PCRE regex matching file or SMB paths, indicating an attempt to fetch data via XML External Entity (XXE) injection.
Page 283 of 312