Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,084 detections
Filters
Last updated
All Time
Detection languages
418
193
163
156
81
Contributors
381
251
92
71
40
Categories
498
271
255
135
123
Platforms
443
441
267
121
114
Products / Services
10,665
9,773
6,704
4,421
3,749
1,084
MITRE Techniques
278
229
180
177
151
CVEs
17
15
13
13
8
IDS Classtypes
4
IDS Protocols
4
Detects invocations of the 'grafana_api_request' tool that lack a preceding valid bearer-token authentication event for the same session. This indicates a potential scenario where a server or service account token is being used on behalf of an unauthenticated caller, bypassing normal authentication requirements for the Grafana API.
Detects invocations of the 'grafana_api_request' tool that lack a preceding valid bearer-token authentication event for the same session. This indicates a potential scenario where a server or service account token is being used on behalf of an unauthenticated caller, bypassing normal authentication requirements for the Grafana API.
Detects a PHP TypeError in Magento system logs where array_merge() is called with an integer argument following an include statement. This signature is indicative of exploitation attempts targeting Magento sites using the StyleSmuggler vulnerability, which often involves malicious file inclusion and code execution.
Detects a PHP TypeError in Magento system logs where array_merge() is called with an integer argument following an include statement. This signature is indicative of exploitation attempts targeting Magento sites using the StyleSmuggler vulnerability, which often involves malicious file inclusion and code execution.
Detects a PHP TypeError in Magento system logs where array_merge() is called with an integer argument following an include statement. This signature is indicative of exploitation attempts targeting Magento sites using the StyleSmuggler vulnerability, which often involves malicious file inclusion and code execution.
Detects EDR or JVM stack-trace or exception telemetry indicating the invocation of insecure deserialization methods associated with Log4jLogEvent$LogEventProxy, such as marshalledMessage.get() or MarshalledObject.get(). This pattern is indicative of potential exploitation attempts leveraging vulnerable Log4j libraries for remote code execution.
This rule detects potential unauthenticated access or unauthorized configuration modifications to an AI agent management backend. It monitors HTTP logs for requests targeting configuration endpoints that lack proper authentication, specifically identifying attempts to retrieve sensitive information like Dify or Coze keys, or attempts to inject new agent configurations via unauthenticated POST requests.
This rule detects instances where a user account performs a password update without any preceding or associated account verification events (such as email verification, reset requests, or action execution) within a short timeframe. This behavior can be indicative of account compromise where an adversary modifies credentials for a compromised user account.
Detects probing of common sensitive paths such as .env, .git, wp-admin, phpmyadmin.
Detects access attempts to sensitive files such as xmlrpc.php, .htaccess, wp-config.php, /etc/shadow.
Detects a PHP TypeError in Magento system logs where array_merge() is called with an integer argument following an include statement. This signature is indicative of exploitation attempts targeting Magento sites using the StyleSmuggler vulnerability, which often involves malicious file inclusion and code execution.
Detects incoming Grafana API requests directed at vulnerable mcp-grafana server instances identified by an outdated version (pre-1.1.0). This rule correlates host-level version discovery with application-layer logs containing suspicious 'grafana_api_request' method calls, which may indicate an attempt to exploit Server-Side Request Forgery (SSRF) vulnerabilities.
Detects instances where unauthenticated users or sessions execute privileged 'tools/call' operations within the Grafana MCP dispatcher. This behavior is indicative of potential session spoofing attacks, specifically targeting vulnerabilities similar to CVE-2026-19516, where lack of an Authorization header allows unauthorized access to privileged tool functions.
Detects the presence of a specific sentinel string 'data.external.telemetry' within Terraform provisioner job logs, which indicates the execution of unauthorized data-collection logic within a compromised or backdoored Terraform module.
Detects a hardcoded PEM RSA public key embedded alongside JSCeal-specific compiled V8 bytecode obfuscation artifacts, used to encrypt exfiltrated data or C2 communications
Detects cross-site scripting payloads in the request URI.
Detects empty, placeholder, or abnormally long User-Agent headers often used to evade fingerprinting.
Detects instances where the Grafana MCP (Model Context Protocol) server's service account identity executes administrative tools (such as 'grafana_api_request') within a session that lacks a verified, prior authentication event (bearer token). This pattern suggests an adversary may be spoofing or hijacking a privileged service account session to perform unauthorized administrative actions.
Detects potential Server-Side Request Forgery (SSRF) attacks targeting Grafana instances. The rule identifies suspicious 'grafana_api_request' calls that occur shortly after an unauthenticated discovery call ('tools/call') within the same session, where the target URL in the request header is not included in a defined allowlist of known internal Grafana hosts.
Detects potential Server-Side Request Forgery (SSRF) attacks targeting Grafana instances. The rule identifies suspicious 'grafana_api_request' calls that occur shortly after an unauthenticated discovery call ('tools/call') within the same session, where the target URL in the request header is not included in a defined allowlist of known internal Grafana hosts.
Detects potential Server-Side Request Forgery (SSRF) attacks targeting Grafana instances. The rule identifies suspicious 'grafana_api_request' calls that occur shortly after an unauthenticated discovery call ('tools/call') within the same session, where the target URL in the request header is not included in a defined allowlist of known internal Grafana hosts.
Page 31 of 52