Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,084 detections
Filters
Last updated
All Time
Detection languages
418
193
163
156
81
Contributors
381
251
92
71
40
Categories
498
271
255
135
123
Platforms
443
441
267
121
114
Products / Services
10,665
9,773
6,704
4,421
3,749
1,084
MITRE Techniques
278
229
180
177
151
CVEs
17
15
13
13
8
IDS Classtypes
4
IDS Protocols
4
This rule detects anomalous activity where a 'post_save_repair' event is triggered multiple times for the same WordPress post ID within a short timeframe. Repeated post repair operations could indicate automated exploitation attempts, malformed content injection, or excessive resource usage causing application-layer instability.
Detects WordPress activity logs involving 'oembed' and 'cache' during a 'parse_request' action. This pattern can be associated with unauthorized attempts to manipulate or exploit the oEmbed cache mechanism within WordPress environments.
Detects instances where a nested REST request is initiated while the application context is performing a post-save event, specifically identified by a 'parse_request' status or type indicator. This pattern may signify an adversary attempting to impersonate an administrator within the application to perform unauthorized actions during data processing.
Detects a PyPI release of mrmustard 0.7.4 with no corresponding GitHub tag, indicating the package was published outside the project's normal release process.
Detects unauthenticated exploitation attempts targeting WordPress sites using wp2shell techniques. The rule identifies malicious payloads attempting to leverage RSS, Navigation, or Calendar Gutenberg blocks in conjunction with the batch REST API to achieve Remote Code Execution.
Detects the invocation of an unimplemented keylogger command placeholder (key '11') within the GigaWiper malware. This indicates an attempt to trigger a command that the malware is not currently configured to execute, often used for debugging or malicious functionality activation.
Detects the invocation of an unimplemented keylogger command placeholder (key '11') within the GigaWiper malware. This indicates an attempt to trigger a command that the malware is not currently configured to execute, often used for debugging or malicious functionality activation.
Detects exploitation attempts against Joomla websites targeting CVE-2023-23752. This vulnerability allows an unauthenticated attacker to disclose sensitive information, such as configuration details or user data, by crafting specific GET requests to the Joomla API.
Detects presence of known-malicious Jscrambler npm supply chain dropper artifact filenames dist/setup.js and dist/intro.js referenced or embedded within scanned content (package contents, tarballs, manifests)
Detects potential LLM prompt injection or jailbreak attempts within command line arguments or event log data, such as instructions to override system prompts or masquerade as a specific persona.
This rule detects potential automated data exfiltration or staging behavior by identifying the concurrent execution of email-related processes and vector database memory modification commands (insert/upsert) within a 5-minute window on the same host. This combination may indicate an attacker extracting data from email systems and injecting it into a local vector memory store, likely for subsequent LLM-based analysis or exfiltration.
This rule detects potential exploitation attempts targeting vulnerabilities in FortiClient EMS. It specifically looks for indicators such as requests lacking proper certificate headers or suspicious requests to 'service/save.php' on the FortiClient EMS server, which are commonly associated with CVE-2026-35616.
This rule detects unauthorized requests to the '/api/tokens/import/txt' endpoint, which is associated with the 'Device Code Lab' token management panel. Such activity is indicative of an attacker importing stolen session tokens to maintain persistent access to a compromised environment.
This rule detects potential brute-force or credential stuffing attempts against web application authentication endpoints by monitoring patterns of success and failure. It aggregates requests over 5-minute intervals, calculating a risk score based on high volumes of authentication failures relative to successful requests from individual source IPs targeting sensitive API paths (e.g., auth, session, login, token).
This rule detects the creation of unauthorized technician accounts in the SimpleHelp RMM platform that follow an OIDC authentication bypass pattern (CVE-2026-48558). It correlates server logs indicating 'New Anon' registration activity with Windows Security Event ID 4720 (User account created), specifically filtering for accounts that do not belong to trusted corporate domains.
Detects unauthorized attempts by low-privileged API tokens to access sensitive Argo CD endpoints related to Git repository credentials and project configurations. This rule specifically monitors for exploitation patterns associated with CVE-2025-55190, where tokens with read-only access could retrieve secrets they are not authorized to view.
Detects attempts to exploit an authorization bypass vulnerability in MyBB (specifically observed in version 1.8.40) where a non-administrative ACP account can assign users to the administrator group (gid=4) by manipulating POST requests to the user-add or user-edit endpoints.
Detects high-volume unauthenticated API queries against a ServiceNow instance by a Guest user. This behavior is indicative of an adversary attempting to exfiltrate sensitive information, such as ticket data, configuration secrets, or employee records, via the 'related_list_edit' REST endpoint or standard table APIs.
Detects high-volume, unauthenticated REST API requests to ServiceNow endpoints, specifically those identified as coming from a 'guest' user account or lacking authentication tokens, which may indicate reconnaissance, vulnerability scanning, or automated data extraction attempts.
Detects unauthenticated HTTP requests to sensitive Gitea endpoints containing the 'X-WEBAUTH-USER' header set to 'admin'. This rule identifies exploitation attempts against misconfigured Docker deployments where 'REVERSE_PROXY_TRUSTED_PROXIES' is improperly set to a wildcard, allowing unauthorized users to impersonate administrative accounts (CVE-2026-20896).
Detects the execution of command lines containing suspicious keywords associated with potential data encryption, database table destruction, or configuration tampering. These commands, such as those invoking encryption functions or dropping configuration tables, are indicative of malicious activity often performed by ransomware or wiper malware to hinder system recovery or exfiltrate and destroy data.
Page 36 of 52