Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,208 detections
Filters
Last updated
All Time
Detection languages
708
203
154
38
26
Contributors
191
190
181
159
113
Categories
416
392
385
331
166
Platforms
829
343
197
84
56
Products / Services
10,650
9,755
6,688
4,418
3,745
1,208
MITRE Techniques
421
359
350
273
255
CVEs
16
12
11
10
8
IDS Classtypes
18
2
2
1
1
IDS Protocols
25
Detects React2Shell exploitation attempts via prototype pollution and Node.js
gadget invocation. Covers vulnerability scanning, gadget testing, and active
RCE exploitation.
gadget invocation. Covers vulnerability scanning, gadget testing, and active
RCE exploitation.
Detects attempts to exploit CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) by identifying Prototype Pollution vectors (__proto__, constructor) specifically targeting the React Flight protocol (RSC headers/params). Covers both clear-text and common JSON escape sequences. The rule also correlates with 500 errors to identify potential successful exploitation or blind probing attempts.
Detects attempts to exploit CVE-2025-55182 (Next.js/React) via Server Actions. Target is identified by the 'Next-Action' header or 'RSC' markers, combined with JSON prototype pollution vectors in the body.
Detects attempts to exploit CVE-2025-55182 by injecting prototype pollution vectors ("__proto__", "constructor") into React Server Component (RSC) or Next.js Server Action requests. This vulnerability allows for Remote Code Execution via object serialization flaws.
This rule detects various activities associated with the Sha1-Hulud campaign, including the creation of malicious files (setup_bun.js, bun_environment.js) identified by their SHA256 hashes or filenames within .npm directories. It also identifies the execution of malicious preinstall scripts involving 'node' and 'setup_bun.js'. Furthermore, the rule looks for persistence mechanisms related to GitHub Actions, specifically the creation of 'discussion.yaml' within '.github/workflows' or 'run.sh'/'config.sh' within '/.dev-env/'. Finally, it detects destructive commands used as a fallback, targeting both Linux (using 'find', 'shred', 'xargs', 'delete') and Windows (using 'del', 'rd' on '%USERPROFILE%').
Detects the ToolShell exploit chain used against SharePoint servers. This exploit involves a POST request to ToolPane.aspx with a spoofed Referer header pointing to SignOut.aspx, which is a key indicator of this specific attack.
This rule detects web requests targeting SharePoint endpoints associated with the ToolShell exploit chain (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771). This activity is linked to the threat actor CL-CRI-1040 (also known as Storm-2603). The rule specifically looks for requests to "/_layouts/15/ToolPane.aspx" or "/_layouts/15/SignOut.aspx" that also contain suspicious strings indicative of command execution or file manipulation attempts, such as "cmd.exe", "powershell", "whoami", "ipconfig", "systeminfo", "&cmd=", or "&file=".
Detects potential command injection attempts against Citrix NetScaler ADC and Gateway devices. This detection is based on the patterns described in a hypothetical proof-of-concept for CVE-2025-7775, which involves injecting shell commands and referencing sensitive system paths in HTTP requests.
Detects the spawning of a Windows command shell, powershell, or reconnaissance tools by the IIS worker process (w3wp.exe). This behavior is a strong indicator of a successful web application exploit, such as the deserialization vulnerability in WSUS (CVE-2025-59287), where an attacker gains remote code execution. Also detects the WSUS Service as the parent process spawning another process.
When, for example, a printer, camera, IoT appliance, or other device suddenly makes outbound connections to countries such as China, Russia, or Iran, this may not be noise. The following detection helps identify connections from these specific device groups that we were not previously aware of and that could be exfiltrating information.
The query below correlates device inventory, IP assignment and network events to identify internal endpoints attempting to connect to routers — including whether they succeeded and via Web or Application access. Attack traffic often aligns with failed HTTP/HTTPS attempts or unknown device names.
This rule detects inbound HTTP requests containing the User-Agent string 'Salesforce-Multi-Org-Fetcher/1.0'. This specific User-Agent has been associated with data theft from Salesforce instances, as detailed in a Google Cloud blog post. The detection aims to identify potential malicious activity targeting web server applications, specifically Salesforce environments, where an attacker might be attempting to exfiltrate data.
Certain strings in the uri_query field when combined with null referer and null user agent can indicate activity associated with the webshell ReGeorg.
Detects common commands used in Windows webshells
Detects XSS attempts injected via GET requests in access logs
ET WEB_SPECIFIC_APPS VMware Workspace ONE Access OAuth2TokenResourceController ACS Authentication Bypass (CVE-2022-22956)
ET WEB_SPECIFIC_APPS Adobe ColdFusion Unauthenticated Remote Code Execution (CVE-2023-29300)
This rule detects an attempted remote code execution (RCE) vulnerability in Microsoft SharePoint, specifically CVE-2024-38018. The detection is based on an HTTP POST request targeting the `/_vti_bin/webpartpages.asmx` URI with a specific content pattern in the request body: `|3c|AttachedPropertiesShared|3e 2f|wE`. This pattern indicates an attempt to exploit a deserialization vulnerability within SharePoint's SPThemes functionality.
ET WEB_SPECIFIC_APPS Wordpress Post SMTP Plugin Unauthenticated Account Takeover via Email Log Disclosure (CVE-2025-11833)
This rule detects attempts to exploit a deserialization vulnerability (CVE-2018-8421) in Microsoft SharePoint via a crafted workflow. The detection specifically looks for HTTP POST requests to the `/_vti_bin/webpartpages.asmx` endpoint containing `ValidateWorkflowMarkupAndCreateSupportObjects` and `workflowMarkupText` with CDATA, indicating an attempt to inject malicious XML.
Detects source code enumeration that use GET requests by keyword searches in URL strings
Page 38 of 58