Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,084 detections
Filters
Last updated
All Time
Detection languages
418
193
163
156
81
Contributors
381
251
92
71
40
Categories
498
271
255
135
123
Platforms
443
441
267
121
114
Products / Services
10,665
9,773
6,704
4,421
3,749
1,084
MITRE Techniques
278
229
180
177
151
CVEs
17
15
13
13
8
IDS Classtypes
4
IDS Protocols
4
Detects incoming HTTP requests that use URL-encoding (e.g., %2e%2e, %2f) to obfuscate path traversal sequences targeting sensitive operating system or container application files, such as /proc/self/environ or /etc/passwd. This technique is often used to bypass security filters or URL validation mechanisms in web applications.
Detects URL credential confusion attempts where an attacker injects an @ symbol into URL-based query parameters. By including an '@' character, the attacker forces a mismatch between how a hostname validator parses the URL (seeing a legitimate hostname like github.com as the userinfo component) and how the backend fetcher resolves the URL (ignoring the userinfo and resolving the host following the @ symbol), potentially enabling Server-Side Request Forgery (SSRF) or local file read bypasses.
Detects path traversal attempts in web server access logs by searching for dot-dot-slash (../), dot-dot-backslash (..\), or their URL-encoded equivalents (..). These patterns are indicative of efforts to access files or directories outside the intended web root.
Detects application log patterns indicative of a memory leak exploitation attempt against vLLM using the Python Imaging Library (PIL). This behavior is associated with an ASLR bypass technique leveraging BytesIO object manipulation, a prerequisite for a subsequent heap overflow vulnerability.
Detects web server processes (e.g., httpd, nginx) spawning common shell interpreters (sh, bash, cmd.exe) that execute suspicious commands often used in reconnaissance or download stages of an attack, such as 'whoami', 'wget', or 'curl'. This behavior is characteristic of an exploited web application being used as a staging or command-and-control pivot point.
Detects potential privilege escalation attempts against a MyBB forum by monitoring POST requests to administrative endpoints. Specifically, it flags session activity that includes creating new users with admin group assignments (usergroup=4) or accessing sensitive administrative modules (config, tools, style, user) from within the admin control panel.
Detects remote code execution (RCE) attempts targeting Flowise/floci API Gateway services through Velocity Template Language (VTL) server-side template injection. The rule monitors for malicious payload patterns involving Java class reflection (e.g., ProcessBuilder) and unauthorized access attempts through API Gateway endpoints, including potential IAM scope bypass signatures.
Detects unauthorized attempts to escalate privileges within the MyBB Admin Control Panel (ACP) by creating a new user account with administrator privileges (group 4). This rule identifies when an account with limited management permissions exploits the ACP to assign a new user to the administrator group, effectively bypassing intended permission restrictions.
Detects instances where scripting or development processes (e.g., node.exe, python.exe, code.exe) access sensitive SSH private key files or PEM files, followed by an immediate outbound network connection to a non-private IP address within 60 seconds. This activity is indicative of credential exfiltration or unauthorized use of stolen keys.
Detects the installation and execution of known APT36 Ghazwa spyware variants (com.ghazwa.updates, com.chragall, or com.chagall) that are sideloaded (not from the official Google Play Store) and attempt to request or activate Device Administrator privileges via intent actions or receiver class activation.
This rule detects suspicious audio capture activity associated with the APT36 Ghazwa spyware. It monitors for the execution of specific foreground services (MEATIER or ADSFEAM) from the package 'com.ghazwa.updates' simultaneously with the application requesting 'RECORD_AUDIO' permissions on the same device.
Detects unauthorized privilege escalation attempts within the MyBB Admin Control Panel (ACP). The rule identifies HTTP POST requests, likely generated by a limited-privilege account, that attempt to create a new user with Administrator permissions (gid=4) or modify an existing user's group assignment to the Administrator group, bypassing standard ACP permission controls.
Detects exploitation attempts against CVE-2026-33017 in Langflow by monitoring for unauthenticated POST requests to the /api/v1/build_public_tmp/ endpoint, specifically using the identified exploit User-Agent, followed by outbound connections from the victim host to known attacker-controlled infrastructure.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
Jellyfin Ffprobe Exploit
YARA-L
Detects Jellyfin's automated ffprobe media scan pipeline spawning suspicious network-related shell commands. This indicates active exploitation of the PixelSmash vulnerability (CVE-2026-8461) via zero-click library scans.
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
This rule detects two stages of a potential exploitation chain targeting vLLM multimodal endpoints. Stage 1 identifies POST requests to vLLM API endpoints that contain 'video_url' in the request context, which could indicate an attempt to exploit CVE-2026-22778. Stage 2 detects post-exploitation activity by looking for unexpected child processes (like shell interpreters or download utilities) spawned from vLLM or Python inference processes, suggesting successful remote code execution.
Detects unexpected child processes (e.g., shell, Python, network utilities) spawned from vLLM or Python worker processes, or suspicious file/network activity related to vLLM/Python processes. This rule aims to identify potential exploitation of CVE-2026-22778, an FFmpeg JPEG2000 heap overflow vulnerability, which could lead to arbitrary code execution within AI/ML environments.
Detects unauthorized, unauthenticated API activity targeting the ServiceNow 'related_list_edit' Scripted REST resource. The rule specifically alerts on requests originating from the 'Guest' account or where authentication requirements have been disabled, which are known indicators of exploitation.
Detects attempts to bypass URL validation and access sensitive GCP metadata endpoints (169.254.169.254 or metadata.google.internal) using a double-slash (//) prefix injection pattern within URL parameters. This technique is often used in Server-Side Request Forgery (SSRF) attacks to read local resources or metadata credentials from Cloud Run or other GCP compute services.
Page 39 of 52