Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,084 detections
Filters
Last updated
All Time
Detection languages
418
193
163
156
81
Contributors
381
251
92
71
40
Categories
498
271
255
135
123
Platforms
443
441
267
121
114
Products / Services
10,665
9,758
6,692
4,421
3,749
1,084
MITRE Techniques
278
229
180
177
151
CVEs
17
15
13
13
8
IDS Classtypes
4
IDS Protocols
4
This rule detects attempts to exploit MyBB administrative controls. It monitors for two primary patterns: unauthorized privilege escalation where a limited ACP account creates a new Administrator (usergroup=4) user by bypassing access controls, and unauthorized access by limited ACP accounts to restricted administrative modules such as template and plugin management.
This rule detects activities associated with c-ares TCP Use-After-Free (UAF) exploitation, specifically identifying execution of known Proof-of-Concept binaries, the creation of exploitation proof marker files, and suspicious parent-child process relationships where network-facing services or common interpreters (e.g., node, curl, python) spawn unexpected calculator or shell processes indicative of RCE payloads.
Detects potential privilege escalation within the MyBB Administrative Control Panel (ACP). The rule identifies POST requests to user management modules that set a user's group ID (gid) or usergroup to 4, which typically corresponds to the administrator group in MyBB. It verifies the escalation by correlating it with a prior session that lacked administrator privileges and identifying a subsequent login event.
Detects unauthorized attempts to escalate privileges within the MyBB Admin Control Panel (ACP) by creating a new account or modifying an existing one to belong to the administrator group (gid=4). This is indicative of an attacker attempting to gain full administrative control by bypassing module-level access restrictions.
Detects unauthenticated GET requests to the vulnerable ServiceNow REST API endpoint '/api/now/related_list_edit/create' which was exploited in early June 2026. The detection monitors for requests originating from anonymous or guest users, lacking authorization headers, and returning successful (200) responses.
Detects attempts to restore or extract files containing path traversal characters ('../' or '..\') commonly associated with the ZipSlip vulnerability. This technique was utilized in Operation Escaneo (via the mkzip34.py tool) to deploy webshells automatically upon legitimate archive restoration. The rule specifically looks for file creation or modification events where the initiating process is a common archive extraction tool (unzip, tar) or a Java application server (java, tomcat), the file extension is for a Java web application (.jsp, .jspx), and the resulting folder path contains path traversal sequences.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
Detects unauthorized privilege escalation attempts within the MyBB Admin Control Panel (ACP) by monitoring limited-privilege accounts accessing restricted modules (e.g., plugins, templates, user groups). It correlates these web requests with file system changes in the plugin directory by the web server process and monitors application logs for suspicious administrative activity.
Detects HTTP POST requests to MyBB Admin Control Panel modules restricted to superadministrators (e.g., user management, group configuration, settings) initiated by non-privileged accounts. This activity is consistent with privilege escalation exploitation patterns where internal authorization checks might be bypassed.
This rule detects anomalous access to cloud services, specifically Salesforce, Drift, Salesloft, HubSpot, and Marketo, that may indicate OAuth token abuse. It identifies scenarios where a high volume of actions (8 or more) occur within a short timeframe (3 hours or less) from a single IP address but with multiple unique user agents (2 or more). The detection is further refined by looking for actions related to 'Add delegated permission grant' or 'Create service principal', which are indicative of an attacker attempting to establish persistence or escalate privileges after gaining access through a compromised OAuth token.
This rule detects the dropping of a 24-character hexadecimal JavaScript payload followed by the creation of a '.pkg_history' or '.pkg_logs' marker file within a one-minute timeframe. This behavior is indicative of the Mastra NPM supply chain compromise.
This rule detects potentially unauthorized or suspicious command execution originating from AI development assistant processes such as Claude, Cursor, Amazon Q, or Node-based environments. It specifically monitors for the invocation of shell commands (e.g., bash, sh -c) or package managers (npx) that interact with sensitive AI assistant configuration files (e.g., .amazonq, mcp.json), which could indicate an adversary attempting to leverage AI integration paths for unauthorized command execution or persistent configuration manipulation.
This rule detects a sequence of events where multiple failed one-time code (MFA) attempts are followed by a successful new device registration within Dashlane. This pattern can indicate an attacker attempting to brute-force MFA codes and then registering a new device once successful, potentially leading to account compromise.
Detects unauthenticated ServiceNow Scripted REST Resource access attributed to Guest user or known attacker IP 51.159.98.241
This rule identifies newly created PHP files within specific WordPress plugin folders ("woocommerce-subscription" or "woocommerce-notification") that have a rare SHA256 hash count (less than 5 occurrences in the enterprise). This behavior is indicative of web shells or backdoored plugin files, potentially introduced via a supply chain compromise.
Detects w3wp.exe directly passing backdoor files as command line arguments to a PHP runtime. This activity is indicative of a supply chain compromise where malicious PHP files are executed by the IIS worker process.
This rule identifies the execution of MeshCentral for remote command execution by looking for specific command-line arguments. It specifically targets instances where 'meshctrl.js' and 'RunCommand' are present in process command lines or syslog messages. This activity has been associated with threat actors like ShinyHunters.
Detects the presence of PIL exception messages in application logs that leak heap memory addresses. This is the first stage of the CVE-2026-22778 exploitation chain against vLLM instances used to bypass ASLR.
Detects interaction with the WordPress Theme Editor utility immediately followed by a file modification to functions.php, indicative of the ErrTraffic deployment phase. This activity can be a sign of web shell deployment or other malicious code injection.
Detects web requests attempting to exploit CWE-78 in AutoGen MCP via base64 encoded parameters in the URL. Specifically looks for '/api/mcp/ws/' and 'server_params=' within syslog messages.
This rule detects the creation of a '.pkg_history' file, which is a known indicator of the Mastra NPM supply chain compromise, followed by a network connection to specific command and control (C2) IP addresses (23.254.164.123 or 23.254.164.92) within a 5-minute window on the same device. This correlation aims to identify successful exploitation and subsequent C2 communication by the Mastra NPM malware.
Page 42 of 52