Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,084 detections
Filters
Last updated
All Time
Detection languages
418
193
163
156
81
Contributors
381
251
92
71
40
Categories
498
271
255
135
123
Platforms
443
441
267
121
114
Products / Services
10,665
9,758
6,692
4,418
3,749
1,084
MITRE Techniques
278
229
180
177
151
CVEs
17
15
13
13
8
IDS Classtypes
4
IDS Protocols
4
Detects the creation of specific webshell files (GW.class, payload.bin, or dpr_<8-hex-digits>.jsp) associated with CVE-2026-4681 weaponization on PTC Windchill and FlexPLM servers, or suspicious web requests containing patterns which could indicate exploitation attempts.
This rule detects various indicators associated with the Shai-Hulud supply chain attack. It identifies known malicious hashes, suspicious file creations in GitHub workflows, destructive commands on Linux/macOS and Windows systems, initial execution via npm preinstall scripts, and the installation of specific vulnerable application names or applications from known vulnerable vendors.
Detects Zimbra SOAP API requests attempting to enable IMAP access by setting zimbraPrefImapEnabled. This is a known persistence technique used by threat actors (such as in Operation GhostMail) to silently enable mail protocols, bypassing the web UI to maintain access using stolen app-specific passwords.
Detects the creation of an app-specific password named 'ZimbraWeb' via Zimbra SOAP API. This specific persistent credential name is a known mechanism utilized in the Operation GhostMail campaign by a Russian APT.
Detects access to the Zimbra mailbox export endpoint (/home/~/?fmt=tgz). This native Zimbra feature is actively abused by APT actors (such as in Operation GhostMail) to silently export emails without deploying custom collection tools.
Detects attempts to exploit the authentication bypass vulnerability (CVE-2026-29000) in the pac4j-jwt library. An attacker can craft a JWE token containing an unsigned PlainJWT, which causes the library to skip signature verification. This is often indicated by a successfully authenticated token with an 'alg' (algorithm) claim of 'none'. This detection requires application logs to be configured to record the claims of successfully authenticated JWTs.
This detection identifies JSON Web Tokens (JWTs) with an expiration time ("exp" claim) that is set unusually far in the future. Attackers may forge tokens with long lifespans to maintain persistent access after an initial compromise.
Detects the presence of the unique 'ic-tracker-js' ID within script tags on web server files (.php, .html, .js), which is a high-fidelity indicator of a compromised WordPress site by the IClickFix framework. This rule looks for file creation or modification events where the initiating process command line contains the malicious string.
Detects potential JSON Web Token (JWT) algorithm confusion attacks. This occurs when an attacker sends a token signed with a symmetric algorithm (e.g., HS256) to a server expecting an asymmetric one (e.g., RS256). If the server is misconfigured, it may use its public key as the HMAC secret, allowing the attacker to forge valid tokens. The rule specifically looks for JWTs with symmetric HMAC-based algorithms (HS256, HS384, HS512) being sent to applications configured to exclusively use asymmetric key algorithms.
Detects potential JSON Web Token (JWT) authentication bypass attempts where the algorithm in the token header is explicitly set to "none". A vulnerable server might skip signature validation for such tokens, allowing an attacker to forge arbitrary claims and potentially gain unauthorized access or escalate privileges.
This rule detects activity associated with UNC6201 exploiting Dell RecoverPoint VM (CVE-2026-22769), which involves the SLAYSTYLE/BRICKSTORM/GRIMBOLT malware. It identifies attempts to deploy WAR files via Tomcat Manager, suspicious WAR file uploads or modifications in Tomcat directories on Linux appliances, modifications to a persistence script named 'convert_hosts.sh', network communication with a GRIMBOLT C2 endpoint (149.248.11.71), and specific file hashes linked to the threat actor.
This rule detects activity related to the DKnife gateway AitM (Adversary-in-the-Middle) threat, as detailed in Talos Intelligence reporting. It identifies specific binary names (dknife.bin, sslmm.bin, postapi.bin, rules.bin, sshapi.bin, inotify.bin, curlapi.bin) associated with the threat, either as process names or file names. Additionally, it looks for configuration artifacts (rules.conf, sslmm.cfg, url.cfg) used by the proxy/redirect logic, either as file names or within process command lines. Finally, the rule identifies exfiltration or tagging markers (dkimsi=, 460110672021628, PASSWORD) observed in logs or artifacts, which are indicative of DKnife's reporting mechanisms.
This rule detects the installation or execution of known malicious, typosquatted npm packages associated with the SANDWORM_MODE campaign. It identifies process creation events related to common Node.js package managers (npm, yarn, npx) and checks for command lines indicating package installation or execution, specifically looking for the presence of malicious package names from the SANDWORM_MODE campaign.
This rule detects various indicators associated with the Booking.com phishing campaign targeting hotels and customers. It identifies suspicious web requests to non-Booking.com domains containing 'op_token' and 'complaint' or 'reservation' keywords, especially when combined with punycode, 'booklng' typos, or management-related subdomains. It also looks for partner kit patterns involving 'sign-in/?tpo_token=' and 'booklng' in URLs. Additionally, it identifies suspicious emails from newly generated Gmail accounts with specific subjects ('Automatic reply', 'Availability', 'Reservation') containing 'op_token' in the subject or body.
This rule detects the creation of specific JSP web shell filenames (1.jsp, 401.jsp, 403.jsp) and suspicious CSS files in the Ivanti EPMM web application directory. This activity is indicative of post-exploitation persistence following the exploitation of vulnerabilities like CVE-2026-1281 or CVE-2026-1340.
Detects suspicious child processes (e.g., shells, network utilities) spawned by the Ivanti EPMM web server process (java, tomcat, httpd). This behavior is a strong indicator of successful remote code execution, often following the exploitation of vulnerabilities like CVE-2026-1281 and CVE-2026-1340.
Sleeper-style JSP backdoor: 403.jsp or similar with Runtime.getRuntime().exec or ProcessBuilder
Detects events that may indicate a user is being enrolled into a Bitwarden organization's account recovery policy under malicious circumstances. As described by researchers, a malicious or compromised server can silently add a user to an attacker-controlled organization and enable an account recovery policy. The victim's client will then encrypt the user's vault key with an attacker-provided public key and upload it, leading to a full vault compromise.
This rule detects potential exploitation attempts targeting Ivanti EPMM vulnerabilities (CVE-2025-4427/4428) and subsequent post-exploitation activities. It has two main parts:
1. Web Request Analysis: It identifies web requests to the `/api/v2/featureusage` endpoint that contain suspicious patterns indicative of command injection or expression language injection attempts.
2. Process Creation Analysis: It looks for unusual process creations where Java or Tomcat-related processes (`java.exe`, `javaw.exe`, `catalina.bat`, `catalina.sh`) spawn command-line interpreters (`cmd.exe`, `bash`, `sh`, `powershell.exe`) or processes whose command lines contain keywords like `sliver` or `implant`, suggesting the deployment of malicious implants or sleeper shells.
1. Web Request Analysis: It identifies web requests to the `/api/v2/featureusage` endpoint that contain suspicious patterns indicative of command injection or expression language injection attempts.
2. Process Creation Analysis: It looks for unusual process creations where Java or Tomcat-related processes (`java.exe`, `javaw.exe`, `catalina.bat`, `catalina.sh`) spawn command-line interpreters (`cmd.exe`, `bash`, `sh`, `powershell.exe`) or processes whose command lines contain keywords like `sliver` or `implant`, suggesting the deployment of malicious implants or sleeper shells.
Detects successful brute force attacks: 10+ login failures within 10 minutes followed by successful login within 1 hour, excluding trusted networks and whitelisted accounts
This rule set detects potential post-exploitation activity and exploitation attempts targeting Ivanti EPMM (formerly MobileIron Core). The first rule, `ivanti_epmm_java_spawns_shell`, identifies suspicious process creation where a Java or Tomcat process (parent process) spawns a shell process (cmd.exe, bash, sh, or powershell.exe). This behavior is indicative of an attacker gaining remote code execution and using the compromised Java/Tomcat process to execute system commands. The second rule, `ivanti_epmm_http_featureusage_exploit`, detects HTTP requests to the `/api/v2/featureusage` endpoint that contain parameters indicative of Expression Language (EL) injection or format string abuse, specifically looking for `format=` along with keywords like `${`, `Runtime`, `exec`, or `getRuntime` in the URL. This suggests an attempt to exploit a vulnerability in the Ivanti EPMM application to achieve remote code execution.
Page 45 of 52