Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,084 detections
Filters
Last updated
All Time
Detection languages
418
193
163
156
81
Contributors
381
251
92
71
40
Categories
498
271
255
135
123
Platforms
443
441
267
121
114
Products / Services
10,665
9,758
6,692
4,418
3,749
1,084
MITRE Techniques
278
229
180
177
151
CVEs
17
15
13
13
8
IDS Classtypes
4
IDS Protocols
4
Detects the spawning of suspicious child processes by an Atlassian Confluence server, specifically looking for shell interpreters (sh, bash, dash, ksh, zsh, csh, fish), curl, wget, or python being executed as child processes of the Confluence Java process. This behavior is indicative of successful exploitation of CVE-2022-26134, a critical remote code execution vulnerability in Atlassian Confluence. The rule focuses on the post-exploitation phase where an attacker would execute commands on the compromised server.
Detects process execution related exceptions in JVM based applications, which can often indicate Remote Code Execution (RCE) attempts. The rule specifically looks for keywords like 'Cannot run program', 'java.lang.ProcessImpl', and 'java.lang.ProcessBuilder' in application error logs.
This rule detects potential local file read vulnerabilities in JVM-based applications by looking for specific keywords in application error logs. It triggers when a 'FileNotFoundException' occurs in conjunction with path traversal payloads like '/../../..'. This combination suggests an attacker is attempting to read arbitrary files from the system by manipulating input paths, which could lead to sensitive information disclosure.
Detects potential XML External Entity (XXE) exploitation attempts in JVM-based applications by looking for specific XML parsing error keywords in application error logs. These errors, such as 'SAXParseException' and 'DOMException', can indicate that an attacker is trying to manipulate XML input to access local files, perform server-side request forgery (SSRF), or execute other malicious actions. The rule is designed to identify issues where an application expects to work with XML and the parser might not be initialized safely.
Detects exploitation attempts targeting the VMware View Planner vulnerability, CVE-2021-21978. This vulnerability allows for arbitrary file upload due to an unrestricted file upload flaw in the 'upload' function, specifically within the 'wsgi_log_upload.py' script. Attackers can leverage this to upload malicious files, potentially leading to remote code execution.
This rule detects potential JNDI (Java Naming and Directory Interface) injection exploitation attempts within JVM-based applications. It specifically looks for keywords related to LDAP lookups ('com.sun.jndi.ldap.') and the Log4j JndiManager ('org.apache.logging.log4j.core.net.JndiManager') in application error logs. Such patterns are commonly associated with vulnerabilities like Log4Shell, where attackers inject malicious JNDI lookup strings to achieve remote code execution.
Detects potential Spring Expression Language (SpEL) Injection exploitation attempts, which can lead to Remote Code Execution (RCE). The rule specifically looks for the 'org.springframework.expression.ExpressionException' keyword in application error logs, indicating that an attempt to evaluate a malicious expression might have occurred or failed.
Detects exploitation attempts of Sitecore Experience Platform Pre-Auth RCE CVE-2021-42237. This vulnerability allows for remote code execution without authentication. The rule specifically looks for POST requests to the '/sitecore/shell/ClientBin/Reporting/Report.ashx' endpoint that result in a 200 HTTP status code, indicating a successful interaction with the vulnerable component.
This rule detects common SQL exception types in Python applications as defined by PEP 249. These exceptions (DataError, IntegrityError, ProgrammingError, OperationalError) indicate issues during database operations, which could range from malformed queries to database connectivity problems or constraint violations. While often benign, repeated or unusual occurrences of these errors could signal application vulnerabilities being exploited (e.g., SQL injection attempts leading to syntax errors) or other malicious database interactions.
Detects attempts to exploit Apache Spark shell command injection vulnerabilities, specifically CVE-2022-33891, by monitoring for suspicious command-line executions involving 'id -Gn' as a child process of a bash shell. This indicates an attacker successfully injecting commands into the Spark environment.
Detects potential exploitation attempts targeting the Cacti Command Injection vulnerability, CVE-2022-46169. The rule looks for specific patterns in GET requests to '/remote_agent.php' with 'action=polldata' and 'poller_id=' in the query, combined with suspicious command injection payloads like 'base64 -d | /bin/bash', 'whoami', 'powershell', 'cmd', or 'wget'.
Java Payload Strings
Sigma
Detects possible Java payloads in web access logs
Yara rule that detects GwisinLocker ransomware.
Page 52 of 52