Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
216 detections
Filters
Last updated
All Time
Detection languages
63
55
53
15
9
Contributors
57
34
30
28
16
Categories
100
75
74
73
39
Platforms
126
94
59
5
4
Products / Services
10,650
9,755
6,688
4,418
3,745
MITRE Techniques
101
79
76
70
59
CVEs
6
5
5
5
4
IDS Classtypes
11
2
1
1
IDS Protocols
15
This rule set detects potential post-exploitation activity and exploitation attempts targeting Ivanti EPMM (formerly MobileIron Core). The first rule, `ivanti_epmm_java_spawns_shell`, identifies suspicious process creation where a Java or Tomcat process (parent process) spawns a shell process (cmd.exe, bash, sh, or powershell.exe). This behavior is indicative of an attacker gaining remote code execution and using the compromised Java/Tomcat process to execute system commands. The second rule, `ivanti_epmm_http_featureusage_exploit`, detects HTTP requests to the `/api/v2/featureusage` endpoint that contain parameters indicative of Expression Language (EL) injection or format string abuse, specifically looking for `format=` along with keywords like `${`, `Runtime`, `exec`, or `getRuntime` in the URL. This suggests an attempt to exploit a vulnerability in the Ivanti EPMM application to achieve remote code execution.
This detection identifies common web attack patterns including SQL Injection (SQLi), Cross-Site Scripting (XSS), and Local File Inclusion (LFI) by inspecting URL and POST data for specific malicious patterns. It looks for indicators such as script tags, onerror/onload attributes, javascript: URIs, alert() functions for XSS; SQL keywords like UNION SELECT, xp_cmdshell, sp_configure, and common SQLi bypass patterns for SQLi; and directory traversal sequences (../../, ..%2f..%2f), and sensitive file paths like /etc/passwd, /windows/win.ini, php://filter for LFI.
This rule detects an attempt to exploit an XML External Entity (XXE) vulnerability in GeoServer's Web Map Service (WMS) GetMap function. The detection logic looks for HTTP POST requests to the '/wms?' endpoint containing 'request=GetMap' in the URI, and specific XML elements like '<StyledLayerDescriptor>', '<!DOCTYPE', '<!ENTITY', and 'SYSTEM' within the request body, along with a URL-like pattern '://' indicating an attempt to fetch external content.
Detects HTTP POST requests to n8n '/form/*' endpoints where the Content-Type header is 'application/json'. This indicates an attempt to exploit the Content-Type confusion vulnerability (CVE-2026-21858) to achieve arbitrary file read and subsequent remote code execution.
This rule query identifies likely post‑exploitation activity associated with React2Shell (CVE-2025-55182) in which Part 1 identifies web servers spawning unusual child processes (such as command shells or system utilities) combined with suspicious command-line patterns, which may indicate post-exploitation behavior following a compromise. and part 2 detects web servers making outbound network connections to known malicious IPs or hostnames, or to domains associated with tunneling services (e.g., trycloudflare.com), suggesting potential command-and-control activity or data exfiltration.
Detects React2Shell exploitation attempts via prototype pollution and Node.js
gadget invocation. Covers vulnerability scanning, gadget testing, and active
RCE exploitation.
gadget invocation. Covers vulnerability scanning, gadget testing, and active
RCE exploitation.
Detects attempts to exploit CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) by identifying Prototype Pollution vectors (__proto__, constructor) specifically targeting the React Flight protocol (RSC headers/params). Covers both clear-text and common JSON escape sequences. The rule also correlates with 500 errors to identify potential successful exploitation or blind probing attempts.
Detects attempts to exploit CVE-2025-55182 (Next.js/React) via Server Actions. Target is identified by the 'Next-Action' header or 'RSC' markers, combined with JSON prototype pollution vectors in the body.
Detects potential command injection attempts against Citrix NetScaler ADC and Gateway devices. This detection is based on the patterns described in a hypothetical proof-of-concept for CVE-2025-7775, which involves injecting shell commands and referencing sensitive system paths in HTTP requests.
This rule detects inbound HTTP requests containing the User-Agent string 'Salesforce-Multi-Org-Fetcher/1.0'. This specific User-Agent has been associated with data theft from Salesforce instances, as detailed in a Google Cloud blog post. The detection aims to identify potential malicious activity targeting web server applications, specifically Salesforce environments, where an attacker might be attempting to exfiltrate data.
ET WEB_SPECIFIC_APPS VMware Workspace ONE Access OAuth2TokenResourceController ACS Authentication Bypass (CVE-2022-22956)
ET WEB_SPECIFIC_APPS Adobe ColdFusion Unauthenticated Remote Code Execution (CVE-2023-29300)
The following analytic detects the use of default or publicly known named pipes associated with Cobalt Strike. It leverages Sysmon EventID 17 and 18 to identify specific named pipes commonly used by Cobalt Strike's Artifact Kit and Malleable C2 Profiles. This activity is significant because Cobalt Strike is a popular tool for adversaries to conduct post-exploitation tasks, and identifying its named pipes can reveal potential malicious activity. If confirmed malicious, this could indicate an active Cobalt Strike beacon, leading to unauthorized access, data exfiltration, or further lateral movement within the network.
This analytic detects suspicious data transfer activities involving the use of the `split` syscall with the `-b` option, which specifies the size of each output file. This technique can be used by attackers to evade detection by breaking large files into smaller parts, bypassing size-based security controls, and facilitating covert exfiltration of sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall with a specified block size, this analytic helps identify potential data exfiltration attempts.
Detects suspicious file writes to the root directory of web applications, specifically targeting Apache or Tomcat servers. This activity often indicates an attempt to deploy malicious files like web shells or other unauthorized scripts, potentially after exploiting a public-facing application.
This analytic identifies the bulk creation of ransomware notes (e.g., .txt, .html, .hta files) on an infected machine. It leverages Sysmon EventCode 11 to detect multiple instances of these file types being created within a short time frame (10 seconds). A detection is triggered if 15 or more unique readme paths are observed. This activity is a strong indicator of an active ransomware attack, where the attacker is notifying the victim of the encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering critical files inaccessible and potentially causing significant operational disruption.
The following analytic detects suspicious attempts to find credentials stored in password stores, indicating a potential attacker's effort to access sensitive login information. Password stores are critical repositories that contain valuable credentials, and unauthorized access to them can lead to significant security breaches. By monitoring for unusual or unauthorized activities related to password store access, this analytic helps identify potential credential theft attempts, allowing security teams to respond promptly and prevent unauthorized access to critical systems and data.
Detects potential command injection attempts in the body of HTTP POST requests. Attackers, such as those operating the RondoDoX botnet, exploit unsanitized input fields in web interfaces of SOHO routers, IoT devices, and other applications to execute arbitrary commands. This rule looks for common command-line tools and shell characters within the POST body, particularly in requests targeting parameters known to be vulnerable.
This analytic detects instances where web or application server processes (such as Java, Tomcat, Apache, Nginx, Node, Caddy, IIS, PHP) spawn a Linux or Windows shell. This activity is highly indicative of successful exploitation, potentially related to vulnerabilities like Log4Shell (CVE-2021-44228) or Spring4Shell (CVE-2022-22965), leading to unauthorized command execution, privilege escalation, or persistent access. The detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on parent-child process relationships and process names.
The following analytic identifies the execution of RAR utilities to archive files on a system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, GUIDs, and command-line arguments. This activity is significant as threat actors, including red-teamers and malware like DarkGate, use RAR archiving to compress and exfiltrate collected data from compromised hosts. If confirmed malicious, this behavior could lead to the unauthorized transfer of sensitive information to command and control servers, posing a severe risk to data confidentiality and integrity.
Detects the initial access attempt for the Oracle E-Business Suite vulnerability CVE-2025-61882. This involves a crafted POST request to the UiServlet component containing a malicious XML payload.
Page 6 of 11