Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
233 detections
Filters
Last updated
All Time
Detection languages
102
76
22
16
7
Contributors
67
65
42
13
8
Categories
108
61
51
46
34
Platforms
39,908
7,245
6,529
3,864
3,627
233
Products / Services
81
68
63
51
21
MITRE Techniques
97
63
44
31
19
CVEs
18
13
11
10
8
IDS Classtypes
48
11
6
5
3
IDS Protocols
33
28
14
Detects network requests targeting Dahua devices that attempt to exploit CVE-2021-33044. The exploitation involves sending a crafted 'global.login' RPC call with specific parameters (clientType 'NetKeyboard', loginType 'Direct', authorityType 'Default') to bypass authentication and retrieve administrative session tokens.
Detects repeated HTTP requests targeting the '/cgi-bin/' path on Dahua camera web interfaces with a specific user-agent string ('CGI Brute'). This behavior is characteristic of an automated brute-force campaign attempting to gain unauthorized access to camera web administration interfaces.
This rule detects a high volume of TCP synchronization (SYN) packets from external sources directed at a Cisco IOS XR network device. This behavioral pattern is indicative of a resource exhaustion denial-of-service (DoS) attack, potentially attempting to exploit vulnerabilities such as CVE-2026-20274 by flooding the control plane.
Detects the presence of the known Cyclops Blink implant by file hash (SHA256) on an endpoint, followed by a network connection to associated C2 infrastructure within one hour, aligning with typical implant beaconing or file transfer behavior.
Detects the presence of the known Cyclops Blink implant by file hash (SHA256) on an endpoint, followed by a network connection to associated C2 infrastructure within one hour, aligning with typical implant beaconing or file transfer behavior.
This rule detects potentially malicious network activity involving Dahua PTCP protocol packets that specifically request a loopback bind (127.0.0.1) using an inverted-STUN style mechanism. This behavior is indicative of an adversary attempting to bypass network segmentation or perform local service proxying/tunneling to maintain command and control or enable unauthorized access to internal services on the target device.
This rule monitors for the creation or presence of a specific backdoor account (username 'p2pwn' and password 'p2password') on Dahua devices. This account is known to be injected by threat actors exploiting CVE-2024-39943 as part of Operation CameraSwarm to maintain persistent unauthorized access.
Detects high-frequency login attempts using the Dahua Easy4IP protocol. The rule flags multiple login opcode requests (identified by specific byte patterns 0xFF followed by 0x00A0) originating from the same source within a 60-second window, which is indicative of an automated brute-force or credential-stuffing attack targeting vulnerable IoT devices.
Detects coordinated behavioral signals associated with the CVE-2025-25249 campaign, which deploys the PivotC2 Node.js RAT on FortiGate devices. The rule correlates anomalous inbound CAPWAP (UDP/5246) traffic, Node.js process execution, suspicious JavaScript file writes, and unauthorized access to Fortinet configuration files, followed by long-lived outbound TLS beacons to non-standard ports.
Detects anomalous, high-frequency inbound TCP connection attempts to port 102 (S7comm), which is used by Siemens S7 PLCs. This behavior is indicative of automated network scanning or reconnaissance targeting industrial control system (ICS) infrastructure.
Detects S7comm 'PUT' or 'Write Var' commands directed at a PLC via port 102 when no authorized maintenance window is active, indicating potentially unauthorized industrial control system (ICS) modifications.
Detects high-frequency, repeated exploitation attempts or IDS alerts referencing Siemens S7 CVEs directed at a single destination IP, potentially indicating iterative exploit development or automated vulnerability testing against Industrial Control System (ICS) hardware.
Detects unauthorized S7comm 'GET' or 'Read' operations directed at Siemens S7 Series PLCs over TCP port 102. These commands are often used in reconnaissance phases of ICS/OT attacks to map memory blocks, read ladder logic, or identify system state before executing more disruptive operations.
Detects unauthorized network sessions targeting Siemens S7 PLCs. The rule specifically identifies unauthenticated S7comm protocol traffic on TCP port 102 and the usage of default SNMP community strings ('public' or 'private') on port 161, which are indicative of exploitation attempts or unauthorized access to industrial control system (ICS) hardware.
Detects unauthorized S7comm 'PUT' or 'Write' operations to Programmable Logic Controller (PLC) data blocks or configuration memory that occur outside of defined maintenance or change windows, specifically when no valid work order is associated with the event.
Detects signs of exploitation against FortiOS/FortiProxy authentication bypass vulnerabilities (CVE-2024-55591 / CVE-2025-24472) consistent with Gunra ransomware activity. This rule monitors for administrative logins originating from non-management public IP addresses and identifies potential MFA bypass attempts through the reuse of identical one-time passcodes across multiple distinct accounts or sessions within a one-hour window.
This rule monitors for two critical firmware-related conditions: detected non-compliance with secure boot, UEFI, or TPM configuration standards via Microsoft Defender TVM, and explicit firmware or boot configuration change events reported by device telemetry. It is designed to identify potential tampering or misconfigurations that could facilitate bootkits or other pre-OS persistence mechanisms.
This rule monitors for two critical firmware-related conditions: detected non-compliance with secure boot, UEFI, or TPM configuration standards via Microsoft Defender TVM, and explicit firmware or boot configuration change events reported by device telemetry. It is designed to identify potential tampering or misconfigurations that could facilitate bootkits or other pre-OS persistence mechanisms.
Detects signs of exploitation against FortiOS/FortiProxy authentication bypass vulnerabilities (CVE-2024-55591 / CVE-2025-24472) consistent with Gunra ransomware activity. This rule monitors for administrative logins originating from non-management public IP addresses and identifies potential MFA bypass attempts through the reuse of identical one-time passcodes across multiple distinct accounts or sessions within a one-hour window.
Detects unauthorized modifications to the /etc/init.d/workplace initialization script on SonicWall SMA appliances, specifically looking for additions of commands that launch the KNUCKLEBALL Python-based loader (deploy_new.py). This behavior indicates an adversary attempting to establish boot-time persistence.
Detects the use of PowerShell to invoke 'Confirm-SecureBootUEFI' or 'Clear-SecureBootKeys' cmdlets. These commands are utilized by the TOKYOCORE wiper malware to erase the UEFI Secure Boot key database, effectively preventing the system from booting a signed operating system as part of a destructive attack chain.
Page 8 of 12