Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
97 detections
Filters
Last updated
All Time
Detection languages
55
25
12
3
2
Contributors
52
12
11
4
3
Categories
20
19
17
13
12
Platforms
60
28
13
8
4
Products / Services
10,660
9,755
6,689
4,418
3,748
MITRE Techniques
25
21
18
18
16
CVEs
3
2
2
2
1
IDS Classtypes
2
IDS Protocols
2
Detects Check Point SmartDefense logs for network detections associated with PHP2Shell, specifically CVE-2026-109618 and CVE-2026-109619
Detects VPN/IKE negotiation failures characterized by certificate validation or parsing anomalies on Check Point Security Gateway or Spark firewall devices. These anomalies, when correlated with connections originating from known anonymization infrastructure (such as Tor exit nodes, proxies, or public VPN services), indicate potential exploitation attempts of the CVE-2026-85102 vulnerability, which allows for pre-authentication remote code execution via malformed certificate inputs.
Detects potential exploitation attempts targeting CVE-2026-16232 in Check Point SmartConsole. The rule identifies specific authentication error messages indicating that a username length validation vulnerability is being triggered by a remote attacker attempting to bypass authentication.
This rule detects attempts to exploit a pre-authentication path traversal and unsafe file-upload vulnerability (CVE-2026-93616) in Check Point Management Server. It monitors web server logs for specific application-level error messages related to ReflectionUtils failure and suspicious path traversal sequences (../) in request URLs.
This rule detects potential unauthorized account creation by correlating suspicious administrative activity on network edge devices (VPNs, firewalls) with subsequent local administrator account creation on an internal host within a one-hour window. This behavior is indicative of ransomware affiliates exploiting internet-facing infrastructure to gain initial access and escalate privileges.
Detects outbound network requests from endpoints to known 'uncensored' or jailbroken LLM-as-a-Service domains (e.g., WormGPT, FraudGPT). These platforms are specifically marketed to threat actors for illicit purposes like generating malware, phishing kits, or exploit code, and identifying access to them serves as a leading indicator of adversarial activity.
Detects outbound network requests from endpoints to known 'uncensored' or jailbroken LLM-as-a-Service domains (e.g., WormGPT, FraudGPT). These platforms are specifically marketed to threat actors for illicit purposes like generating malware, phishing kits, or exploit code, and identifying access to them serves as a leading indicator of adversarial activity.
This rule detects potentially suspicious administrative activity on Check Point Security Management or Multi-Domain servers. It monitors the CommonSecurityLog for specific management-related activities ('command', 'cpm', 'cpca') originating from non-trusted IP ranges. This behavior is indicative of unauthorized management access or exploitation attempts targeting the administrative console of Check Point security appliances.
This rule detects potentially suspicious administrative activity on Check Point Security Management or Multi-Domain servers. It monitors the CommonSecurityLog for specific management-related activities ('command', 'cpm', 'cpca') originating from non-trusted IP ranges. This behavior is indicative of unauthorized management access or exploitation attempts targeting the administrative console of Check Point security appliances.
Detects anomalous, oversized IKEv1 Phase 1 packets targeting Check Point VPN devices, indicative of an exploitation attempt for CVE-2026-50751.
Detects anomalous, oversized IKEv1 Phase 1 packets targeting Check Point VPN devices, indicative of an exploitation attempt for CVE-2026-50751.
This rule detects network connections to phishing pages hosted on the workers.dev domain that are attempting to interact with EvilTokens device code API endpoints. These pages are known to implement developer hotkey prevention (F12 blocked, context menu disabled) to hinder in-browser analysis, indicating malicious intent.
Detects a multi-stage attack pattern associated with the Qilin ransomware, beginning with suspicious VPN authentication (potential credential stuffing or bypass), moving through lateral movement attempts (SMB/RDP/WMI), and culminating in ransomware behaviors such as shadow copy deletion, mass file encryption, and ransom note creation.
This rule detects potential Log4Shell (CVE-2021-44228) exploitation attempts by identifying JNDI injection patterns in web request headers, process command lines, and syslog messages. It further identifies suspicious outbound network callbacks to known malicious infrastructure associated with these exploitation attempts.
Detects a multi-stage attack pattern associated with the Qilin ransomware, beginning with suspicious VPN authentication (potential credential stuffing or bypass), moving through lateral movement attempts (SMB/RDP/WMI), and culminating in ransomware behaviors such as shadow copy deletion, mass file encryption, and ransom note creation.
This rule detects network connections to phishing pages hosted on the workers.dev domain that are attempting to interact with EvilTokens device code API endpoints. These pages are known to implement developer hotkey prevention (F12 blocked, context menu disabled) to hinder in-browser analysis, indicating malicious intent.
This rule looks for signs that someone is abusing an older Check Point VPN login method that has known security flaws. Successful abuse can give remote access without proper credentials. Patch and monitor VPN gateways if this appears. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule correlates successful VPN authentication events with the subsequent execution of tools commonly associated with ransomware staging activities within a 6-hour window. It aims to detect initial access via VPN followed by preparatory actions for ransomware deployment. The rule specifically looks for VPN logins from 'Check Point' devices and process executions of 'rclone.exe', '7z.exe', 'powershell.exe', 'wevtutil.exe', 'vssadmin.exe', or 'nltest.exe'.
This rule detects external brute-force attempts against firewall authentication mechanisms. It triggers when 15 or more failed login attempts from a single external IP address occur within a 15-minute window. The rule specifically filters for 'USER_LOGIN' events with a 'BLOCK' or 'FAIL' security result and excludes internal RFC1918 IP addresses to focus on external threats.
This rule set detects various stages of activity related to the 'OpenClaw' malware family and associated campaigns. It includes detection for OpenClaw process execution, exposure of a specific administrative port, execution of shell commands via curl (ClawHavoc delivery), outbound webhook exfiltration, and infostealer access to OpenClaw configuration files.
Detects successful VPN connections from various common security devices logging to CommonSecurityLog. Monitoring successful VPN logins is crucial for tracking remote access and identifying potential unauthorized access, especially when correlated with other events like logins from unusual locations or impossible travel scenarios.
Page 1 of 5