Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
73 detections
Filters
Last updated
All Time
Detection languages
38
17
13
5
Contributors
36
9
8
7
3
Categories
24
16
16
8
7
Platforms
38
16
15
7
4
Products / Services
10,650
9,755
6,688
4,418
3,745
MITRE Techniques
26
16
14
14
11
CVEs
9
5
3
3
2
IDS Classtypes
4
1
IDS Protocols
5
Detects configuration changes on F5 BIG-IP. Changing a virtual server, pool or
iRule can silently redirect application traffic to infrastructure the attacker
controls — users reach the same hostname and notice nothing, while traffic takes a
different path.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='F5BIGIP'
and action='CONFIGURATION_CHANGED'
| groupby user
iRule can silently redirect application traffic to infrastructure the attacker
controls — users reach the same hostname and notice nothing, while traffic takes a
different path.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='F5BIGIP'
and action='CONFIGURATION_CHANGED'
| groupby user
Detects an unusual rate of terminated connections at the BIG-IP. Mass termination
can indicate resource exhaustion, a denial of service in progress, or an attacker
disrupting the application tier — and the load balancer sees it before the
application does.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='F5BIGIP' and action='CONNECTION_TERMINATED'
| duration 10m
| groupby srcip, dstip, dstport, app
| select srcip, dstip, dstport, app, count(*) as cnt
| having cnt > 100
can indicate resource exhaustion, a denial of service in progress, or an attacker
disrupting the application tier — and the load balancer sees it before the
application does.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='F5BIGIP' and action='CONNECTION_TERMINATED'
| duration 10m
| groupby srcip, dstip, dstport, app
| select srcip, dstip, dstport, app, count(*) as cnt
| having cnt > 100
Detects authentication to the BIG-IP management interface. These interfaces should
be reachable only from a management network; a login from anywhere else indicates
either an exposure that should not exist or an attacker who has already reached the
management plane.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='F5BIGIP' and action='LOGIN'
| groupby user, srcip, authproto
be reachable only from a management network; a login from anywhere else indicates
either an exposure that should not exist or an attacker who has already reached the
management plane.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='F5BIGIP' and action='LOGIN'
| groupby user, srcip, authproto
Detects anomalous unauthenticated HTTP requests targeting Citrix NetScaler ADC/Gateway, characterized by suspicious URI patterns, non-standard HTTP methods, and malformed request parameters. This rule is designed to identify potential exploitation attempts consistent with CVE-2026-88771.
Detects HTTP requests directed at NetScaler AAA or Gateway authentication endpoints that exhibit characteristics indicative of exploitation attempts against CVE-2026-88771. The rule monitors for anomalies such as excessive Content-Length headers, unusually large URI query parameters, or the presence of duplicated HTTP headers, which may be leveraged to bypass security controls or trigger buffer-related vulnerabilities during the authentication process.
Detects the spawning of shells, interpreters, or system reconnaissance binaries by primary Citrix NetScaler ADC/Gateway processes (httpd, nsppe, aslearning). This behavior is strongly indicative of post-exploitation activity, such as remote command execution, often following the exploitation of vulnerabilities like CVE-2026-88771.
Detects attempts to bypass authentication on Citrix NetScaler Gateway or management interfaces by using alternate URI paths, double-encoding, or path traversal techniques to reach restricted administrative endpoints. This is consistent with exploitation attempts targeting vulnerabilities like CVE-2026-19490.
Detects the creation or modification of a local NetScaler administrative account with superuser (nsroot-level) privileges via the appliance CLI or management API. This activity is indicative of persistent administrative backdoors potentially established after the exploitation of vulnerabilities such as CVE-2026-88771 or CVE-2026-88772.
This rule monitors NetScaler ADC/Gateway system logs for configuration modifications (save, add, or set commands) that occur outside of a designated maintenance window. Such activities, when performed off-hours, may indicate unauthorized persistence, defense evasion, or configuration tampering following successful exploitation.
Detects outbound network connections from Citrix NetScaler appliances that exhibit high periodic regularity (beaconing behavior) towards rare external destinations. This pattern is indicative of potential command and control (C2) communication, possibly following the exploitation of vulnerabilities like CVE-2026-88771/88772.
This rule detects a potential heap overflow exploitation attempt against F5 BIG-IP Access Policy Manager (APM) by inspecting HTTP POST requests to the /oauth/token endpoint with an unusually large 'grant_type' field (exceeding 4096 bytes). This behavior is characteristic of an attempt to trigger the heap overflow vulnerability identified as CVE-2026-94127.
Detects anomalous lateral movement behavior where a successful NetScaler VPN or gateway session is followed immediately by internal remote service logons (RDP, SSH, WinRM) or network connections from the same source IP. This pattern is indicative of potential exploitation of Citrix NetScaler vulnerabilities (e.g., CVE-2026-88771, CVE-2026-88772) or credential abuse to move laterally into the internal environment.
This rule detects anomalous, high-frequency unauthenticated POST requests targeting NetScaler ADC and Gateway management or service endpoints (/vpn/, /logon/, /nitro/). Such patterns are characteristic of automated reconnaissance and exploitation attempts, specifically targeting vulnerabilities like CVE-2026-88771 and CVE-2026-88772.
Detects anomalous NetScaler session activity potentially indicative of session hijacking or token forgery. This includes identifying session tokens reused across different source IP addresses or user-agents within a short timeframe, as well as detecting session tokens utilized in traffic without a preceding recorded authentication or logon event.
This rule detects HTTP POST requests to .php files containing suspicious PHP execution functions in the request body, such as 'system', 'eval', or 'shell_exec'. These patterns are indicative of an attempt to execute commands via an in-memory or injected PHP web shell on an F5 BIG-IP APM device.
Detects anomalous serialized object payloads within authenticated GraphQL subscription requests to GitLab Duo Chat endpoints. This pattern is indicative of exploitation attempts targeting the insecure deserialization vulnerability in GitLab EE (CVE-2026-87719), where malicious payloads are injected into serialized data streams.
Detects anomalous serialized object payloads within authenticated GraphQL subscription requests to GitLab Duo Chat endpoints. This pattern is indicative of exploitation attempts targeting the insecure deserialization vulnerability in GitLab EE (CVE-2026-87719), where malicious payloads are injected into serialized data streams.
Detects anomalous serialized object payloads within authenticated GraphQL subscription requests to GitLab Duo Chat endpoints. This pattern is indicative of exploitation attempts targeting the insecure deserialization vulnerability in GitLab EE (CVE-2026-87719), where malicious payloads are injected into serialized data streams.
Detects anomalous serialized object payloads within authenticated GraphQL subscription requests to GitLab Duo Chat endpoints. This pattern is indicative of exploitation attempts targeting the insecure deserialization vulnerability in GitLab EE (CVE-2026-87719), where malicious payloads are injected into serialized data streams.
Detects anomalous serialized object payloads within authenticated GraphQL subscription requests to GitLab Duo Chat endpoints. This pattern is indicative of exploitation attempts targeting the insecure deserialization vulnerability in GitLab EE (CVE-2026-87719), where malicious payloads are injected into serialized data streams.
Detects possible unauthenticated exploitation attempts against CVE-2025-53521 (F5 BIG-IP APM RCE). Tightened from a generic 'any POST without a cookie on 443/8443' match (extremely broad, alerts on ordinary cookie-less API/health-check traffic) to POST requests specifically targeting F5 APM access-policy processing endpoints (/my.policy, /vdesk/) that lack a session cookie, since the CVE requires an access policy configured on the virtual server and legitimate APM sessions carry a session cookie. Added detection_filter (3 hits/60s per source) to suppress single incidental matches and prioritize repeated attempts. Note: public reporting for this CVE does not include the exact exploit URI/payload, so this is a behavioral/namespace heuristic, not a payload-specific signature — validate against your own APM traffic baseline and update once exploit specifics are published.
Page 1 of 4