Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
94 detections
Filters
Last updated
All Time
Detection languages
49
31
6
4
2
Contributors
46
20
5
4
3
Categories
45
43
23
10
8
Platforms
43
30
23
4
2
Products / Services
10,660
9,755
6,689
4,418
3,748
MITRE Techniques
45
42
20
18
16
CVEs
3
3
2
2
2
IDS Classtypes
4
1
1
IDS Protocols
6
Detects UNC6240 PSEMHUB.war web shell/tunnel/trojanized installer artifacts by distinctive content markers (x.jsp, u.jsp, tunnel.jsp/jspx, Ple64.exe)
Detects UNC6240 PSEMHUB.war web shell/tunnel/trojanized installer artifacts by distinctive content markers (x.jsp, u.jsp, tunnel.jsp/jspx, Ple64.exe)
Detects UNC6240 PSEMHUB.war web shell/tunnel/trojanized installer artifacts by distinctive content markers (x.jsp, u.jsp, tunnel.jsp/jspx, Ple64.exe)
Detects UNC6240 PSEMHUB.war web shell/tunnel/trojanized installer artifacts by distinctive content markers (x.jsp, u.jsp, tunnel.jsp/jspx, Ple64.exe)
This rule monitors incoming HTTP requests for the presence of the Base64-encoded string 'rO0AB', which is the standard header for serialized Java objects. The presence of this header in an HTTP request body is a strong indicator of a Java deserialization exploitation attempt.
Detects HTTP traffic patterns characteristic of suo5 and Neo-reGeorg web shell tunnels. These tools facilitate bidirectional communication through JSP endpoints (e.g., /jmx/suo5.jsp, /common/themes/top_css.jsp) by utilizing hardcoded proxy identifiers in HTTP headers. This behavior is indicative of a compromised web server acting as a pivot point for command-and-control operations.
Detects instances where a Java-based application (specifically associated with 'floci' or API Gateway components) spawns suspicious child processes such as shell interpreters (sh, bash, powershell, cmd.exe). This pattern is often indicative of post-exploitation activity following a remote code execution (RCE) attempt against a template engine or web-facing gateway. It also identifies specific file paths related to documented 'floci' POCs and RCE payloads.
This rule detects processes generating network connections to multiple known malicious ports (4444, 7211, 8000, 8001, 8002, 10000) within a 30-minute window. This behavior is indicative of command and control (C2) beaconing, where a compromised system periodically communicates with a C2 server. The rule is designed to identify a pattern of C2 activity that might be used across different threat campaigns, leveraging ports commonly associated with various C2 frameworks or custom C2 implementations.
Detects the deletion of .pkg_history or .pkg_logs, an anti-forensic attempt after the dropper completes, associated with the Mastra NPM compromise.
This rule detects attempts to write or modify cron persistence entries via HTTP. Specifically, it looks for HTTP client body content containing the string "/etc/cron" (case-insensitive). This indicates a potential attacker trying to establish persistence on a Linux system by scheduling malicious tasks.
Detects the initial access attempt for the Oracle E-Business Suite vulnerability CVE-2025-61882. This involves a crafted POST request to the UiServlet component containing a malicious XML payload.
Detects exploitation attempts against Oracle WebLogic via suspicious HTTP requests and command execution patterns. The rule identifies WebLogic-specific endpoints combined with RCE payload indicators such as cmd, bash, powershell, wget, curl, or encoded payloads within the URI query.
Detects attempts to exploit a remote code execution vulnerability (CVE-2025-40553) in SolarWinds Web Help Desk. Attackers use hex-encoded escape sequences (`\xNN`) and other JSON parsing gotchas to bypass security filters and achieve deserialization of malicious objects.
This rule is meant to catch a very specific web request pattern tied to the SolarWinds Web Help Desk issue described in the report. The attack sends a crafted request to a known application path and includes a small group of values that are unusual in normal traffic but important in the exploit chain. The rule stays tight by requiring the request method, the path, and the special body values together. That matters because web applications often have busy and messy traffic, and loose matching on only one keyword would create noise. In plain language, this rule tries to spot a request that is not just using the help desk site, but is trying to abuse it to make the server handle attacker-controlled data in a dangerous way. It is best used as a high-confidence lead for review rather than a generic web alert. When it fires, it should be treated as a focused sign of attempted abuse rather than normal help desk.
This detection identifies common web attack patterns including SQL Injection (SQLi), Cross-Site Scripting (XSS), and Local File Inclusion (LFI) by inspecting URL and POST data for specific malicious patterns. It looks for indicators such as script tags, onerror/onload attributes, javascript: URIs, alert() functions for XSS; SQL keywords like UNION SELECT, xp_cmdshell, sp_configure, and common SQLi bypass patterns for SQLi; and directory traversal sequences (../../, ..%2f..%2f), and sensitive file paths like /etc/passwd, /windows/win.ini, php://filter for LFI.
This rule detects an attempt to exploit an XML External Entity (XXE) vulnerability in GeoServer's Web Map Service (WMS) GetMap function. The detection logic looks for HTTP POST requests to the '/wms?' endpoint containing 'request=GetMap' in the URI, and specific XML elements like '<StyledLayerDescriptor>', '<!DOCTYPE', '<!ENTITY', and 'SYSTEM' within the request body, along with a URL-like pattern '://' indicating an attempt to fetch external content.
Detects HTTP POST requests to n8n '/form/*' endpoints where the Content-Type header is 'application/json'. This indicates an attempt to exploit the Content-Type confusion vulnerability (CVE-2026-21858) to achieve arbitrary file read and subsequent remote code execution.
Detects React2Shell exploitation attempts via prototype pollution and Node.js
gadget invocation. Covers vulnerability scanning, gadget testing, and active
RCE exploitation.
gadget invocation. Covers vulnerability scanning, gadget testing, and active
RCE exploitation.
Detects attempts to exploit CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) by identifying Prototype Pollution vectors (__proto__, constructor) specifically targeting the React Flight protocol (RSC headers/params). Covers both clear-text and common JSON escape sequences. The rule also correlates with 500 errors to identify potential successful exploitation or blind probing attempts.
Detects attempts to exploit CVE-2025-55182 (Next.js/React) via Server Actions. Target is identified by the 'Next-Action' header or 'RSC' markers, combined with JSON prototype pollution vectors in the body.
Detects potential command injection attempts against Citrix NetScaler ADC and Gateway devices. This detection is based on the patterns described in a hypothetical proof-of-concept for CVE-2025-7775, which involves injecting shell commands and referencing sensitive system paths in HTTP requests.
Page 1 of 5