Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
78 detections
Filters
Last updated
All Time
Detection languages
41
13
9
6
6
Contributors
39
9
7
5
3
Categories
28
27
21
20
10
Platforms
33
28
17
5
2
Products / Services
10,660
9,758
6,692
4,418
3,748
MITRE Techniques
23
23
20
20
13
CVEs
8
7
2
1
1
IDS Classtypes
7
IDS Protocols
6
Detects configuration changes to Oracle Audit Vault. The Vault is the integrity
control for database auditing, so altering its configuration can stop collection,
narrow what is recorded, or redirect the audit trail — removing the evidence of
whatever follows.
Treat any change here as affecting the reliability of all database audit data for
the period concerned.
Onboarding: ORACLE-AUDIT-VAULT is ingested via Syslog (KV) (Bloo extractor 310).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='ORACLE-AUDIT-VAULT'
and action='CONFIGURATION_CHANGED'
| groupby user, config, srcip
control for database auditing, so altering its configuration can stop collection,
narrow what is recorded, or redirect the audit trail — removing the evidence of
whatever follows.
Treat any change here as affecting the reliability of all database audit data for
the period concerned.
Onboarding: ORACLE-AUDIT-VAULT is ingested via Syslog (KV) (Bloo extractor 310).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='ORACLE-AUDIT-VAULT'
and action='CONFIGURATION_CHANGED'
| groupby user, config, srcip
This rule detects potential exploitation of the Oracle PeopleSoft PSEMHUB component vulnerability (CVE-2026-35273). It identifies suspicious POST requests to the PSEMHUB HttpListeningConnector servlet, including obfuscated URL paths, followed by the creation of suspiciously named .jsp or .jspx files in the PSEMHUB.war application directory, which is indicative of a web shell deployment.
This rule detects potential exploitation of the Oracle PeopleSoft PSEMHUB component vulnerability (CVE-2026-35273). It identifies suspicious POST requests to the PSEMHUB HttpListeningConnector servlet, including obfuscated URL paths, followed by the creation of suspiciously named .jsp or .jspx files in the PSEMHUB.war application directory, which is indicative of a web shell deployment.
This rule detects potential exploitation of the Oracle PeopleSoft PSEMHUB component vulnerability (CVE-2026-35273). It identifies suspicious POST requests to the PSEMHUB HttpListeningConnector servlet, including obfuscated URL paths, followed by the creation of suspiciously named .jsp or .jspx files in the PSEMHUB.war application directory, which is indicative of a web shell deployment.
This rule detects potential exploitation of the Oracle PeopleSoft PSEMHUB component vulnerability (CVE-2026-35273). It identifies suspicious POST requests to the PSEMHUB HttpListeningConnector servlet, including obfuscated URL paths, followed by the creation of suspiciously named .jsp or .jspx files in the PSEMHUB.war application directory, which is indicative of a web shell deployment.
This rule detects potential exploitation of the Oracle PeopleSoft PSEMHUB component vulnerability (CVE-2026-35273). It identifies suspicious POST requests to the PSEMHUB HttpListeningConnector servlet, including obfuscated URL paths, followed by the creation of suspiciously named .jsp or .jspx files in the PSEMHUB.war application directory, which is indicative of a web shell deployment.
Detects when a single process terminates two or more critical security, database, or backup related processes within a short window. This behavior is often associated with adversary attempts to disable security controls or disrupt database operations, commonly observed during the impact phase of an attack or preparatory to data destruction/encryption.
Detects incoming HTTP POST requests to the /PSEMHUB/hub endpoint on Oracle PeopleSoft servers, which is indicative of exploitation attempts related to the Server-Side Request Forgery (SSRF) vulnerability identified as CVE-2026-35273.
Detects incoming HTTP POST requests to the /PSEMHUB/hub endpoint on Oracle PeopleSoft servers, which is indicative of exploitation attempts related to the Server-Side Request Forgery (SSRF) vulnerability identified as CVE-2026-35273.
This rule detects scenarios where an Oracle database process (or associated service processes) spawns potentially malicious OS-level child processes, such as shells, network utilities, or script execution. This behavior is highly indicative of abuse of Oracle features like DBMS_SCHEDULER or UTL_FILE to execute arbitrary commands, perform network reconnaissance, or stage exploit payloads.
This rule detects suspicious activity on Oracle database hosts, including the spawning of unexpected child processes from Oracle service binaries (such as cmd.exe or shells), the creation or access of known exploit-related script filenames, and the use of UTL_FILE to write files with suspicious extensions to temporary directories, which are patterns indicative of exploitation attempts like DBMS_SCHEDULER remote code execution or data exfiltration.
Detects the execution of known Oracle database PII exfiltration scripts and patterns associated with the 'MexicanMafia Operation Escaneo' campaign. The rule monitors for specific command-line activity, including the use of extraction scripts like 'dump_oracle_pii.sh', 'fast_extract.py', and database-level exfiltration techniques such as UTL_FILE or sys_eval targeting incremental CSV exports to /tmp.
Detects suspicious child processes spawned by a Java process, which may indicate post-exploitation activity related to the Oracle E-Business Suite vulnerability CVE-2025-61882. The exploit chain often results in a reverse shell.
Detects unauthorized execution of Oracle DBMS_SCHEDULER jobs combined with UTL_FILE output retrieval, a TTP observed in Operation Escaneo. The rule identifies suspicious command lines involving common database-layer exploitation scripts, manipulation of DBMS_SCHEDULER jobs, and interaction with the /tmp directory to exfiltrate or read command outputs.
This rule detects potentially malicious activity within Oracle database audit and alert logs, specifically monitoring for the usage of packages like DBMS_SCHEDULER or UTL_FILE to execute OS commands or manipulate files. It also flags the execution of known exploit scripts or reconnaissance queries commonly associated with database-based attacks and unauthorized data dumping.
Detects high-volume SQL UPDATE operations indicating data manipulation attack
Detects high-volume database record modifications
Detects anomalous activity originating from Oracle database processes, including the spawning of shell commands via DBMS_SCHEDULER, execution of known attacker staging scripts, and the creation of sensitive output files in temporary directories, which are characteristic of database-level remote code execution or exfiltration attempts.
Detects unauthorized OS command execution initiated via Oracle DBMS_SCHEDULER jobs, often involving UTL_FILE for output retrieval. This behavior is indicative of RCE attempts against database servers.
This rule detects processes generating network connections to multiple known malicious ports (4444, 7211, 8000, 8001, 8002, 10000) within a 30-minute window. This behavior is indicative of command and control (C2) beaconing, where a compromised system periodically communicates with a C2 server. The rule is designed to identify a pattern of C2 activity that might be used across different threat campaigns, leveraging ports commonly associated with various C2 frameworks or custom C2 implementations.
Detects external HTTP POST requests to the Oracle PeopleSoft Environment Management Hub or Integration Broker listening connector. This activity could indicate an attempt to exploit public-facing Oracle PeopleSoft applications.
Page 1 of 4