Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,324 detections
Filters
Last updated
All Time
Detection languages
1,225
935
481
239
184
Contributors
626
512
469
337
261
Categories
20,443
11,831
5,875
5,151
4,864
3,324
Platforms
1,411
1,220
873
142
138
Products / Services
973
444
393
392
360
MITRE Techniques
1,525
1,085
885
593
540
CVEs
42
28
26
26
24
IDS Classtypes
390
220
127
40
26
IDS Protocols
671
150
30
18
12
Detects anomalous child process execution (e.g., shells, curl, python) or the creation of web-accessible script files (.jsp, .php, .aspx) originating from common VPN gateway or edge appliance service processes. This behavior is indicative of potential exploitation of a remote-facing appliance or webshell deployment.
Detects a suspicious sequence of events where a known web server process (e.g., IIS, Nginx, Apache) spawns a command shell process, followed shortly by the creation of a file with a web shell-like extension (.aspx, .jsp, .php) in the same environment. This pattern is indicative of an adversary exploiting a public-facing application to upload and potentially access a web shell.
Detects incoming HTTP POST requests to the Docker API endpoint '/containers/create' containing 'Privileged: true' and a bind mount to the host filesystem ('/:/host'). This pattern is indicative of an attempt to deploy a privileged container with host access, which can be leveraged for container breakout or host system compromise.
Detects an exploitation chain originating from a Chrome browser process, characterized by the execution of an anomalous child process followed by the creation of an executable file named 'chrome_cleanup.exe' within a short time window. This sequence is indicative of multi-stage exploitation, involving remote code execution via browser vulnerability and subsequent privilege escalation.
This rule detects reconnaissance activity targeting Azure App Service instances, specifically looking for attempts to access web-shell-like files, WordPress administration paths, PHP-CGI endpoints, or LangFlow code validation paths. It identifies potential Storm-3168 actor infrastructure through known IOCs or through patterns of high-volume, path-diverse HTTP requests that deviate from typical noise, helping to distinguish targeted probing from common internet background scanning.
This rule detects reconnaissance activity targeting Azure App Service instances, specifically looking for attempts to access web-shell-like files, WordPress administration paths, PHP-CGI endpoints, or LangFlow code validation paths. It identifies potential Storm-3168 actor infrastructure through known IOCs or through patterns of high-volume, path-diverse HTTP requests that deviate from typical noise, helping to distinguish targeted probing from common internet background scanning.
Detects HTTP POST requests directed at Grav CMS endpoints where the __unique_form_id__ parameter contains directory traversal sequences (e.g., ../). This behavior is indicative of attempted exploitation of CVE-2026-42608, aimed at bypassing file system restrictions to write files to unauthorized locations outside the application's expected form data directory.
This rule detects malicious HTTP POST requests attempting a path traversal attack against Grav CMS, specifically targeting the __unique_form_id__ parameter. The rule looks for directory traversal sequences ('..') following the parameter, which is characteristic of attempts to read sensitive files outside the intended web directory.
Detects a sequence of events characteristic of exploitation against RouterOS (CVE-2026-67276/CVE-2026-86060), involving a failed SSH login attempt with the username '-2', followed by the creation of a new user account within the same SSH session, and a successful login with that newly created account.
Detects incoming web requests containing a 'pagename' parameter with URL-encoded path traversal sequences, which could allow unauthorized file access or directory traversal attacks against WordPress page-template resolution as described in CVE-2026-87902.
Detects anomalous execution of the Microsoft Support Diagnostic Tool (msdt.exe) or its host process (sdiagnhost.exe) when spawned by Microsoft Office applications or when invoked with specific command-line arguments indicative of the CVE-2022-30190 (Follina) exploit.
Detects HTTP GET requests targeting the Vite Dev Server that include directory traversal sequences ('../') within the '/@fs/' endpoint. This pattern is indicative of an attempt to bypass root directory restrictions to access sensitive files on the server.
Detects anomalous POST requests to Citrix NetScaler SAML authentication endpoints (/saml/login or /cgi/samlauth) that result in an HTTP 500 error, which may indicate a heap overflow exploitation attempt associated with CVE-2026-8452.
This rule detects inbound HTTP requests targeting Oracle PeopleSoft applications that contain malicious patterns indicative of Server-Side Request Forgery (SSRF) attempts. The rule inspects the URI for specific PeopleSoft application paths and suspicious redirection or internal IP address patterns (including internal cloud metadata addresses like 169.254.169.254) which are commonly used in SSRF attacks to probe or access internal resources.
This rule monitors Salesforce lead creation events for potential prompt-injection payloads. It identifies submissions containing common AI manipulation instructions, HTML tags, or suspicious outbound URLs, which could be used to hijack internal user sessions or execute malicious content within the Salesforce environment.
Detects anomalous, oversized fragmented UDP traffic (exceeding 1400 bytes) targeting or originating from the MikroTik btest service port (2000). This behavior is indicative of attempts to trigger integer underflows, system crashes, or uninitialized memory disclosures within the btest protocol implementation.
This rule detects potential attempts to exploit an SSH pre-authentication rekey or authentication bypass vulnerability (CVE-2026-67279) in MikroTik RouterOS devices. It monitors incoming TCP traffic on port 22 that contains the 'ROSSSH' signature followed by specific binary sequences indicative of exploitation attempts.
Detects the creation of an administrative-level user account (e.g., 'ops') on a MikroTik RouterOS device shortly after an anomalous login attempt using the '-2' username. This sequence is indicative of the exploit chain associated with specific MikroTik RouterOS vulnerabilities where an unauthenticated or specially crafted login is used to facilitate unauthorized user creation.
Detects network activity related to the exploitation of the CVE-2025-31702 vulnerability in Dahua P2P Relay services. The rules monitor for probe attempts, device parameter fetching (randsalt), serial number enumeration bursts, and successful no-auth channel responses, indicating a bypass of authentication mechanisms on vulnerable Dahua devices.
This rule detects unauthorized or unauthenticated attempts to call the NetrServerPasswordSet2 method on a Domain Controller via the MS-NRPC (Netlogon) interface, which is indicative of an exploitation attempt related to CVE-2020-1472 (Zerologon). This vulnerability allows an attacker to bypass authentication and reset a Domain Controller's computer account password, leading to full domain compromise.
Detects suspicious command line activity or network interactions targeting MongoDB, characterized by the use of 'eval' combined with specific function calls (such as 'process', 'load', 'require', or constructor-chaining) indicative of attempts to escape the MongoDB JavaScript sandbox.
Page 14 of 159