Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,324 detections
Filters
Last updated
All Time
Detection languages
1,225
935
481
239
184
Contributors
626
512
469
337
261
Categories
20,443
11,831
5,875
5,151
4,864
3,324
Platforms
1,411
1,220
873
142
138
Products / Services
973
444
393
392
360
MITRE Techniques
1,525
1,085
885
593
540
CVEs
42
28
26
26
24
IDS Classtypes
390
220
127
40
26
IDS Protocols
671
150
30
18
12
This rule detects exploitation attempts using the Pulse Connect Secure (PCS) vulnerability CVE-2021-22893. The detection logic looks for specific URI query patterns commonly associated with this exploit.
Detects suspicious access to specific URLs associated with the exploitation of the ADSelfService Plus vulnerability CVE-2021-40539. Attackers have been observed targeting these URLs to exploit the vulnerability.
Detects Microsoft Office applications executing child processes that include directory traversal patterns in their command line. This behavior is indicative of exploitation attempts, specifically referencing vulnerabilities like CVE-2022-30190 (MSDT RCE, also known as Follina) and CVE-2021-40444 (MSHTML RCE). The rule looks for common Office applications as parent processes and specific directory traversal strings in the child process's command line.
Detects exploitation attempts of Sitecore Experience Platform Pre-Auth RCE CVE-2021-42237. This vulnerability allows for remote code execution without authentication. The rule specifically looks for POST requests to the '/sitecore/shell/ClientBin/Reporting/Report.ashx' endpoint that result in a 200 HTTP status code, indicating a successful interaction with the vulnerable component.
Detects URL patterns indicative of ProxyShell exploitation attempts against Microsoft Exchange servers. The rule looks for specific URI query strings and HTTP status codes (401) that are characteristic of both failed and successful exploitation attempts.
Detects URL patterns and status codes that indicate a successful ProxyShell exploitation attack against Microsoft Exchange servers. The rule looks for requests to '/autodiscover.json' combined with specific URI paths like '/powershell', '/mapi/nspi', or '/EWS', and successful HTTP status codes (200 or 301).
Detects an exploitation attempt of the SystemNightmare vulnerability, which aims to obtain a shell with LOCAL_SYSTEM privileges. The rule specifically looks for command-line arguments associated with known exploitation tools or techniques related to SystemNightmare, such as references to 'printnightmare.gentilkiwi.com', '/user:gentilguest', or 'Kiwi Legit Printer'.
Detects attempts to exploit the VMware Workspace ONE Access Authentication Bypass vulnerability (CVE-2022-31656). This vulnerability allows a malicious actor with network access to the UI to obtain administrative access without authentication by sending a specially crafted URI query.
Detects attempts to exploit an Apache Spark server via CVE-2022-33891, which is a shell command injection vulnerability, by looking for specific patterns in web server query strings.
This rule detects the execution of 'rundll32.exe' with specific command-line arguments and parent processes that are characteristic of Qakbot malware activity. It looks for 'rundll32.exe' being launched by common scripting or command-line interpreters (cmd.exe, cscript.exe, curl.exe, mshta.exe, powershell.exe, pwsh.exe, wscript.exe) and attempting to load DLLs from suspicious paths (ProgramData, Users\Public, AppData\Local\Temp, AppData\Roaming). Additionally, it specifically targets known export functions used by Qakbot, such as 'aslr', 'bind', 'DrawThemeIcon', 'GG10', 'GL70', 'jhbvygftr', 'kjhbhkjvydrt', 'LS88', 'Motd', 'N115', 'next', 'Nikn', 'print', 'qqqb', 'qqqq', 'RS32', 'Test', 'Time', 'Updt', 'vips', 'Wind', 'WW50', 'X555', 'XL55', 'xlAutoOpen', and 'XS88'. This combination of indicators aims to reduce false positives by focusing on behaviors uniquely associated with Qakbot.
Detects attempts to exploit Apache Spark shell command injection vulnerabilities, specifically CVE-2022-33891, by monitoring for suspicious command-line executions involving 'id -Gn' as a child process of a bash shell. This indicates an attacker successfully injecting commands into the Spark environment.
This rule detects successful attempts to exploit the IIS shortname vulnerability, which allows enumeration of folders when IIS uses an old .Net Framework. The detection logic looks for HTTP GET or OPTIONS requests to URIs containing '~1' and ending with 'a.aspx', combined with successful HTTP status codes (200 or 301). This pattern is indicative of a successful fuzzing scan for the IIS shortname vulnerability.
This rule detects suspicious activity related to the Windows User Profile Service, specifically looking for EventID 1511 (Windows cannot find the local profile and is logging you on with a temporary profile) from the 'Microsoft-Windows-User Profiles Service' provider. This event, especially when combined with EventID 1515 (user profile loaded successfully) and the creation of a '\Users\TEMP' directory, can indicate an attempt to exploit vulnerabilities like CVE-2021-34484 or CVE-2022-21919 for privilege escalation. The rule focuses on the initial indication of a temporary profile being loaded.
Detects the exploitation of the Microsoft Exchange vulnerability CVE-2020-0688, which is a remote code execution vulnerability. The rule specifically looks for an 'Error' level EventID 4 from the 'MSExchange Control Panel' provider, combined with the presence of '__VIEWSTATE=' in the event data, indicating an attempt to exploit the vulnerability via the Eventlog.
Detects exploitation attempts targeting the TerraMaster TOS vulnerability CVE-2020-28188. This rule specifically looks for GET requests to '/include/makecvs.php' with a '?Event=' parameter, combined with common command injection payloads such as 'curl', 'wget', '.py', '.sh', 'chmod', or '_GET' in the URI query.
Detects the exploitation of the Microsoft Exchange ProxyToken vulnerability (CVE-2021-33766), which is an authentication bypass. The rule looks for specific URI query patterns and HTTP POST methods combined with a 500 HTTP status code, indicating a potential exploitation attempt against the Exchange Control Panel (ECP) or related services.
Detects potential exploitation attempts targeting the Cacti Command Injection vulnerability, CVE-2022-46169. The rule looks for specific patterns in GET requests to '/remote_agent.php' with 'action=polldata' and 'poller_id=' in the query, combined with suspicious command injection payloads like 'base64 -d | /bin/bash', 'whoami', 'powershell', 'cmd', or 'wget'.
Detects the execution of renamed 'cmd', 'powershell', or 'powershell_ise' binaries to 'wermgr.exe'. This technique has been observed in the exploitation of CVE-2023-36874, where attackers disguise legitimate system binaries to evade detection.
Detects the use of a specific default username, 'thisisnotvaliduser', during an interactive logon (LogonType 9) event (EventID 4624) on a Windows system. This specific username is associated with the DiagTrackEoP Proof-of-Concept (POC) for privilege escalation.
Detects attempts to exploit the VMware Workspace ONE Access Admin Remote Code Execution vulnerability (CVE-2022-31659) by monitoring for POST requests to the '/SAAS/jersey/manager/api/migrate/tenant' URI. This URI is associated with the migration API, and suspicious activity here could indicate an attacker attempting to leverage the vulnerability for remote code execution.
Detects the creation of a symbolic link between "cmd.exe" and the accessibility on-screen keyboard binary (osk.exe) using "mklink". This technique provides an elevated command prompt to the user from the login screen without the need to log in, which is a common method for privilege escalation and persistence.
Page 158 of 159