Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,324 detections
Filters
Last updated
All Time
Detection languages
1,225
935
481
239
184
Contributors
626
512
469
337
261
Categories
20,443
11,831
5,875
5,151
4,864
3,324
Platforms
1,411
1,220
873
142
138
Products / Services
973
444
393
392
360
MITRE Techniques
1,525
1,085
885
593
540
CVEs
42
28
26
26
24
IDS Classtypes
390
220
127
40
26
IDS Protocols
671
150
30
18
12
Detects an attempt to exploit CVE-2026-24858 in FortiCloud SSO by sending a crafted SAML authentication request that lacks a signature. This vulnerability allows an attacker to bypass authentication by providing an unsigned SAML response.
This rule detects malformed SCTP packets that trigger a protocol decoding error ('pkt_too_small'). This behavior is associated with the 'DiagSpill' vulnerability (CVE-2026-74469), where specially crafted chunk sequences in the SCTP stream can cause a remote service crash or potential instability. The rule includes a threshold to mitigate noise from non-malicious malformed packets.
This rule detects malformed SCTP packets that trigger a protocol decoding error ('pkt_too_small'). This behavior is associated with the 'DiagSpill' vulnerability (CVE-2026-74469), where specially crafted chunk sequences in the SCTP stream can cause a remote service crash or potential instability. The rule includes a threshold to mitigate noise from non-malicious malformed packets.
Detects anomalous process execution patterns involving netkit devices and virtual network interfaces (VXLAN/OVS) configured with oversized headroom, characteristic of the TUNderflow (CVE-2026-81000) exploitation chain. The rule monitors for the staging of netkit devices and specific OVS command-line interactions by non-privileged accounts, excluding known legitimate SDN and CNI infrastructure management processes.
Detects potential zero-click administrator session hijacking by correlating a logged-in administrator accessing a page containing user-generated content (e.g., comments) followed immediately by a sensitive administrative action (e.g., plugin installation, user creation) within a 5-second window, suggesting automated script execution via an autofocus/onfocus handler triggered by the admin's browser.
Detects potential zero-click administrator session hijacking by correlating a logged-in administrator accessing a page containing user-generated content (e.g., comments) followed immediately by a sensitive administrative action (e.g., plugin installation, user creation) within a 5-second window, suggesting automated script execution via an autofocus/onfocus handler triggered by the admin's browser.
Detects potential zero-click administrator session hijacking by correlating a logged-in administrator accessing a page containing user-generated content (e.g., comments) followed immediately by a sensitive administrative action (e.g., plugin installation, user creation) within a 5-second window, suggesting automated script execution via an autofocus/onfocus handler triggered by the admin's browser.
Detects Microsoft Defender (MsMpEng) performing scan or remediation actions against non-standard filesystem paths, specifically NT object-manager namespace paths or CLFS-driver-prefixed paths. This behavior is indicative of an exploitation attempt (e.g., CVE-2026-69414) where an attacker uses symbolic links and CLFS driver namespaces to redirect the Defender scanning engine to arbitrary files on the system, potentially allowing file reads as SYSTEM.
Detects attempts to exploit a path traversal vulnerability in the GitLab commits API, specifically targeting the /api/v4/projects/ repository/commits path. The rule monitors for directory traversal patterns such as .. or url-encoded variations in conjunction with file paths, which could allow unauthorized access to files outside the intended directory.
This rule detects potential exploitation attempts targeting VLC media player, specifically focusing on the CVE-2026-56711 integer overflow vulnerability. The rule identifies instances where VLC processes a PNG file originating from untrusted locations (such as Downloads, Temp, or removable media) shortly after that file was created or modified on the host.
This rule detects attempts to exploit a path traversal vulnerability (CVE-2024-21762) in FortiOS SSL-VPN by monitoring for malformed GET requests targeting the /remote/fgt_lang endpoint. The rule also tracks successful exploitation by identifying HTTP 200 responses containing Linux password file patterns (root:x:0:0:), indicating potential remote file disclosure.
Detects the presence of known artifacts associated with the GhostContainer backdoor, including indicators of Neo-reGeorg web shell usage, ysoserial payloads, and exploitation attempts targeting the CVE-2020-0688 vulnerability via VIEWSTATE manipulation.
Detects indicators associated with the exploitation of CVE-2025-3248 in Langflow. The rule identifies anomalous web requests targeting the /api/v1/validate/code endpoint, subsequent suspicious process creation (base64 encoded payloads in Python/shell), and network communication with identified command and control (C2) or data exfiltration IP addresses. It also includes alerts for observed contact with known extortion email addresses.
Detects indicators associated with the exploitation of CVE-2025-3248 in Langflow. The rule identifies anomalous web requests targeting the /api/v1/validate/code endpoint, subsequent suspicious process creation (base64 encoded payloads in Python/shell), and network communication with identified command and control (C2) or data exfiltration IP addresses. It also includes alerts for observed contact with known extortion email addresses.
Detects unauthorized attempts to request an AWS token via the JFrog Artifactory API, specifically targeting a vulnerability identified as CVE-2026-42018. The rule triggers when a POST request is made to the '/access/api/v1/aws/token/' endpoint without an Authorization header, indicating potential exploitation of an anonymous token request flaw.
This rule detects potential exploitation attempts against PaperCut servers by identifying high-frequency, consistent-interval network requests directed at PaperCut-specific URI patterns and ports, or associated with known vulnerability identifiers (CVE-2026-81578, CVE-2026-82078). The rule employs statistical analysis to identify potential automated scanning or exploitation activity, filtering out known geographic regions associated with lower-risk or irrelevant traffic.
Detects unauthenticated network requests targeting specific administration endpoints (SetupCompleted, configure-update-service, or /admin/) of PaperCut NG/MF applications. The rule identifies potential exploitation attempts by flagging successful requests that return HTTP status codes other than 401 (Unauthorized) or 403 (Forbidden), indicating a possible authentication bypass.
This rule detects inbound HTTP requests targeting Microsoft Exchange Server that contain the specific headers and patterns associated with the ProxyLogon (CVE-2021-26855) Server-Side Request Forgery (SSRF) vulnerability. It specifically monitors for the presence of the 'X-BEResource' header and malformed request structures used by attackers to bypass authentication.
Detects the creation of Object Manager symbolic links that redirect the Windows Defender 'WD_SCAN' object to a loopback UNC share path. This behavior is indicative of a symlink exploitation technique (ShieldCrash/CVE-2026-69414) used to manipulate Windows Defender or associated scan operations by redirecting them to an adversary-controlled or loopback-hosted target.
The following analytic identifies unusually long strings in the Content-Type HTTP header sent by the client to the server. It uses data from the Stream:HTTP source, specifically evaluating the length of the `cs_content_type` field. This activity is significant because excessively long Content-Type headers can indicate attempts to exploit vulnerabilities or evade detection mechanisms. If confirmed malicious, this behavior could allow attackers to execute code, manipulate data, or bypass security controls, potentially leading to unauthorized access or data breaches.
This rule detects SQL injection attempts targeting the BuddyBoss members REST endpoint, specifically identifying exploitation patterns associated with the 'sqlmap' tool. The rule monitors for specific URL parameters including 'member_type', 'search_terms', and 'scope' in combination with an 'sqlmap' user-agent, indicating an automated exploitation attempt against the application.
Page 23 of 159