Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,324 detections
Filters
Last updated
All Time
Detection languages
1,225
935
481
239
184
Contributors
626
512
469
337
261
Categories
20,443
11,831
5,875
5,151
4,864
3,324
Platforms
1,411
1,220
873
142
138
Products / Services
973
444
393
392
360
MITRE Techniques
1,525
1,085
885
593
540
CVEs
42
28
26
26
24
IDS Classtypes
390
220
127
40
26
IDS Protocols
671
150
30
18
12
Detection rules identifying suspicious communication patterns associated with Dahua P2P Cloud Relay devices, including WSSE authentication attempts and device probing to known cloud relay endpoints. These patterns are consistent with reconnaissance and exploitation activity against IoT devices within the context of Operation CameraSwarm.
Detects network activity related to Dahua P2P relay services (easy4ipcloud.com) on port 8800. The rules monitor for device lookup queries (/online/p2psrv/), probe requests (/probe/device/), and the presence of WSSE authentication headers, which may indicate interaction with or exploitation attempts by tools targeting P2P-enabled surveillance hardware.
Detects embedded CVE-2026-46300 (Fragnesia) Linux privilege escalation exploit code used by KATARU IoT malware, copied unmodified from public PoC
Detects unauthenticated path traversal attempts targeting the GitLab repository commits API, specifically checking for URL-encoded and plain path traversal patterns (e.g., '../') in requests to the commits endpoint. This behavior is indicative of attempts to exploit vulnerabilities like CVE-2026-85706 to read arbitrary files outside the repository scope.
Detects incoming HTTP requests to the WSO2 admin API endpoint that utilize a JSON Web Token (JWT) with the 'alg=none' algorithm, indicating an attempt to bypass authentication via JWT token forgery (CVE-2026-5430).
Detects attempts to exploit a vulnerability in WSO2 API Manager and Traffic Manager that allows for authentication bypass by utilizing a malformed JWT with the 'alg=none' header. Attackers can leverage this to impersonate users or bypass security controls by providing a crafted Bearer token in the Authorization header.
Detects repeated process execution events associated with Acronis backup plugins for cPanel, WHM, or Plesk within a 15-minute window. This behavior is consistent with automated exploitation attempts, specifically referencing CVE-2026-87886, which target these backup management plugins to achieve privilege escalation or unauthorized system access.
Detects a malicious command sequence targeting Redis instances where an attacker uses 'CONFIG SET' to modify the 'dir' and 'dbfilename' configuration directives followed by a 'SLAVEOF' or 'REPLICAOF' command. This is a common exploit pattern used to achieve remote code execution by forcing the Redis instance to load a malicious database file (often containing binary webshells or cron jobs) from an attacker-controlled server.
Detects malicious activities associated with the SilkParasite campaign targeting Redis servers. The rules identify the initiation of a 'SLAVEOF' command to a rogue replication host, subsequent handshake (PSYNC/REPLCONF) with an external attacker-controlled node, and the modification of server configuration ('CONFIG SET dbfilename') to potentially facilitate unauthorized file persistence or data exfiltration through the Redis replication mechanism.
Detects malicious activities associated with the SilkParasite campaign targeting Redis servers. The rules identify the initiation of a 'SLAVEOF' command to a rogue replication host, subsequent handshake (PSYNC/REPLCONF) with an external attacker-controlled node, and the modification of server configuration ('CONFIG SET dbfilename') to potentially facilitate unauthorized file persistence or data exfiltration through the Redis replication mechanism.
Detects malicious activities associated with the SilkParasite campaign targeting Redis servers. The rules identify the initiation of a 'SLAVEOF' command to a rogue replication host, subsequent handshake (PSYNC/REPLCONF) with an external attacker-controlled node, and the modification of server configuration ('CONFIG SET dbfilename') to potentially facilitate unauthorized file persistence or data exfiltration through the Redis replication mechanism.
Detects rapid AI agent state transitions (from 'think' to 'act') within Microsoft Edge processes, specifically identifying potential exploitation of the CVE-2026-55945 race condition vulnerability, which could be used to force the unauthorized execution of an injected prompt.
Detects rapid AI agent state transitions (from 'think' to 'act') within Microsoft Edge processes, specifically identifying potential exploitation of the CVE-2026-55945 race condition vulnerability, which could be used to force the unauthorized execution of an injected prompt.
This rule detects attempts to exploit a path traversal vulnerability (CVE-2024-21762) in FortiOS SSL-VPN by monitoring for malformed GET requests targeting the /remote/fgt_lang endpoint. The rule also tracks successful exploitation by identifying HTTP 200 responses containing Linux password file patterns (root:x:0:0:), indicating potential remote file disclosure.
Detects anomalous POST requests containing SharePoint 'MSOTlPn_' ToolPane markup directed at pages other than the expected 'ToolPane.aspx'. This pattern is characteristic of attempts to exploit the SPUtility.EnsureAuthentication bypass vulnerability, allowing attackers to access or execute operations on SharePoint pages without proper authentication.
Detects a specific SharePoint markup injection technique targeting the EditingPageParser type-check mechanism. An attacker smuggles a 'Register' directive into a crafted WebPartMarkup POST request using the 'publishingribbon' Tagprefix to bypass SafeControl validation.
Detects suspicious process execution patterns originating from Langflow or Nacos AI orchestration services, including the spawning of sensitive binaries like cmd, powershell, or scripts (python/bash/sh) with suspicious command-line arguments. Additionally, it identifies potential exploitation attempts targeting known-vulnerable API endpoints (code validation and Nacos user authentication).
Detects an attempt to exploit CVE-2026-24858 in FortiCloud SSO by sending a crafted SAML authentication request that lacks a signature. This vulnerability allows an attacker to bypass authentication by providing an unsigned SAML response.
Detects rapid deletion and creation cycles of the WD_SCAN object manager link, a behavioral pattern associated with a Time-of-Check-to-Time-of-Use (TOCTOU) exploit chain targeting Windows Defender (referenced as CVE-2026-69414). The rule monitors for at least three cycle events occurring within a 5-second window, specifically involving the 'WD_SCAN' object identifier.
Detects successful exploitation attempts targeting Vite development servers via chained access-control bypass vulnerabilities (CVE-2025-30208, CVE-2025-31125, CVE-2024-45811). The rule identifies malicious GET requests using the /@fs/ endpoint with specific query parameters, resulting in a successful HTTP 200 response, while originating from non-internal IP addresses.
This rule detects anomalous high-frequency, short-duration bursts of CAPWAP (Control and Provisioning of Wireless Access Points) traffic originating from external sources and targeting internal FortiGate devices. This behavior is indicative of automated exploitation attempts, specifically targeting known heap-grooming activities used in vulnerabilities like CVE-2023-27997, which rely on repetitive 'Add-Station' operations. Legitimate controller traffic is filtered by focusing on internal-to-internal communication patterns.
Page 26 of 159