Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,324 detections
Filters
Last updated
All Time
Detection languages
1,225
935
481
239
184
Contributors
626
512
469
337
261
Categories
20,438
11,829
5,873
5,150
4,864
3,324
Platforms
1,411
1,220
873
142
138
Products / Services
973
444
393
392
360
MITRE Techniques
1,525
1,085
885
593
540
CVEs
42
28
26
26
24
IDS Classtypes
390
220
127
40
26
IDS Protocols
671
150
30
18
12
Detects CVE-2026-76504 Cisco SD-WAN vManage authentication bypass attempts: POST logins using internal viptela-reserved-* accounts via the percent-encoded /%6a_security_check path. Summarized per host and account.
Detects potential SQL injection (SQLi) attempts targeting web applications by identifying multiple requests matching specific SQLi regex patterns combined with encoding or internal reference markers within web access logs.
Detects the SITE CPFR and SITE CPTO command sequence in ProFTPD logs, which is characteristic of exploiting the mod_copy vulnerability (CVE-2015-3306) to copy files without authentication.
Detects repeated crashes of GitLab Ruby, Puma, Sidekiq, or bundle processes on Linux within a short time window. The detection looks for crash markers such as segfault, SIGSEGV, SIGABRT, or onigmo in the command line, which typically indicate exploitation attempts against Onigmo regex engine vulnerabilities.
Detects web servers (httpd, apache2, nginx, php-fpm) or Request Tracker (RT) Perl worker processes spawning suspicious child processes such as shells, downloaders, netcat, or Python interpreters, indicative of post-exploitation or web application compromise.
Detects CVE-2026-76504 Cisco SD-WAN vManage authentication bypass attempts: POST logins using internal viptela-reserved-* accounts via the percent-encoded /%6a_security_check path. Summarized per host and account.
Correlates a CVE-2026-76504 encoded /%6a_security_check login POST with a follow-on /dataservice/admin/user request from the same client to the same vManage within 10 minutes. Summarized and sorted by follow-on count.
Detects an attack identified by the FortiWeb web application firewall. WAF telemetry
is widely collected and almost never turned into detection content — it is usually
left as a vendor dashboard, so repeated targeting of one application by one source
goes unexamined.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='FORTIWEB' and action='THREAT_DETECTED'
| duration 1h
| groupby srcip, dstip, threat
| select srcip, dstip, threat, count(*) as cnt
| having cnt > 10
is widely collected and almost never turned into detection content — it is usually
left as a vendor dashboard, so repeated targeting of one application by one source
goes unexamined.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='FORTIWEB' and action='THREAT_DETECTED'
| duration 1h
| groupby srcip, dstip, threat
| select srcip, dstip, threat, count(*) as cnt
| having cnt > 10
Detects HTTP requests to the PeopleSoft PSEMHUB servlet using alternate
encodings such as the percent-encoded path %50SEMHUB. ShinyHunters/UNC6240 mass-exploit
Oracle PeopleSoft CVE-2026-35273 against internet-facing systems and encode the path to
defeat literal WAF signatures for /PSEMHUB/ (T1190, T1027).
encodings such as the percent-encoded path %50SEMHUB. ShinyHunters/UNC6240 mass-exploit
Oracle PeopleSoft CVE-2026-35273 against internet-facing systems and encode the path to
defeat literal WAF signatures for /PSEMHUB/ (T1190, T1027).
Detects HTTP requests to the WordPress REST batch endpoint (/wp-json/batch/v1 or /?rest_route=/batch/v1) carrying user agents associated with public wp2shell proof-of-concept tooling. This targets the pre-auth route confusion and SQL injection primitive in WordPress Core (CVE-2026-63030, CVE-2026-60137) that leads to full remote code execution.
Detects an inbound QUIC/UDP port 443 burst targeting a Bun process (bun.exe or bun) from external IP addresses, followed by the process going completely silent on the network within a short time window. This pattern correlates with potential exploitation or denial-of-service conditions involving network parsing anomalies.
Detects when the IIS worker process (w3wp.exe) spawns command-line utilities or script interpreters such as cmd.exe, powershell.exe, mshta.exe, wscript.exe, or cscript.exe. This behavior often indicates web application exploitation or webshell activity.
Detects non-browser Python-based HTTP clients (such as python-requests, python-urllib, aiohttp, or httpx) targeting specific API endpoints (/user, /profile, /order, /upload) while exhibiting indicators of SQL injection or high-volume object ID enumeration.
Detects non-browser Python-based HTTP clients (such as python-requests, python-urllib, aiohttp, or httpx) targeting specific API endpoints (/user, /profile, /order, /upload) while exhibiting indicators of SQL injection or high-volume object ID enumeration.
Detects non-browser Python-based HTTP clients (such as python-requests, python-urllib, aiohttp, or httpx) targeting specific API endpoints (/user, /profile, /order, /upload) while exhibiting indicators of SQL injection or high-volume object ID enumeration.
Detects non-browser Python-based HTTP clients (such as python-requests, python-urllib, aiohttp, or httpx) targeting specific API endpoints (/user, /profile, /order, /upload) while exhibiting indicators of SQL injection or high-volume object ID enumeration.
Detects non-browser Python-based HTTP clients (such as python-requests, python-urllib, aiohttp, or httpx) targeting specific API endpoints (/user, /profile, /order, /upload) while exhibiting indicators of SQL injection or high-volume object ID enumeration.
Detects the loading of the 'truesight.sys' driver from non-standard or temporary locations. This activity is associated with a campaign where threat actors use a vulnerable version of this driver to terminate security products before deploying ransomware or RATs, a technique known as Bring Your Own Vulnerable Driver (BYOVD).
Detects the AdFection multi-stage infection chain where a device sequentially contacts advertising infrastructure, Candiru validator servers, exploit servers, and Candiru Command and Control domains within a short time window.
Detects HTTP requests targeting Microsoft Exchange servers that combine the autodiscover.json URI with PowerShell endpoint parameters, indicative of ProxyNotShell vulnerabilities exploitation (CVE-2022-41040 and CVE-2022-41082).
Detects potential exploitation of the libcurl CURLOPT_REQUEST_TARGET CRLF injection vulnerability via web/proxy request logs where curl user-agents are observed with carriage return/line feed characters or injected request lines within the URI path.
Page 3 of 159