Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,324 detections
Filters
Last updated
All Time
Detection languages
1,225
935
481
239
184
Contributors
626
512
469
337
261
Categories
20,438
11,829
5,872
5,150
4,864
3,324
Platforms
1,411
1,220
873
142
138
Products / Services
973
444
393
392
360
MITRE Techniques
1,525
1,085
885
593
540
CVEs
42
28
26
26
24
IDS Classtypes
390
220
127
40
26
IDS Protocols
671
150
30
18
12
Detects VPN/IKE negotiation failures characterized by certificate validation or parsing anomalies on Check Point Security Gateway or Spark firewall devices. These anomalies, when correlated with connections originating from known anonymization infrastructure (such as Tor exit nodes, proxies, or public VPN services), indicate potential exploitation attempts of the CVE-2026-85102 vulnerability, which allows for pre-authentication remote code execution via malformed certificate inputs.
Detects the execution of a Node.js interpreter (node.exe or node) as a child process of a Fortinet management-related process, or where the command line contains references to Fortinet. This behavior is indicative of post-exploitation activity related to CVE-2025-25249, where a heap-based buffer overflow is exploited to deploy the PivotC2 remote access trojan.
This rule detects an exploitation attempt targeting a memory overflow vulnerability in Citrix NetScaler Gateway, specifically identifying oversized DTLS handshake length fields in UDP traffic. The rule triggers when a DTLS packet exceeds the specified size threshold, which is indicative of a buffer overflow attack intended to cause a service crash (Denial of Service).
This rule detects an exploitation attempt targeting a memory overflow vulnerability in Citrix NetScaler Gateway, specifically identifying oversized DTLS handshake length fields in UDP traffic. The rule triggers when a DTLS packet exceeds the specified size threshold, which is indicative of a buffer overflow attack intended to cause a service crash (Denial of Service).
This rule detects an exploitation attempt targeting a memory overflow vulnerability in Citrix NetScaler Gateway, specifically identifying oversized DTLS handshake length fields in UDP traffic. The rule triggers when a DTLS packet exceeds the specified size threshold, which is indicative of a buffer overflow attack intended to cause a service crash (Denial of Service).
This rule detects security alerts (IDS, WAF, or infrastructure logs) indicating exploitation attempts against JFrog Artifactory instances related to CVE-2026-66384, specifically involving cache poisoning techniques observed in recent threat campaigns.
This rule detects potential command injection attacks targeting the Zimbra 'swatchdog' service, specifically involving the abuse of SNMP trap notifications (CVE-2026-73570). The attack works by injecting malicious shell metacharacters into the 'zimbra-MIB::zmServiceName' argument, which is processed by a Perl-invoked 'swatchdog' script. The rule monitors process execution events for shell commands spawned by the swatchdog utility that contain suspicious shell operators and the targeted MIB parameter.
This rule monitors network appliance logs (Fortinet, Cisco, Meraki, WatchGuard, Sophos) for patterns associated with known vulnerabilities, including authentication bypass (CVE-2022-40684), SQL injection, path traversal, and command injection attempts within URL parameters. It also flags high-severity IPS/IDS alerts generated by these devices.
Detects incoming web server requests containing suspicious, URL-encoded SQL injection patterns indicative of automated probing or exploitation attempts, such as UNION SELECT, boolean-based injection fragments, and comment sequences.
Detects HTTP requests containing common web exploit patterns (SQLi, XSS, RCE) that exhibit characteristics of automated, mutating payload generation often utilized in AI-assisted fuzzing or vulnerability scanning tools. The rule monitors for encoded, obfuscated, or highly varied payload syntax within URI query strings.
Detects unauthenticated HTTP POST requests to the /prompt endpoint of a ComfyUI instance, which is indicative of an attempt to remotely execute workflows on an exposed instance.
Detects anomalous access to the SharePoint WebPartPages.asmx SOAP endpoint, specifically using the GetWebPartPageConnectionInfo method. This query identifies patterns consistent with the exploitation of CVE-2026-65660, where adversaries attempt to smuggle WebPart template markup (e.g., <%@ Register, XamlServices) after legitimate preview methods have been disabled.
Detects a volumetric spike in RPC connection attempts (specifically port 135 followed by Netlogon binding) from a single host to a Domain Controller. This behavior is indicative of the exploit retry mechanism used by Zerologon (CVE-2020-1472) tools, which must attempt the authentication sequence thousands of times due to the low success probability of the all-zero byte ClientCredential.
Detects potential exploitation attempts of the Zerologon vulnerability (CVE-2020-1472) by monitoring for Domain Controller machine account password resets (Event 4742) targeting DC computer accounts, and insecure Netlogon RPC channel events (Event 5829) triggered when vulnerable clients or tools attempt connections.
Detects attempts to exploit Oracle WebLogic Server vulnerabilities, specifically those leveraging the T3 protocol to transmit malicious Java serialized payloads, as seen in CVE-2026-70756. The rule identifies suspicious T3 handshake patterns and the presence of common Java deserialization gadget chains.
Detects potential exploitation attempts targeting the vulnerable Oracle PeopleSoft PSEMHUB Environment Management Hub endpoint (associated with CVE-2026-35273 and UNC6240). The rule identifies suspicious bursts of POST requests where the URI path uses percent-encoding or mixed-case characters to evade Web Application Firewall (WAF) filtering.
This rule detects attempts to exploit the Microsoft Support Diagnostic Tool (MSDT) vulnerability CVE-2022-30190, known as 'Follina'. The rules monitor for malicious HTTP traffic and payloads that leverage the 'ms-msdt' URI scheme to execute arbitrary commands, often delivered via weaponized documents or external references to remote malicious HTML files.
Detects attempts to exploit the Log4Shell vulnerability (CVE-2021-44228) by identifying JNDI lookups (ldap, rmi, dns) via malicious strings within HTTP URI and request headers, a common attack vector for remote code execution.
Detects Heartbleed (CVE-2014-0160) exploitation attempts by monitoring for malformed TLS heartbeat requests (undersized payload) followed by oversized responses from the server that indicate potential memory disclosure.
Detects anomalous SOAP requests to the SharePoint WebPartPages.asmx endpoint specifically targeting the 'GetWebPartPageConnectionInfo' method. This pattern is associated with exploitation attempts against SharePoint vulnerabilities.
Detects network exploitation attempts targeting Fortinet FortiOS and FortiProxy vulnerabilities (CVE-2024-55591, CVE-2025-24472) involving authentication bypass via HTTP header manipulation (Forwarded, X-Forwarded-For) and unauthorized access to the /jsconsole endpoint.
Page 8 of 159