Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,443
11,831
5,875
5,151
4,864
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
ET WEB_SPECIFIC_APPS IPFire ddns.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34309)
ET WEB_SPECIFIC_APPS IPFire firewalllogip.dat pienumber Parameter Cross Site Scripting Attempt (CVE-2025-34306)
ET WEB_SPECIFIC_APPS IPFire dns.cgi REMARK Parameter Cross Site Scripting Attempt (CVE-2025-34305)
ET WEB_SPECIFIC_APPS IPFire vpnmain.cgi REMARK Parameter Cross Site Scripting Attempt (CVE-2025-34305)
ET WEB_SPECIFIC_APPS IPFire connscheduler.cgi ACTION_COMMENT Parameter Cross Site Scripting Attempt (CVE-2025-34305)
ET WEB_SPECIFIC_APPS IPFire dhcp.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34305)
ET WEB_SPECIFIC_APPS IPFire fwhosts.cgi PROT Parameter Cross Site Scripting Attempt (CVE-2025-34302)
ET WEB_SPECIFIC_APPS Tenda RouteStatic page Parameter Buffer Overflow Attempt (CVE-2025-12271)
ET WEB_SPECIFIC_APPS Adobe Commerce & Magento SessionReaper Unauthenticated Remote Code Execution (CVE-2025-54236)
ET MALWARE MEOWBACKCONN CnC Checkin
ET INFO DYNAMIC_DNS HTTP Request to a *.hornburst .com domain
Detects network communication patterns associated with the LANDFALL Android spyware C2 servers. This includes connections to known malicious domains/IPs and specific HTTP POST requests used for beaconing.
ET WEB_SPECIFIC_APPS Adobe ColdFusion Access Control Bypass (CVE-2023-38205)
ET WEB_SPECIFIC_APPS Wavlink login.cgi pagelogin Parameter Buffer Overflow Attempt (CVE-2025-61128)
ET WEB_SPECIFIC_APPS Tenda openNetworkGateway wpapsk_crypto2_4g Parameter Buffer Overflow Attempt (CVE-2025-12619)
ET WEB_SPECIFIC_APPS IPFire mail.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34316)
ET WEB_SPECIFIC_APPS IPFire qos.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34310)
ET WEB_SPECIFIC_APPS IPFire firewalllogip.dat pienumber Parameter Cross Site Scripting Attempt (CVE-2025-34307)
ET WEB_SPECIFIC_APPS Tenda VirtualSer page Parameter Buffer Overflow Attempt (CVE-2025-12265)
ET WEB_SPECIFIC_APPS ASMAX CGI script system Parameter Command Injection Attempt (CVE-2009-5156)
ET WEB_SPECIFIC_APPS TVT queryDevInfo Information Disclosure (CVE-2024-7339)
Page 181 of 202