Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
188 detections
Filters
Last updated
All Time
Detection languages
154
11
11
7
3
Contributors
47
34
22
16
9
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
100
58
51
32
23
Products / Services
72
20
19
13
12
MITRE Techniques
86
71
56
52
33
CVEs
5
5
5
4
4
IDS Classtypes
7
4
IDS Protocols
10
1
This rule identifies installations of Parallels Desktop on Intel-based macOS devices that are within the 26.x version branch and have not been updated to the 27.0.0 fix. It utilizes software inventory and device information to alert on systems running vulnerable software susceptible to exploitation.
This rule identifies installations of Parallels Desktop on Intel-based macOS devices that are within the 26.x version branch and have not been updated to the 27.0.0 fix. It utilizes software inventory and device information to alert on systems running vulnerable software susceptible to exploitation.
Detects high-volume bursts of HTTP GET requests against specific paths associated with a Vite development server (/@vite/client, /@fs/, /src/) on port 5173. This pattern is indicative of automated reconnaissance or vulnerability scanning targeting an exposed development environment.
This rule identifies vulnerable versions of FortiOS and FortiSwitchManager susceptible to CVE-2025-25249, a critical heap-based buffer overflow vulnerability in the cw_acd daemon. It parses device version strings from security logs and compares them against known affected version ranges.
This rule identifies vulnerable versions of FortiOS and FortiSwitchManager susceptible to CVE-2025-25249, a critical heap-based buffer overflow vulnerability in the cw_acd daemon. It parses device version strings from security logs and compares them against known affected version ranges.
This rule monitors web server logs (IIS, W3C, and Azure Application Gateway) for incoming traffic that matches known malicious or automated vulnerability scanners, as well as requests for common system fingerprinting paths (such as /server-status or /.git/config). The rule aggregates these hits by source IP address to identify potential active reconnaissance or vulnerability scanning attempts.
This rule identifies installations of Parallels Desktop on Intel-based macOS devices that are within the 26.x version branch and have not been updated to the 27.0.0 fix. It utilizes software inventory and device information to alert on systems running vulnerable software susceptible to exploitation.
This rule identifies installations of Parallels Desktop on Intel-based macOS devices that are within the 26.x version branch and have not been updated to the 27.0.0 fix. It utilizes software inventory and device information to alert on systems running vulnerable software susceptible to exploitation.
This rule identifies critical or high-severity software vulnerabilities affecting devices tagged as part of a PCI-CDE (Payment Card Industry Cardholder Data Environment) scope. It summarizes the findings by CVE, severity level, count of affected devices, and specific assets involved, prioritizing remediation for PCI compliance.
This rule identifies devices within the environment that are susceptible to CVE-2026-81963. It correlates vulnerability data with knowledge base information to flag the software, vendor, version, severity level, and the availability of public exploits for this specific vulnerability.
Detects high-volume bursts of HTTP GET requests against specific paths associated with a Vite development server (/@vite/client, /@fs/, /src/) on port 5173. This pattern is indicative of automated reconnaissance or vulnerability scanning targeting an exposed development environment.
Detects high-volume bursts of HTTP GET requests against specific paths associated with a Vite development server (/@vite/client, /@fs/, /src/) on port 5173. This pattern is indicative of automated reconnaissance or vulnerability scanning targeting an exposed development environment.
This rule identifies vulnerable versions of FortiOS and FortiSwitchManager susceptible to CVE-2025-25249, a critical heap-based buffer overflow vulnerability in the cw_acd daemon. It parses device version strings from security logs and compares them against known affected version ranges.
Identifies devices running versions of Chromium-based browsers (such as Chrome) vulnerable to CVE-2026-85046, a V8 type confusion vulnerability that allows remote code execution within the browser sandbox.
Identifies devices running versions of Chromium-based browsers (such as Chrome) vulnerable to CVE-2026-85046, a V8 type confusion vulnerability that allows remote code execution within the browser sandbox.
Detects high-volume bursts of HTTP GET requests against specific paths associated with a Vite development server (/@vite/client, /@fs/, /src/) on port 5173. This pattern is indicative of automated reconnaissance or vulnerability scanning targeting an exposed development environment.
Identifies devices running versions of Chromium-based browsers (such as Chrome) vulnerable to CVE-2026-85046, a V8 type confusion vulnerability that allows remote code execution within the browser sandbox.
This rule monitors web server logs (IIS, W3C, and Azure Application Gateway) for incoming traffic that matches known malicious or automated vulnerability scanners, as well as requests for common system fingerprinting paths (such as /server-status or /.git/config). The rule aggregates these hits by source IP address to identify potential active reconnaissance or vulnerability scanning attempts.
This rule identifies devices in the environment that are running software identified as vulnerable to CVE-2026-62890. It aggregates the affected device names along with the associated software names, versions, and vulnerability severity levels.
This rule monitors web server logs (IIS, W3C, and Azure Application Gateway) for incoming traffic that matches known malicious or automated vulnerability scanners, as well as requests for common system fingerprinting paths (such as /server-status or /.git/config). The rule aggregates these hits by source IP address to identify potential active reconnaissance or vulnerability scanning attempts.
Identifies devices with software versions affected by CVE-2026-45321 or devices running TanStack related packages identified via vulnerability management and software inventory data.
Page 3 of 9