Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
188 detections
Filters
Last updated
All Time
Detection languages
154
11
11
7
3
Contributors
47
34
22
16
9
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
100
58
51
32
23
Products / Services
72
20
19
13
12
MITRE Techniques
86
71
56
52
33
CVEs
5
5
5
4
4
IDS Classtypes
7
4
IDS Protocols
10
1
Detects an nginx HTTP Server response header containing a version number identified as vulnerable to CVE-2026-42533 (specifically 0.9.6 through 1.30.3, or 1.31.0 through 1.31.2). This rule identifies potentially exposed or unpatched infrastructure that may be susceptible to exploitation.
Detects high-frequency HTTP GET request patterns indicative of bulk vulnerability scanning using the Nuclei scanner against public-facing web services. The rule triggers when a source IP initiates 250 or more requests within a 300-second window, excluding pre-authorized scanner source IP addresses.
This rule identifies devices running specific outdated and vulnerable versions of WordPress (6.9.0 through 7.0.1) using data from the DeviceTvmSoftwareInventory table. Identifying these versions is critical for vulnerability management and patching, as these versions may be susceptible to known security exploits.
Identifies Linux systems acting as KVM hypervisors that are running kernels vulnerable to CVE-2026-53359 (Januscape), a use-after-free vulnerability in the shadow MMU (arch/x86/kvm/mmu/mmu.c). This vulnerability permits a guest virtual machine to escape into the underlying host environment, potentially compromising the hypervisor and other hosted workloads.
This rule detects potential vulnerability scanning activity by identifying devices making multiple successful network connections to specific ports commonly used by vulnerability scanners (8834, 8889, 1241). A device is flagged if it makes 3 or more such connections within a one-hour window.
Detects successful network or explicit credential logons (4624/4648) on Windows workstations where the username or workstation name contains keywords associated with Tenable Nessus scanning activity, indicating an authenticated vulnerability scan.
Detects anomalous external scanning activity against internal web applications by monitoring for multiple requests to sensitive URI paths associated with vulnerability exploitation (e.g., cgi-bin, admin-ajax.php, .env, or command execution endpoints) originating from external IP addresses to internal network space.
Detects the creation of processes where the command line contains keywords such as 'cve' or 'vulnerability'. This could indicate attempts to exploit known vulnerabilities, perform vulnerability research, or execute tools related to vulnerability assessment.
Detects nmap processes performing IPv6 scans (using flags such as -6) that result in abnormal process termination or the spawning of unexpected child processes (e.g., cmd.exe, sh, bash). This behavior is indicative of exploitation attempts targeting the nmap IPv6 extension header length integer wrap vulnerability, including the execution of associated PoC harness binaries.
Detects anomalous network scanning behavior from a Qualys scanner towards Domain Controller ports. The rule monitors CommonSecurityLog and NetworkSessions for high volumes of connection attempts (more than 50 within one hour) targeting critical Active Directory ports (88, 135, 389, 445, 636, 3268, 3269). This activity may indicate a scanner configuration error, a compromised scanner, or an adversary attempting to map the environment while masquerading as a security tool.
Detects the creation of files containing keywords such as 'vulnerability', 'assessment', or 'scan'. This rule aims to identify activities related to vulnerability scanning or security assessments being performed on a system, potentially indicating reconnaissance or unauthorized activity. The events are summarized by the initiating process account name and time to help identify the source of these activities.
Detects high-volume, multi-port connections from a single source to a domain controller, which is indicative of vulnerability scanning activity such as Nessus. The rule monitors for a large volume of connection attempts across multiple sensitive ports (e.g., 88, 135, 389, 445, 464, 636, 3268, 3269) within a short 5-minute window.
Detects successful network or explicit credential logons (4624/4648) on Windows workstations where the username or workstation name contains keywords associated with Tenable Nessus scanning activity, indicating an authenticated vulnerability scan.
Detects successful logon events (4624) or special logon attempts (4648) associated with accounts or workstations identified as Qualys scanner agents. This is typically used to identify or baseline vulnerability scanning activity across the environment.
This rule detects potential vulnerability scanning activity by identifying devices making multiple successful network connections to specific ports commonly used by vulnerability scanners (8834, 8889, 1241). A device is flagged if it makes 3 or more such connections within a one-hour window.
Detects successful logon events (4624) or special logon attempts (4648) associated with accounts or workstations identified as Qualys scanner agents. This is typically used to identify or baseline vulnerability scanning activity across the environment.
Detects the creation of processes where the command line contains keywords such as 'cve' or 'vulnerability'. This could indicate attempts to exploit known vulnerabilities, perform vulnerability research, or execute tools related to vulnerability assessment.
This rule detects the execution of processes with command lines containing keywords associated with common vulnerability scanners such as 'scanner', 'nessus', or 'qualys'. It aggregates these events by computer and account over one-hour intervals to identify potential vulnerability scanning activity within the environment.
Detects the creation of files containing keywords such as 'vulnerability', 'assessment', or 'scan'. This rule aims to identify activities related to vulnerability scanning or security assessments being performed on a system, potentially indicating reconnaissance or unauthorized activity. The events are summarized by the initiating process account name and time to help identify the source of these activities.
This rule detects the execution of processes with command lines containing keywords associated with common vulnerability scanners such as 'scanner', 'nessus', or 'qualys'. It aggregates these events by computer and account over one-hour intervals to identify potential vulnerability scanning activity within the environment.
Detects responses from vLLM (or similar services) that leak a Python Imaging Library (PIL)/Pillow heap address through BytesIO exception text. This indicates Stage 1 of the CVE-2026-22778 ASLR bypass vulnerability, where memory addresses are exposed, which could be used by an attacker to bypass Address Space Layout Randomization (ASLR). The rule looks for specific error messages containing '_io.BytesIO object at 0x' followed by a hexadecimal address.
Page 4 of 9