Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
188 detections
Filters
Last updated
All Time
Detection languages
154
11
11
7
3
Contributors
47
34
22
16
9
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
100
58
51
32
23
Products / Services
72
20
19
13
12
MITRE Techniques
86
71
56
52
33
CVEs
5
5
5
4
4
IDS Classtypes
7
4
IDS Protocols
10
1
Webworm Executes Nuclei and dirsearch
Cortex XDR
Detects vulnerability and directory scanners (Nuclei, dirsearch, or Python scripts) launched with output files or target lists covering numerous web servers. This activity is associated with the Webworm threat group.
Detects anomalous network scanning behavior from a Qualys scanner towards Domain Controller ports. The rule monitors CommonSecurityLog and NetworkSessions for high volumes of connection attempts (more than 50 within one hour) targeting critical Active Directory ports (88, 135, 389, 445, 636, 3268, 3269). This activity may indicate a scanner configuration error, a compromised scanner, or an adversary attempting to map the environment while masquerading as a security tool.
Detects high-volume, multi-port connections from a single source to a domain controller, which is indicative of vulnerability scanning activity such as Nessus. The rule monitors for a large volume of connection attempts across multiple sensitive ports (e.g., 88, 135, 389, 445, 464, 636, 3268, 3269) within a short 5-minute window.
Detects one external source repeatedly requesting PeopleSoft administrative endpoints across multiple destinations or URLs within fifteen minutes. This activity could indicate an attacker performing reconnaissance or vulnerability scanning against public-facing PeopleSoft applications.
Detects attempts to exploit a path traversal vulnerability in SharePoint's Upload.aspx page by looking for requests to 'Upload.aspx' that include both 'List=' and 'RootFolder=' parameters, specifically targeting sensitive catalogs like '_catalogs'. This indicates an attempt to upload files to unauthorized locations.
Identifies devices with FFmpeg installations below version 9.0 that include the vulnerable MagicYUV decoder (libavcodec), exposing the host to heap out-of-bounds write RCE via crafted AVI, MKV, or MOV files (CVE-2026-8461).
Detects active development and probing behavior by a VAPT tool using embedded test strings ("MediaVault Asset Portal" and "Reverb Studio") against local networks. This rule looks for these specific strings within network event fields like 'AdditionalFields' or 'RemoteUrl'.
An unprivileged user can gain root access on major Linux distributions by exploiting CVE-2026-31431, a deterministic 4-byte page cache write bug in the authencesn cryptographic template.
The 'Copy Fail' vulnerability (CVE-2026-31431) is a critical logic flaw in the Linux kernel's crypto subsystem disclosed by Xint Code. Unlike previous high-profile kernel exploits that relied on race conditions, Copy Fail is a straight-line logic bug that allows an unprivileged local user to perform a controlled 4-byte write into the page cache of any readable file. This enables an attacker to modify the in-memory version of setuid binaries (like /usr/bin/su) to execute arbitrary shellcode as root without changing the file on disk.
Vulnerability affects Linux Kernel version starting 4.14 before 6.18.22.
The 'Copy Fail' vulnerability (CVE-2026-31431) is a critical logic flaw in the Linux kernel's crypto subsystem disclosed by Xint Code. Unlike previous high-profile kernel exploits that relied on race conditions, Copy Fail is a straight-line logic bug that allows an unprivileged local user to perform a controlled 4-byte write into the page cache of any readable file. This enables an attacker to modify the in-memory version of setuid binaries (like /usr/bin/su) to execute arbitrary shellcode as root without changing the file on disk.
Vulnerability affects Linux Kernel version starting 4.14 before 6.18.22.
This rule detects attempts to access a known vulnerable endpoint in Ivanti Sentry appliances, specifically '/mics/api/v2/sentry/mics-config/handleMessage', via an HTTP POST request. This activity is indicative of exploitation attempts related to CVE-2026-10520, which is a pre-authentication OS command injection vulnerability.
Detects access to device firmware version pages for vulnerability assessment
This rule detects potential network reconnaissance activity by looking for keywords such as 'scan', 'sweep', 'probe', 'recon', 'nmap', and 'nessus' within the 'Message' field of CommonSecurityLog entries. This could indicate an adversary actively gathering information about the network infrastructure.
Detects IP addresses generating a high volume of web requests to an IIS server where the referrer is external to the host. This can indicate web scraping, reconnaissance, or denial-of-service attempts.
This rule detects the execution of processes with command lines containing keywords associated with common vulnerability scanners such as 'scanner', 'nessus', or 'qualys'. It aggregates these events by computer and account over one-hour intervals to identify potential vulnerability scanning activity within the environment.
This rule detects HTTP requests originating from the Nessus vulnerability scanner. It specifically looks for the string "Nessus" (case-insensitive) within the HTTP User-Agent header of outgoing HTTP traffic from the protected network.
This rule detects network traffic generated by the OpenVAS vulnerability scanner. It specifically looks for HTTP requests where the User-Agent header contains the string "OpenVAS" (case-insensitive). This indicates that an OpenVAS scanner is actively probing the network, which could be part of a legitimate security assessment or a malicious reconnaissance effort.
Detects the creation of processes where the command line contains keywords such as 'cve' or 'vulnerability'. This could indicate attempts to exploit known vulnerabilities, perform vulnerability research, or execute tools related to vulnerability assessment.
Detects the creation of processes where the command line contains keywords such as 'cve' or 'vulnerability'. This could indicate attempts to exploit known vulnerabilities, perform vulnerability research, or execute tools related to vulnerability assessment.
This rule detects the presence of the Acunetix Web Vulnerability Scanner based on its unique User-Agent string in HTTP traffic. It specifically looks for the case-insensitive string "acunetix" within the HTTP User-Agent header in traffic flowing from the internal network to an external server.
This rule detects potential vulnerability scanning activity by identifying devices making multiple successful network connections to specific ports commonly used by vulnerability scanners (8834, 8889, 1241). A device is flagged if it makes 3 or more such connections within a one-hour window.
Detects the creation of files containing keywords such as 'vulnerability', 'assessment', or 'scan'. This rule aims to identify activities related to vulnerability scanning or security assessments being performed on a system, potentially indicating reconnaissance or unauthorized activity. The events are summarized by the initiating process account name and time to help identify the source of these activities.
This rule detects the execution of processes with command lines containing keywords associated with common vulnerability scanners such as 'scanner', 'nessus', or 'qualys'. It aggregates these events by computer and account over one-hour intervals to identify potential vulnerability scanning activity within the environment.
Page 5 of 9