Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
381 detections
Filters
Last updated
All Time
Detection languages
380
1
Contributors
160
79
64
38
20
Categories
220
190
146
124
101
Platforms
325
56
56
48
11
Products / Services
362
188
33
20
19
MITRE Techniques
140
73
56
53
51
CVEs
12
9
9
5
5
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
189
154
25
4
4
Detects network exploitation attempts targeting Fortinet FortiOS and FortiProxy vulnerabilities (CVE-2024-55591, CVE-2025-24472) involving authentication bypass via HTTP header manipulation (Forwarded, X-Forwarded-For) and unauthorized access to the /jsconsole endpoint.
Detects high-volume SSH authentication failures from a single source IP address within a short time frame, which is indicative of credential spraying or brute force activity.
Detects unauthenticated POST requests to the TorchServe Management API '/models' endpoint containing a 'url=' parameter. This pattern is indicative of an attempt to perform remote model registration, which could be leveraged for Remote Code Execution (RCE) on the server hosting the TorchServe service.
This rule detects unauthorized and unauthenticated attempts to access the Ray Dashboard API '/api/jobs' endpoint. An absence of an Authorization header in these requests indicates potential reconnaissance or exploitation attempts against an exposed Ray cluster management interface.
Detects a high frequency of SSH connection attempts originating from a single source address within a short timeframe, specifically targeting the initial SSH handshake string. This is indicative of automated brute force or credential stuffing activity against SSH services.
Detects Heartbleed (CVE-2014-0160) exploitation attempts by monitoring for malformed TLS heartbeat requests (undersized payload) followed by oversized responses from the server that indicate potential memory disclosure.
Detects Heartbleed (CVE-2014-0160) exploitation attempts by monitoring for malformed TLS heartbeat requests (undersized payload) followed by oversized responses from the server that indicate potential memory disclosure.
Detects anomalous network traffic patterns characteristic of the PetitPotam exploit, specifically targeting the MS-EFSRPC interface on Windows SMB pipes. This behavior is used to force a remote system to initiate authentication to a specified target, facilitating NTLM relay attacks.
Detects anomalous LDAP bind requests containing specific byte sequences characteristic of a potential authentication bypass exploit identified as CVE-2026-83059. The rule monitors LDAP traffic on standard ports for malformed bind operations that attempt to subvert authentication controls.
Detects suspicious LDAP modify or add operations targeting privileged DNs (orcladmin, OracleContext) on Oracle Internet Directory, indicative of exploitation attempts related to CVE-2026-83057.
Detects attempts to access administrative or configuration endpoints on Cisco Identity Services Engine (ISE) without providing valid authentication headers, cookies, or authorization tokens. This behavior is indicative of exploitation attempts targeting CVE-2026-20192 to gain unauthorized administrative access.
Detects high-volume RDP X.224 connection requests originating from a single source within a short timeframe, which is a strong indicator of a brute force or password spraying attack targeting Remote Desktop Protocol services.
Detects high-volume SSH authentication attempts originating from a single source IP targeting a server on port 22, indicating a potential brute force attack.
Detects anomalous POST requests to Citrix NetScaler SAML authentication endpoints (/saml/login or /cgi/samlauth) that result in an HTTP 500 error, which may indicate a heap overflow exploitation attempt associated with CVE-2026-8452.
This rule detects potential attempts to exploit an SSH pre-authentication rekey or authentication bypass vulnerability (CVE-2026-67279) in MikroTik RouterOS devices. It monitors incoming TCP traffic on port 22 that contains the 'ROSSSH' signature followed by specific binary sequences indicative of exploitation attempts.
Detects network activity related to the exploitation of the CVE-2025-31702 vulnerability in Dahua P2P Relay services. The rules monitor for probe attempts, device parameter fetching (randsalt), serial number enumeration bursts, and successful no-auth channel responses, indicating a bypass of authentication mechanisms on vulnerable Dahua devices.
This rule detects potential NTLM relay or authentication downgrade attempts by monitoring HTTP POST requests to the Certificate Enrollment Service (CES) endpoint. It specifically flags when an 'Authorization' header contains an NTLM-wrapped 'Negotiate' token, which is often indicative of an attacker attempting to coerce or relay authentication material to the service.
This rule detects unauthorized or unauthenticated attempts to call the NetrServerPasswordSet2 method on a Domain Controller via the MS-NRPC (Netlogon) interface, which is indicative of an exploitation attempt related to CVE-2020-1472 (Zerologon). This vulnerability allows an attacker to bypass authentication and reset a Domain Controller's computer account password, leading to full domain compromise.
Detects network traffic attempting to exploit CVE-2021-33044, an authentication bypass vulnerability in Dahua NetKeyboard devices, by identifying specific login request strings used in the exploit chain.
Detects Heartbleed (CVE-2014-0160) exploitation attempts by monitoring for malformed TLS heartbeat requests (undersized payload) followed by oversized responses from the server that indicate potential memory disclosure.
This rule detects HTTP POST requests to the 'wp-login.php' endpoint of a WordPress installation where the 'log' (username) and 'pwd' (password) fields are both set to 'admin'. This is a common signature for automated brute-force or credential-stuffing attacks targeting default administrator credentials.
Page 2 of 19