Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
381 detections
Filters
Last updated
All Time
Detection languages
380
1
Contributors
160
79
64
38
20
Categories
220
190
146
124
101
Platforms
325
56
56
48
11
Products / Services
362
188
33
20
19
MITRE Techniques
140
73
56
53
51
CVEs
12
9
9
5
5
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
189
154
25
4
4
Detects repeated HTTP requests targeting the '/cgi-bin/' path on Dahua camera web interfaces with a specific user-agent string ('CGI Brute'). This behavior is characteristic of an automated brute-force campaign attempting to gain unauthorized access to camera web administration interfaces.
Detects unauthenticated attempts to invoke Grafana API tools via the Model Context Protocol (MCP) by utilizing spoofed Mcp-Session-Id headers while bypassing bearer token authentication requirements. This primarily targets unauthorized access to API functionality on Grafana instances configured with bearer-token authentication (v1.1.0+).
Detects inbound network traffic originating from IP addresses known to be associated with exploitation attempts targeting the Elementor Pro CVE-2026-32475 vulnerability. This rule monitors for connections to internal network assets from these identified threat actor sources.
Detects Server-Side Request Forgery (SSRF) attempts originating from the Grafana MCP (Model Context Protocol) process. The rule specifically monitors for instances where the 'grafana_api_request' tool is used in conjunction with a 'X-Grafana-URL' header targeting cloud metadata IP ranges (169.254.0.0/16), or where the host attempts to resolve GCP metadata domains ('metadata.google.internal'). This behavior is indicative of an attacker attempting to access cloud provider instance metadata to exfiltrate security credentials.
Detects inbound network connections from known IP addresses associated with the StyleSmuggler malware distribution, which is used to inject malicious scripts into web applications.
Detects high-frequency login attempts using the Dahua Easy4IP protocol. The rule flags multiple login opcode requests (identified by specific byte patterns 0xFF followed by 0x00A0) originating from the same source within a 60-second window, which is indicative of an automated brute-force or credential-stuffing attack targeting vulnerable IoT devices.
This rule detects unauthenticated TCP connection attempts targeting ports 43210 and 43211, which are associated with the Nexus 9000 S1HAL service. These attempts are indicative of potential exploitation activity related to CVE-2026-20212.
Detects unauthenticated attempts to invoke Grafana API tools via the Model Context Protocol (MCP) by utilizing spoofed Mcp-Session-Id headers while bypassing bearer token authentication requirements. This primarily targets unauthorized access to API functionality on Grafana instances configured with bearer-token authentication (v1.1.0+).
Detects legacy RFB security-type 2 (VNC password) authentication negotiation against macOS Screen Sharing from external sources, indicating legacy-VNC administration or abuse of the CVE-2026-43760 legacy-auth path that retains root file-copy authority.
Detects the CVE-2026-65400 pre-auth bypass exploitation of macOS Screen Sharing via an oversized RFB SRP (security-type 36) authentication frame length field, correlated with the connection subsequently reaching an authenticated state.
Suricata signature detecting a Zoom annotation CAnnoFormatBlock/CAnnoTextFrame/CAnnoTextRange PDU where a count field (count1-4) precisely exceeds 64, overflowing the 128-byte destination buffer — the wire-level trigger for the ZOOMSDAY buffer overflow, stack overflow, and heap-disclosure primitives (CVE-2026-53413).
Detects the RFB protocol length-field bypass frame pattern used to exploit the screensharingd pre-auth authentication bypass (CVE-2026-65400) on ports 5900/5988.
Suricata signature for a Zoom annotation PDU carrying opcode 0x10001 (AddObj) delivered on the downstream acknowledgement channel (which should only carry 0x10002/AddObjAck), indicating sender-role/opcode confusion that lets any participant forge presenter-privileged annotation objects (ZOOMSDAY, CVE-2026-53413/53414/53415).
Suricata signature chain detecting a burst of 20+ 592-byte ExtChild AddObj annotation messages from a single source within 5 seconds (heap-spray pattern), followed by a RemoveObj/ModifyObj teardown operation consistent with dispatch through a corrupted vtable pointer — the full CVE-2026-53414 heap overflow and control-flow hijack chain.
Network signature for the specific WebSocket/admin-API request sequence used to exploit the FortiOS/FortiProxy authentication-bypass vulnerabilities CVE-2024-55591 and CVE-2025-24472, as leveraged by Gunra ransomware affiliates for initial access.
Detects a successful FortiCloud SSO administrative login to a Fortinet appliance followed by the creation of a local administrator account from the same source IP and user within 15 minutes.
The query uses Fortinet CEF events available in CommonSecurityLog and correlates the appliance, administrative user, and source IP to reduce unrelated administrative activity. This behavior is associated with post-exploitation activity observed for CVE-2026-24858.
Bu sorgudaki temel saldırı zinciri, Microsoft Azure-Sentinel deposundaki
"CVE Exploitation Indicators on Network Appliance (3P)" hunting sorgusunda
bulunan FortiCloud SSO oturumu ile admin hesabı oluşturma korelasyonundan
esinlenilerek hazırlanmıştır.
The query uses Fortinet CEF events available in CommonSecurityLog and correlates the appliance, administrative user, and source IP to reduce unrelated administrative activity. This behavior is associated with post-exploitation activity observed for CVE-2026-24858.
Bu sorgudaki temel saldırı zinciri, Microsoft Azure-Sentinel deposundaki
"CVE Exploitation Indicators on Network Appliance (3P)" hunting sorgusunda
bulunan FortiCloud SSO oturumu ile admin hesabı oluşturma korelasyonundan
esinlenilerek hazırlanmıştır.
Detects HTTP POST requests to an Apache Tomcat server containing a Java serialized-object header (AC ED 00 05) in a request body larger than 512 bytes, consistent with CVE-2026-34486 deserialization exploitation.
Detects CVE-2026-33824 IKE VPN endpoint exploitation traffic (UDP 500/4500) correlated within a 5-minute window with a subsequent outbound reverse-shell callback from the same host.
Detects Langflow CVE-2026-33017 exploitation attempts combining the /api/v1/auto_login endpoint with a flow_id parameter.
Detects incoming HTTP requests directed at the Nacos server application path that contain specific identifiers indicative of an exploitation attempt for CVE-2021-29441. This vulnerability allows an attacker to bypass authentication mechanisms.
Detects anomalous, oversized IKEv1 Phase 1 packets targeting Check Point VPN devices, indicative of an exploitation attempt for CVE-2026-50751.
Page 8 of 19