Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
461 detections
Filters
Last updated
All Time
Detection languages
459
2
Contributors
132
104
86
64
24
Categories
408
390
281
37
35
Platforms
404
80
43
24
6
Products / Services
446
282
21
18
15
MITRE Techniques
320
196
58
43
30
CVEs
15
9
8
7
7
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
452
3
1
1
Detects an exploitation attempt against PaperCut MF software leveraging SQL injection to deliver a Java bytecode loader (identified by the 'cafebabe' magic bytes) via a POST request.
Detects SQL injection exploitation attempts against MOVEit Transfer targeting the CVE-2023-34362 vulnerability, followed by the deployment and subsequent interaction with the 'human2.aspx' webshell associated with Cl0p ransomware mass-exploitation campaigns.
Detects attempts to exploit the Log4Shell vulnerability (CVE-2021-44228) by identifying JNDI lookups (ldap, rmi, dns) via malicious strings within HTTP URI and request headers, a common attack vector for remote code execution.
This rule detects an exploitation attempt targeting the ConnectWise ScreenConnect Path Traversal vulnerability (CVE-2024-1708). The detection monitors incoming HTTP traffic for attempts to traverse the file system by inspecting the URI for repeated '..' sequences within the '/App_Extensions/' directory, a hallmark of this vulnerability.
Detects incoming HTTP POST requests to the 'diffpatch' endpoint in Gitea that contain suspicious 'diff --git' patterns combined with path traversal sequences ('../') targeting 'hooks/' directories. This indicates an attempt to exploit CVE-2026-60004 to achieve unauthorized file system access or remote code execution via repository hooks.
Detects incoming HTTP POST requests to internal AI/LLM API endpoints containing common prompt injection strings, such as instructions to ignore previous system prompts or attempts to trigger jailbreak modes like 'DAN'.
Detects attempts to exploit a vulnerability (CVE-2026-68536) in the Apache MyFaces JSF resource handler. The rule monitors for malicious URI parameters ('ln' or 'library') that attempt Server-Side Request Forgery (SSRF) targeting cloud metadata services, path traversal, or URI-based injection attacks.
This rule detects attempts to exploit CVE-2026-93647, a Stored Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic Webclient. The exploit involves injecting malicious script tags or JavaScript event handlers into calendar fields such as SUMMARY, DESCRIPTION, or LOCATION. The detection monitors inbound TCP traffic on web ports used by the application, specifically looking for common XSS injection patterns within calendar-related fields.
Detects a high volume of HTTP POST requests to common login endpoints (e.g., /login or /wp-login.php) from a single source IP address within a short time frame, which is indicative of a credential stuffing or automated brute-force attack.
Detects incoming HTTP traffic containing a custom 'X-Quad' header, which is indicative of exploitation attempts targeting PaperCut MF vulnerabilities (CVE-2026-82078/CVE-2026-81578). This header is associated with the deployment or interaction with a Java-based web shell to establish unauthorized access.
Detects Server-Side Request Forgery (SSRF) attempts targeting SonicWall SMA1000 WorkPlace endpoints. The rule monitors both HTTP GET query parameters and HTTP request bodies for patterns indicating attempts to redirect the application to internal loopback addresses or local network ranges (e.g., 127.0.0.1, 169.254.169.254, RFC1918 private subnets).
Detects high-frequency POST requests to API endpoints, potentially indicative of automated fuzzing or brute-force parameter mutation attacks, by identifying 50 requests from a single source within a 10-second window.
This rule detects attempts to exploit a command injection vulnerability (CVE-2026-49869) in the Kestra workflow automation platform. The rule monitors HTTP POST requests to the '/api/v1/flows' endpoint, identifying payloads that define flow types involving shell or execution plugins and contain suspicious command sequences (e.g., shell operators combined with common system utilities like nc, bash, or curl).
Detects an exploitation attempt against a known SQL injection vulnerability (CVE-2026-62262) in the Piwigo photo gallery application, specifically targeting the 'pwg.images.filteredSearch.create' method via the 'ratings' parameter. The detection monitors inbound HTTP traffic for common SQL injection patterns like UNION SELECT, SLEEP commands, and boolean-based injection payloads.
Detects inbound command-and-control traffic to the MOVEit Transfer application targeting the LEMURLOOT web shell, and subsequent detection of gzip-compressed database exfiltration.
This rule detects POST requests to the '/v2/repository/index' endpoint of a Triton Inference Server. This endpoint is part of the Model Repository control API and is typically used to manage or inspect models. Unauthorized access to this API can be indicative of reconnaissance or exploitation attempts against the inference server.
Detects multiple inbound HTTP requests targeting known vulnerable application paths (e.g., cgi-bin, .env files, actuator gateways, path traversal, WordPress plugins, PHP eval files, and various server administration consoles) from a single source within a short timeframe. This behavior is indicative of an automated scanner or exploit chain attempting to identify and compromise public-facing applications.
Detects network exploitation attempts targeting CVE-2026-82329 in JFrog Artifactory. The rule identifies path traversal, malicious Java deserialization payloads, and unauthorized access attempts to sensitive administrative API endpoints.
Detects incoming HTTP requests to an Artifactory deployment that utilize 'X-Forwarded-Host' and 'X-Forwarded-Scheme' headers in a manner consistent with HTTP cache poisoning attacks (CVE-2026-66384), specifically identifying when the 'X-Forwarded-Host' header contains unexpected or non-internal network values.
Detects SQL injection exploitation attempts against MOVEit Transfer targeting the CVE-2023-34362 vulnerability, followed by the deployment and subsequent interaction with the 'human2.aspx' webshell associated with Cl0p ransomware mass-exploitation campaigns.
Detects incoming HTTP requests to a FortiSandbox device that contain suspicious command injection patterns. The rule monitors both the URI and the request body for shell metacharacters such as ';', '|', '`', '$(', or '&&', followed by common binary execution commands (e.g., cat, wget, curl, bash, rm). This behavior is indicative of an exploit attempt targeting CVE-2026-39808.
Page 2 of 22