Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
461 detections
Filters
Last updated
All Time
Detection languages
459
2
Contributors
132
104
86
64
24
Categories
408
390
281
37
35
Platforms
404
80
43
24
6
Products / Services
446
282
21
18
15
MITRE Techniques
320
196
58
43
30
CVEs
15
9
8
7
7
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
452
3
1
1
This rule detects high-volume, potentially automated POST requests to specific WordPress plugin endpoints (Super Forms and Elementor Pro) used for form submissions and file uploads. A high frequency of these requests from a single source within a short timeframe suggests active reconnaissance or exploitation attempts against these vulnerable components.
This rule detects an unauthenticated exploitation attempt against Magento GraphQL endpoints, specifically targeting the 'styles' parameter. The attack pattern involves sending a malformed request to the /graphql endpoint with an 'X-TRACE-' header, which is indicative of the StyleSmuggler vulnerability exploit.
Detects inbound HTTP POST requests to the /paypal/transparent/response/ endpoint containing encoded PHP webshell payloads, specifically attempting to execute base64-decoded code via eval.
Detects malicious traffic directed towards unpkg.com associated with the 'Beamglea' campaign. The rule specifically monitors for connections to known malicious npm-mirrored packages or pages serving fake Cloudflare CAPTCHA challenges, which are common tactics for credential theft and browser-based exploitation.
This rule detects an unauthenticated exploitation attempt against Magento GraphQL endpoints, specifically targeting the 'styles' parameter. The attack pattern involves sending a malformed request to the /graphql endpoint with an 'X-TRACE-' header, which is indicative of the StyleSmuggler vulnerability exploit.
Detects HTTP traffic directed to known abused web hosting platforms and SaaS site builders frequently used by the BengalSEO campaign to host search engine optimization (SEO) poisoning lures. These lures typically mimic service activation or support pages to trick users into downloading malicious content.
This rule detects two components of a malicious campaign using Google Sites to host fake OpenAI Codex installer lures. The first rule detects when a response body from an external server contains an iframe pointing to the domain 'bright-links.com'. The second rule detects client-side requests to Google Sites paths containing 'codex', indicating a user is navigating to the lure page.
Detects HTTP requests to the attacker's WebApp-Form-Host operator panel managing compromised WordPress sites at scale (wp-uploading.php/wp-verifyup.php with activator parameters).
Detects HTTP requests to StopAndProtect's WordPress webshells and malicious MU-plugin backdoor endpoints.
Detects HTTP GET requests to UNC6692 Edgecution phishing landing pages hosted on S3 buckets using the 'service-page-*-outlook.s3.us-west-2.amazonaws.com' naming pattern with an 'email=' parameter and '/update.html' URI, used to lure victims into downloading the Edgecution malware suite via fake Outlook/Mailbox Repair Utility pages.
Detects a phishing page's /api/config fetch used to stage ClickFix instructions, requiring a Referer indicating an impersonated CRM login page (NetSuite, Odoo, HubSpot, or Salesforce) while excluding requests to the genuine vendor domains.
Detects unauthenticated WebSocket upgrade requests to a terminal/shell-related URI path or subprotocol, lacking Authorization or Cookie headers, indicative of unauthenticated web-terminal exploitation.
Detects CVE-2026-3055 Citrix NetScaler out-of-bounds memory-read exploitation via a GET request eliciting an oversized HTTP response body containing a leaked NSC_AAAC session cookie.
UNC6692 fake Outlook Updates Management Console phishing page served from S3
Detects an n8n form file-upload request combining the vulnerable /form/ multipart upload endpoint with a path-traversal marker in the filename field, consistent with the chained CVE-2026-21858 arbitrary file read to CVE-2025-68613 sandbox-bypass RCE exploit.
Detects inbound HTTP requests targeting specific hosts (photo.pokok.edu.hk, pta.sfaeps.edu.hk) with URI patterns associated with exploitation campaigns targeting vulnerabilities including CVE-2018-11511, CVE-2021-24139, CVE-2021-31755, and CVE-2021-32305.
Detects a rapid sequence of blind boolean SQL injection probes against the author_exclude parameter using ASCII/SUBSTRING syntax and the X-WP-Total header oracle (CVE-2026-60137).
Detects HTTP request attempts to exploit WordPress vulnerabilities (associated with 'wp2shell' activity) targeting the 'author_exclude' or 'author__not_in' parameters with SQL injection payloads, such as sleep() functions or comment injection characters.
This rule detects unauthenticated HTTP requests to the WordPress REST API batch endpoint (/wp-json/batch/v1). Such requests are characteristic of attempts to exploit the wp2shell vulnerability (CVE-2026-63030), where attackers leverage the batch API to execute unauthorized actions without proper authentication headers (Cookie or Authorization).
Detects multiple repeated web requests targeting WordPress 'author_exclude' or '/wp/v2/batch' endpoints that contain suspicious time-based SQL injection payloads. The rule specifically looks for patterns attempting to leverage SLEEP() functions to infer database information.
Detects the WordPress REST API batch-route confusion technique (CVE-2026-63030) via a malformed nested sub-request path combined with the co-occurring parse_path_failed/block_cannot_read/rest_batch_not_allowed error marker pattern.
Page 9 of 22