Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,133 detections
Filters
Last updated
All Time
Detection languages
762
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
370
241
Platforms
934
682
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
2,133
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
Correlates a CVE-2026-76504 encoded /%6a_security_check login POST with a follow-on /dataservice/admin/user request from the same client to the same vManage within 10 minutes. Summarized and sorted by follow-on count.
Detects web server processes (apache2, httpd) spawning a Unix shell (sh, dash, bash) which subsequently executes curl, wget, or php to perform an external HTTP fetch or download. This behavior is commonly associated with PHP or web application post-exploitation callbacks (webshells).
Detects command execution patterns on NetScaler appliances involving the extraction of system details (id, uname, hostname, nsrelease) and writing or echoing them into HTML files within NetScaler web directories, indicative of web shell installation or staging.
Detects the execution of the public Horizon3.ai PoC exploit for CVE-2026-106173 (FortiSIEM gRPC path traversal RCE) utilizing python interpreters with specific command-line arguments indicative of the exploit tool.
Detects web server processes (Apache httpd, apache2, php-cgi, php-fpm) spawning a Unix shell (sh, bash, dash) that executes a wget or curl command piped directly into the shell for execution, indicative of potential remote code execution or web shell activity.
Detects multiple distinct source IPs sending forged 'pitboss PPE' authentication failure messages to NetScaler authentication endpoints within a short timeframe, associated with a fetch-based FreeBSD payload download (kw2-freebsd-x64-s11).
Detects HTTP requests containing serialized PHP objects in the Cookie header matching patterns associated with Zend Framework or Laminas gadget chains, characteristic of PHP object deserialization exploitation (e.g., PHPGGC style).
Detects web server worker processes (such as php-fpm, apache2, nginx, w3wp.exe) spawning download utilities like curl or wget, certutil with transfer flags, or initiating /dev/tcp network connections, which may indicate web application exploitation or webshell activity.
Correlates an inbound connection to a Python/Xoscar/Xinference pool process with an outbound connection from a shell spawned by that same pool process shortly afterward, potentially indicating exploitation and reverse shell activity.
Detects CVE-2026-76504 Cisco SD-WAN vManage authentication bypass attempts: POST logins using internal viptela-reserved-* accounts via the percent-encoded /%6a_security_check path. Summarized per host and account.
Detects the presence of Cisco SD-WAN vManage software, vulnerabilities related to CVE-2026-76504, associated file artifacts, and process executions across endpoints using inventory and event logs.
Detects a sequence where an UpdraftCentral management request is made to a WordPress site followed by plugin installation or user creation requests from the same source within a 30-minute window, potentially indicating unauthorized plugin installation or webshell deployment via compromised management endpoints.
Detects a sequence where a SharePoint application pool worker process (w3wp.exe) spawns a command shell (cmd.exe, powershell.exe, pwsh.exe) related to SharePoint, followed shortly (within 1 hour) by high-fidelity lateral movement tooling or remote execution techniques (such as PsExec, WMI, PowerShell remoting, or scheduled tasks) on the same host.
Detects potential SQL injection (SQLi) attempts targeting web applications by identifying multiple requests matching specific SQLi regex patterns combined with encoding or internal reference markers within web access logs.
Detects suspicious exploitation activity against NetScaler ADC/Gateway appliances, including requests to CGI, VPN, or authentication endpoints with command execution, webshell, or encoded payload behavior associated with CVE-2026-88771.
Detects repeated crashes of GitLab Ruby, Puma, Sidekiq, or bundle processes on Linux within a short time window. The detection looks for crash markers such as segfault, SIGSEGV, SIGABRT, or onigmo in the command line, which typically indicate exploitation attempts against Onigmo regex engine vulnerabilities.
Detects a burst of denied requests at the load balancer. The appliance sits in front
of the application and sees attempts the application never receives, which makes it
an early warning layer that most estates collect and never query.
Onboarding: BARRACUDA-LOADBALANCER is ingested via Syslog (CEF) (Bloo extractor 859).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webserver where sourcename='BARRACUDA-LOADBALANCER'
and action='REQUEST_DENIED'
| duration 15m
| groupby srcip, useragent
| select srcip, useragent, distinct_count(url)
| having distinct_count_col1 > 20
of the application and sees attempts the application never receives, which makes it
an early warning layer that most estates collect and never query.
Onboarding: BARRACUDA-LOADBALANCER is ingested via Syslog (CEF) (Bloo extractor 859).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webserver where sourcename='BARRACUDA-LOADBALANCER'
and action='REQUEST_DENIED'
| duration 15m
| groupby srcip, useragent
| select srcip, useragent, distinct_count(url)
| having distinct_count_col1 > 20
Detects web servers (httpd, apache2, nginx, php-fpm) or Request Tracker (RT) Perl worker processes spawning suspicious child processes such as shells, downloaders, netcat, or Python interpreters, indicative of post-exploitation or web application compromise.
Detects CVE-2026-76504 Cisco SD-WAN vManage authentication bypass attempts: POST logins using internal viptela-reserved-* accounts via the percent-encoded /%6a_security_check path. Summarized per host and account.
Correlates a CVE-2026-76504 encoded /%6a_security_check login POST with a follow-on /dataservice/admin/user request from the same client to the same vManage within 10 minutes. Summarized and sorted by follow-on count.
Finds BeyondTrust Remote Support (Bomgar) appliances at version 26.2.3 or earlier that have a public IP address, indicating a potentially internet-facing vulnerable appliance (CVE-2026-102764). Index and field names are placeholders to adapt.
Page 3 of 102