Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,133 detections
Filters
Last updated
All Time
Detection languages
762
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
370
241
Platforms
934
682
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
2,133
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
Detects an attack identified by the FortiWeb web application firewall. WAF telemetry
is widely collected and almost never turned into detection content — it is usually
left as a vendor dashboard, so repeated targeting of one application by one source
goes unexamined.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='FORTIWEB' and action='THREAT_DETECTED'
| duration 1h
| groupby srcip, dstip, threat
| select srcip, dstip, threat, count(*) as cnt
| having cnt > 10
is widely collected and almost never turned into detection content — it is usually
left as a vendor dashboard, so repeated targeting of one application by one source
goes unexamined.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='FORTIWEB' and action='THREAT_DETECTED'
| duration 1h
| groupby srcip, dstip, threat
| select srcip, dstip, threat, count(*) as cnt
| having cnt > 10
Detects HTTP requests to the PeopleSoft PSEMHUB servlet using alternate
encodings such as the percent-encoded path %50SEMHUB. ShinyHunters/UNC6240 mass-exploit
Oracle PeopleSoft CVE-2026-35273 against internet-facing systems and encode the path to
defeat literal WAF signatures for /PSEMHUB/ (T1190, T1027).
encodings such as the percent-encoded path %50SEMHUB. ShinyHunters/UNC6240 mass-exploit
Oracle PeopleSoft CVE-2026-35273 against internet-facing systems and encode the path to
defeat literal WAF signatures for /PSEMHUB/ (T1190, T1027).
Detects HTTP requests to the WordPress REST batch endpoint (/wp-json/batch/v1 or /?rest_route=/batch/v1) carrying user agents associated with public wp2shell proof-of-concept tooling. This targets the pre-auth route confusion and SQL injection primitive in WordPress Core (CVE-2026-63030, CVE-2026-60137) that leads to full remote code execution.
Detects suspicious DNS queries to external service interaction domains often used for out-of-band interactions after successful RCE
Detects when the IIS worker process (w3wp.exe) spawns command-line utilities or script interpreters such as cmd.exe, powershell.exe, mshta.exe, wscript.exe, or cscript.exe. This behavior often indicates web application exploitation or webshell activity.
Detects non-browser Python-based HTTP clients (such as python-requests, python-urllib, aiohttp, or httpx) targeting specific API endpoints (/user, /profile, /order, /upload) while exhibiting indicators of SQL injection or high-volume object ID enumeration.
Detects non-browser Python-based HTTP clients (such as python-requests, python-urllib, aiohttp, or httpx) targeting specific API endpoints (/user, /profile, /order, /upload) while exhibiting indicators of SQL injection or high-volume object ID enumeration.
Detects non-browser Python-based HTTP clients (such as python-requests, python-urllib, aiohttp, or httpx) targeting specific API endpoints (/user, /profile, /order, /upload) while exhibiting indicators of SQL injection or high-volume object ID enumeration.
Detects non-browser Python-based HTTP clients (such as python-requests, python-urllib, aiohttp, or httpx) targeting specific API endpoints (/user, /profile, /order, /upload) while exhibiting indicators of SQL injection or high-volume object ID enumeration.
Detects non-browser Python-based HTTP clients (such as python-requests, python-urllib, aiohttp, or httpx) targeting specific API endpoints (/user, /profile, /order, /upload) while exhibiting indicators of SQL injection or high-volume object ID enumeration.
Hunts for NetScaler Pitboss packet engine messages where the text after NSPPE carries shell syntax such as separators, command substitution or ${IFS}. Security vendors observed this pattern during exploitation of the NetScaler pre authentication command injection flaw patched in September 2026.
The query reads Syslog and CommonSecurityLog and decodes URL encoding. It checks only the text after NSPPE, so plain heartbeat lines without shell syntax do not match. The matching logic was checked on sample strings only, not on real appliance logs.
Triage: Check the source, the appliance version and whether it was patched at that time. A match on an unpatched appliance points to an exploitation attempt, not proof of success. Preserve logs and a snapshot before upgrading. Hunting query, not an alert.
Limitations: Needs NetScaler syslog forwarded to Sentinel. Empty results do not prove an appliance is clean. Attackers can remove traces and other techniques are not covered. Field names depend on the syslog format and connector. Bare separators and short words can match legitimate messages, so tune the regex after reviewing real results.
The query reads Syslog and CommonSecurityLog and decodes URL encoding. It checks only the text after NSPPE, so plain heartbeat lines without shell syntax do not match. The matching logic was checked on sample strings only, not on real appliance logs.
Triage: Check the source, the appliance version and whether it was patched at that time. A match on an unpatched appliance points to an exploitation attempt, not proof of success. Preserve logs and a snapshot before upgrading. Hunting query, not an alert.
Limitations: Needs NetScaler syslog forwarded to Sentinel. Empty results do not prove an appliance is clean. Attackers can remove traces and other techniques are not covered. Field names depend on the syslog format and connector. Bare separators and short words can match legitimate messages, so tune the regex after reviewing real results.
Detects requests through WebSEAL whose URI or query string carries exploitation
characteristics. As a reverse proxy, WebSEAL sees the full request before it reaches
the application, which makes it the right place to catch attempts against back-end
systems that log very little themselves.
Onboarding: ISAM-WEBSEAL is ingested via Syslog (Bloo extractor 85).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webserver where sourcename='ISAM-WEBSEAL'
| groupby url, uriquery, method, returncode, srcip, useragent
characteristics. As a reverse proxy, WebSEAL sees the full request before it reaches
the application, which makes it the right place to catch attempts against back-end
systems that log very little themselves.
Onboarding: ISAM-WEBSEAL is ingested via Syslog (Bloo extractor 85).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webserver where sourcename='ISAM-WEBSEAL'
| groupby url, uriquery, method, returncode, srcip, useragent
Detects HTTP requests targeting Microsoft Exchange servers that combine the autodiscover.json URI with PowerShell endpoint parameters, indicative of ProxyNotShell vulnerabilities exploitation (CVE-2022-41040 and CVE-2022-41082).
Detects potential exploitation of the libcurl CURLOPT_REQUEST_TARGET CRLF injection vulnerability via web/proxy request logs where curl user-agents are observed with carriage return/line feed characters or injected request lines within the URI path.
The following analytic detects Zeek HTTP requests using methods outside a configurable allowlist of standard and commonly used HTTP methods.
Unusual methods can indicate protocol abuse, exploitation attempts, or command-and-control traffic.
Review the method, source, destination, and URI to assess the activity.
Unusual methods can indicate protocol abuse, exploitation attempts, or command-and-control traffic.
Review the method, source, destination, and URI to assess the activity.
Hunts for NetScaler Pitboss packet engine messages where the text after NSPPE carries shell syntax such as separators, command substitution or ${IFS}. Security vendors observed this pattern during exploitation of the NetScaler pre authentication command injection flaw patched in September 2026.
The query reads Syslog and CommonSecurityLog and decodes URL encoding. It checks only the text after NSPPE, so plain heartbeat lines without shell syntax do not match. The matching logic was checked on sample strings only, not on real appliance logs.
Triage: Check the source, the appliance version and whether it was patched at that time. A match on an unpatched appliance points to an exploitation attempt, not proof of success. Preserve logs and a snapshot before upgrading. Hunting query, not an alert.
Limitations: Needs NetScaler syslog forwarded to Sentinel. Empty results do not prove an appliance is clean. Attackers can remove traces and other techniques are not covered. Field names depend on the syslog format and connector. Bare separators and short words can match legitimate messages, so tune the regex after reviewing real results.
The query reads Syslog and CommonSecurityLog and decodes URL encoding. It checks only the text after NSPPE, so plain heartbeat lines without shell syntax do not match. The matching logic was checked on sample strings only, not on real appliance logs.
Triage: Check the source, the appliance version and whether it was patched at that time. A match on an unpatched appliance points to an exploitation attempt, not proof of success. Preserve logs and a snapshot before upgrading. Hunting query, not an alert.
Limitations: Needs NetScaler syslog forwarded to Sentinel. Empty results do not prove an appliance is clean. Attackers can remove traces and other techniques are not covered. Field names depend on the syslog format and connector. Bare separators and short words can match legitimate messages, so tune the regex after reviewing real results.
Detects potential exploitation of a SAML-related vulnerability in Citrix NetScaler appliances by correlating a surge in SAML authentication traffic to Gateway/AAA endpoints followed by application crashes or core dumps on the device. This behavioral pattern is indicative of a crash-inducing exploitation attempt targeting SAML processing.
Hunts for NetScaler Pitboss packet engine messages where the text after NSPPE carries shell syntax such as separators, command substitution or ${IFS}. Security vendors observed this pattern during exploitation of the NetScaler pre authentication command injection flaw patched in September 2026.
The query reads Syslog and CommonSecurityLog and decodes URL encoding. It checks only the text after NSPPE, so plain heartbeat lines without shell syntax do not match. The matching logic was checked on sample strings only, not on real appliance logs.
Triage: Check the source, the appliance version and whether it was patched at that time. A match on an unpatched appliance points to an exploitation attempt, not proof of success. Preserve logs and a snapshot before upgrading. Hunting query, not an alert.
Limitations: Needs NetScaler syslog forwarded to Sentinel. Empty results do not prove an appliance is clean. Attackers can remove traces and other techniques are not covered. Field names depend on the syslog format and connector. Bare separators and short words can match legitimate messages, so tune the regex after reviewing real results.
The query reads Syslog and CommonSecurityLog and decodes URL encoding. It checks only the text after NSPPE, so plain heartbeat lines without shell syntax do not match. The matching logic was checked on sample strings only, not on real appliance logs.
Triage: Check the source, the appliance version and whether it was patched at that time. A match on an unpatched appliance points to an exploitation attempt, not proof of success. Preserve logs and a snapshot before upgrading. Hunting query, not an alert.
Limitations: Needs NetScaler syslog forwarded to Sentinel. Empty results do not prove an appliance is clean. Attackers can remove traces and other techniques are not covered. Field names depend on the syslog format and connector. Bare separators and short words can match legitimate messages, so tune the regex after reviewing real results.
This analytic detects Windows processes such as cmd.exe, PowerShell, and common Windows LOLBINs being spawned by React or Next.js application servers.
In the context of CVE-2025-55182 / React2Shell / CVE-2025-66478 for Next.js, successful exploitation can lead to arbitrary JavaScript execution on the server, which in turn is used to invoke Node's child_process APIs (for example child_process.execSync) to run OS-level commands.
This detection focuses on suspicious child processes where a Next/React server process spawns an uncommon process.
Such activity might be a strong indicator of exploitation of the aforementioned vulnerability.
In the context of CVE-2025-55182 / React2Shell / CVE-2025-66478 for Next.js, successful exploitation can lead to arbitrary JavaScript execution on the server, which in turn is used to invoke Node's child_process APIs (for example child_process.execSync) to run OS-level commands.
This detection focuses on suspicious child processes where a Next/React server process spawns an uncommon process.
Such activity might be a strong indicator of exploitation of the aforementioned vulnerability.
Detects an unauthenticated remote code execution attempt against AhsayCBS via the UpdateReceivers.do endpoint using the checkSysPwd parameter, associated with CVE-2026-105133 and CVE-2026-105134.
Detects potential exploitation attempts targeting unpatched Citrix NetScaler ADC or Gateway devices, specifically looking for unauthenticated requests to management or sensitive endpoints that contain command execution indicators. This rule is designed to identify activity associated with vulnerabilities similar to CVE-2026-88771.
Page 4 of 102