Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
296 detections
Filters
Last updated
All Time
Detection languages
106
82
51
17
14
Contributors
78
53
49
19
17
Categories
193
87
58
58
49
Platforms
136
116
82
26
14
Products / Services
82
78
53
28
26
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
13
12
10
8
8
IDS Classtypes
39
17
12
7
3
IDS Protocols
35
24
10
8
4
This rule detects the execution of known SMB exploitation tools (e.g., Python-based SMBGhost scanners/payloads, Metasploit resource scripts for EternalBlue) and identifies high-fan-out SMB scanning activity or unauthorized SMB connections from non-standard processes to an internal subnet (10.39.x.x).
Detects command-line activity or process execution related to the EternalBlue (MS17-010) exploit suite, commonly used for lateral movement and remote code execution against SMB services (ports 445/139).
Detects outbound SSH connections from common applications using libssh2 to external, non-standard or untrusted servers, followed by an anomalously large inbound TCP data transfer before authentication completes. This behavior is indicative of exploitation attempts targeting CVE-2026-55200, where a malicious SSH server triggers a heap overflow in the client via a malformed packet.
This rule detects the execution of known exploit binaries and proof-of-concept (PoC) tools associated with vulnerabilities in libssh2, as well as anomalous child process spawning from common SSH-related applications (curl, git, php). These behaviors are indicative of exploitation attempts or unauthorized activity related to the libssh2 exploit chain.
Detects network flows to RustDesk relay server ports (21115, 21116, 21117) characterized by anomalous connection patterns. The rule identifies hosts exhibiting rapid, repeated connection attempts or connections to multiple distinct relay IP addresses within a short timeframe. This behavior is consistent with the 'rustdesk-session-permission-pocs' technique, which may indicate an attacker attempting to establish a remote session while bypassing the standard permission handshake exchange required by the application.
Detects evidence of libssh2 publickey list heap corruption exploitation, including the presence or execution of known proof-of-concept (PoC) binaries, malicious SSH server connection patterns on port 2228, and suspicious child processes (e.g., cmd.exe, calc.exe) spawned by SSH clients or daemons.
Detects unauthenticated access attempts to the ServiceNow Scripted REST Resource endpoint '/api/now/related_list_edit/create'. This endpoint has been associated with exploitation activity targeting ServiceNow instances, particularly when accessed by the 'Guest' account or with missing session tokens.
Detects path traversal attempts in web server access logs by searching for dot-dot-slash (../), dot-dot-backslash (..\), or their URL-encoded equivalents (..). These patterns are indicative of efforts to access files or directories outside the intended web root.
This rule detects macOS 'sharingd' or 'Foundation' service crashes (stack overflow, recursion limit exceeded, or EXC_BAD_ACCESS) that occur during the processing of plist files. This behavior is indicative of potential memory corruption exploits targeting vulnerabilities in Apple's plist parsing logic, potentially exploited via AirDrop.
This rule detects repeated path traversal sequences (../ or ..%2F) in the HTTP URI. This behavior is indicative of an attacker attempting to escape the intended web directory to access sensitive files or configuration files on the underlying filesystem.
This rule detects attempts to perform directory traversal attacks by monitoring incoming HTTP requests for repetitive directory navigation sequences (e.g., ../, .., %2F, %5C). Such sequences are often used to bypass security controls and access unauthorized files or directories on the web server.
This rule detects repeated path traversal sequences (../ or ..%2F) in the HTTP URI. This behavior is indicative of an attacker attempting to escape the intended web directory to access sensitive files or configuration files on the underlying filesystem.
Detects network connections over SMB (port 445) targeting internal IP ranges initiated by common penetration testing or scripting tools (e.g., Python, msfconsole), or attempts containing known exploit strings such as 'eternalblue', 'ms17-010', or 'WinboxExploit'. This behavior is indicative of lateral movement, reconnaissance, or exploitation attempts within the network.
This rule monitors Cisco SD-WAN environment logs for indicators of unauthorized or suspicious control plane activity, including rogue peering attempts, unexpected NETCONF interactions, certificate mismatches, and unauthorized vBond/vSmart connections. It filters out known local management subnets and utilizes a threat intelligence lookup to identify potentially malicious infrastructure attempting to interface with the SD-WAN fabric.
Detects path traversal exploitation attempts targeting Dell Wyse Management Suite (WMS) processes or Java components, specifically looking for attempts to access sensitive system files such as SAM, NTDS.dit, or registry hive files via directory traversal sequences.
Detects exploitation of application vulnerabilities for denial of service
This rule detects successful exploitation attempts against the Ivanti Sentry vulnerability CVE-2026-10520, which is a pre-authentication OS command injection. It specifically looks for HTTP 200 OK responses to requests targeting the vulnerable configuration endpoint '/mics/api/v2/sentry/mics-config/handleMessage'. A 200 OK status indicates that the request was successfully processed, suggesting a potential successful command injection.
Detects exploitation of application vulnerabilities for denial of service
This rule detects potential lateral movement attempts originating from IIS web servers (identified by 'w3wp.exe' as the initiating process) to other internal IP addresses using common lateral movement ports (SMB, RDP, WinRM, SSH). It specifically looks for successful network connections from an IIS server to a private IP address on one of the specified ports, where the remote IP is not the local IP.
Detects the creation of processes where the command line contains keywords such as 'cve' or 'vulnerability'. This could indicate attempts to exploit known vulnerabilities, perform vulnerability research, or execute tools related to vulnerability assessment.
Detects the creation of processes where the command line contains keywords such as 'cve' or 'vulnerability'. This could indicate attempts to exploit known vulnerabilities, perform vulnerability research, or execute tools related to vulnerability assessment.
Page 10 of 15