Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
60 detections
Filters
Last updated
All Time
Detection languages
33
9
4
4
4
Contributors
20
9
4
3
3
Categories
24
19
12
7
7
Platforms
31
23
9
4
1
Products / Services
11
10
5
5
5
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
1
1
1
1
1
IDS Classtypes
3
1
IDS Protocols
3
1
Detects the presence of known malicious VS Code extension files disguised as Jupyter Notebook and markdown tools, which act as a multi-stage backdoor utilized by North Korean threat actors. The rule specifically looks for file creation events of VSIX files with names associated with a known campaign.
Detects suspicious access to network device configuration files or routing table exports, potentially indicating compromise by the Salt Typhoon threat actor. This rule correlates file access events on critical configuration files (e.g., running-config, startup-config, BGP routes) within sensitive directories with network or remote interactive logons by local administrators.
This rule detects HTTP POST requests to a web server where the URI contains both 'plugin' and 'install' (case-insensitive). This combination of keywords in a POST request URI could indicate an attempt to install a malicious plugin on a web application.
This rule detects attempts to upload web shell files to a server's application directory. It specifically looks for HTTP POST requests where the URI contains common web shell file extensions (php, asp, aspx, jsp, cfm) and the file data contains the string "eval(" (case-insensitive), which is a common function used in web shells for code execution.
This rule detects attempts to upload malicious web server modules, plugins, or components. It specifically looks for HTTP PUT requests to URIs containing '/modules/', '/plugins/', or '/components/' and checks the file data for the 'MZ' header, indicating an executable file (likely a Windows executable or DLL). This combination suggests an attacker is trying to upload a malicious executable to a web server's module/plugin directory for persistence or further compromise.
This rule detects the deployment of a potentially malicious middleware component on an application server. It specifically looks for HTTP POST requests to port 8080 with a URI containing 'deploy' (case-insensitive) and a data size greater than 10000 bytes. This pattern is indicative of a large payload being sent to deploy an application or component, which could be malicious in nature.
Detects the creation of a new MariaDB User-Defined Function (UDF) that loads a shared object (.so or .dll) file. This technique is used in the final stage of the CVE-2026-32710 attack chain to execute arbitrary OS commands, often from suspicious temporary or public directories.
Detects attempts to exploit a vulnerability in Google Looker (CVE-2025-12743) by using error-based SQL injection within LookML dimension definitions. Attackers can use this to exfiltrate the internal Looker database.
This query uses the Machine Learning series_decompose_anomalies function to build a baseline of "normal" transport rule modification behavior. If your organization typically changes 0 rules a week, and suddenly 5 are changed at 2 AM on a Saturday, this query will catch it regardless of what the parameters are.
Modifications to a config that will serve an adversary's impacts or persistence
This rule detects modifications to Cisco device configurations that could be used by an adversary for persistence, privilege escalation, or to impact system availability. Specifically, it looks for commands related to enabling HTTP/HTTPS servers, configuring Kron jobs (scheduled tasks), modifying access lists, archiving configurations, and setting NTP servers. These commands, if used maliciously, can allow an attacker to maintain access, execute arbitrary commands, control network access, or disrupt time synchronization.
Detects the PHP file handler variant of BadIIS, used in the 'Operation Rewrite' campaign for SEO poisoning and traffic redirection.
Detects scenarios where an attacker enable the xp_cmdshell in order to execute non SQL content and escalate privileges
Detects scenarios where an attacker attempts to load an artifact in the Exchange transport agent.
Detects scenarios where an attacker attempts to load an artifact in the Exchange transport agent.
'This hunting query identifies GitHub OAuth Apps that have restrictions disabled that may be a sign of compromise. Attacker will want to disable such security tools in order to go undetected. '
The following analytic detects attempts to exploit CVE-2022-26134, an unauthenticated remote code execution vulnerability in Confluence. It leverages the Web datamodel to analyze network and CIM-compliant web logs, identifying suspicious URL patterns and parameters indicative of exploitation attempts. This activity is significant as it allows attackers to execute arbitrary code on the Confluence server without authentication, potentially leading to full system compromise. If confirmed malicious, this could result in unauthorized access, data exfiltration, and further lateral movement within the network. Immediate investigation and remediation are crucial to prevent extensive damage.
This analytic identifies instances where the CrushFTP service process (crushftpservice.exe) spawns shell processes such as cmd.exe or powershell.exe. This behavior is unusual for CrushFTP during normal operations and could indicate a successful exploitation of vulnerabilities, such as CVE-2025-31161, allowing an attacker to execute arbitrary commands with the privileges of the CrushFTP service.
Page 3 of 3