Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,919 detections
Filters
Last updated
All Time
Detection languages
2,238
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
808
765
577
Platforms
1,844
1,022
856
814
659
Products / Services
988
596
477
456
383
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
4,919
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Detects process execution related errors in NodeJS. If the exceptions are caused due to user input then they may suggest an RCE vulnerability.
Detects potential local file read vulnerability in JVM based apps.
If the exceptions are caused due to user input and contain path traversal payloads then it's a red flag.
If the exceptions are caused due to user input and contain path traversal payloads then it's a red flag.
Detects process execution related exceptions in JVM based apps, often relates to RCE
Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE.
Java Payload Strings
Sigma
Detects possible Java payloads in web access logs
Detects path traversal exploitation attempts
Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation
Detects potential JNDI Injection exploitation. Often coupled with Log4Shell exploitation.
Detects XML parsing issues, if the application expects to work with XML make sure that the parser is initialized safely.
Detects SQL error messages that indicate probing for an injection attack
Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell.
SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
Detects an issue in apache logs that reports threading related errors
Detects potential SQL injection attempts via GET requests in access logs.
USB Device Plugged
Sigma
Detects plugged/unplugged USB devices
Detects external disk drives or plugged-in USB devices.
Detects suspicious file type dropped by an Exchange component in IIS
Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which could be a sign of ProxyShell exploitation
Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)
Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.
Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.
Detects a suspicious program execution in Outlook temp folder
Page 233 of 235