Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,421 detections
Filters
Last updated
All Time
Detection languages
4,217
105
40
25
13
Contributors
1,327
1,003
725
627
332
Categories
2,253
2,239
1,434
1,144
973
Platforms
4,107
453
295
83
82
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
886
774
552
505
456
CVEs
18
12
12
12
10
IDS Classtypes
1,868
466
446
362
230
IDS Protocols
2,366
846
388
301
93
ET EXPLOIT_KIT LandUpdate808 Domain (edentista .com) in TLS SNI
ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (graffetti .com)
ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (graffetti .com)
ET EXPLOIT_KIT LandUpdate808 Domain (guiasexo .com) in TLS SNI
ET EXPLOIT_KIT ZPHP Domain in TLS SNI (fellsminjs .com)
ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (fellsminjs .com)
ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (varorg .com)
ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (polimakels .com)
ET EXPLOIT_KIT ZPHP Domain in TLS SNI (prajsm .com)
ET ATTACK_RESPONSE Likely ClickFix Related Staging Domain
This rule detects the 'Zip Slip' vulnerability pattern within incoming TAR archives. Specifically, it looks for the sequence '|00 00 00 2e 2e 5c|' (which represents '..\') within the file data of a POSIX tar archive. This pattern indicates an attempt to extract files outside of the intended directory, potentially leading to directory traversal and arbitrary file overwrite.
ET ATTACK_RESPONSE Nishang Invoke-PowerShellTcp Shell Prompt Outbound
ET ATTACK_RESPONSE HTML Smuggling Powershell Payload In iframe
This rule detects the inbound transfer of an AsyncRAT installer executable over HTTP. It specifically looks for HTTP responses with a content-type of 'application/x-msdownload', a 'content-disposition' header indicating an attachment named 'asyncclient.exe', and the presence of 'cloudflare.com' in the HTTP response body, along with the 'MZ' header indicating a Windows executable.
This rule detects attempts to exploit a known authentication bypass vulnerability in Commvault via QCommand Argument Injection. The detection specifically looks for HTTP POST requests to the '/commandcenter/api/Login' endpoint with specific content in the request body, including '_localadmin__' and 'commserver', along with a PCRE match for '-cs' preceded by a space or URL-encoded space, indicating an attempt to inject arguments.
This rule detects an attempted Server-Side Request Forgery (SSRF) via External XML Entity (XXE) injection targeting Xerox FreeFlow Core. The detection is based on HTTP POST requests containing specific XML and entity declarations indicative of an XXE attack, followed by a SYSTEM entity referencing an HTTP URL, which is characteristic of an SSRF attempt.
ET WEB_SPECIFIC_APPS Guetebruck param.cgi group Parameter SQL Injection Attempt (CVE-2025-12463)
ET WEB_SPECIFIC_APPS IPFire ovpnclients.dat CONNECTION_NAME Parameter SQL Injection Attempt (CVE-2025-34304)
ET WEB_SPECIFIC_APPS Tenda SafeUrlFilter page Parameter Buffer Overflow Attempt (CVE-2025-12233)
ET WEB_SPECIFIC_APPS Tenda webExcptypemanFilter page Parameter Buffer Overflow Attempt (CVE-2025-12273)
ET WEB_SPECIFIC_APPS better-auth Unauthenticated API Key Creation (CVE-2025-61928)
Page 203 of 211