Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,421 detections
Filters
Last updated
All Time
Detection languages
4,217
105
40
25
13
Contributors
1,327
1,003
725
627
332
Categories
2,253
2,239
1,434
1,144
973
Platforms
4,107
453
295
83
82
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
886
774
552
505
456
CVEs
18
12
12
12
10
IDS Classtypes
1,868
466
446
362
230
IDS Protocols
2,366
846
388
301
93
ET WEB_SPECIFIC_APPS Nagios Log Server Admin API Credential Disclosure (CVE-2025-44823)
ET WEB_SPECIFIC_APPS Brickcom camerainfo.cgi a Parameter Information Disclosure Attempt (CVE-2017-9238)
ET WEB_SPECIFIC_APPS Brickcom configfile.dump action Parameter Information Disclosure Attempt (CVE-2017-9238)
ET WEB_SPECIFIC_APPS OptiLink/GPON admin/formTracert target_addr Parameter Command Injection Attempt (CVE-2025-34049)
ET WEB_SPECIFIC_APPS TVT language Command Injection Attempt (CVE-2025-34036)
ET MALWARE TA398 CurlBack_RAT CnC Activity - Upload Results
ET INFO DYNAMIC_DNS HTTP Request to a *.freeddns .me domain
ET INFO DYNAMIC_DNS HTTP Request to a *.destroyerkisscover .com .br domain
ET INFO Observed Observed Commonly Actor Abused Online Service Domain (getenjoyment .net in TLS SNI)
ET EXPLOIT_KIT LandUpdate808 Domain (saeam .com) in TLS SNI
ET EXPLOIT_KIT LandUpdate808 Domain (dolmain .com) in TLS SNI
ET EXPLOIT_KIT LandUpdate808 Domain (forrbes .com) in TLS SNI
ET EXPLOIT_KIT ZPHP Domain in TLS SNI (dotauan .pro)
ET EXPLOIT_KIT ZPHP Domain in TLS SNI (polimakels .com)
This rule detects the presence of the PowerShell cmdlet 'Set-ScheduledTask' within the HTTP response body. This could indicate an attacker using a web-based mechanism to deliver or execute commands related to scheduled task creation or modification on a compromised system, potentially for persistence.
This rule detects the presence of the 'schtasks /query' command within the HTTP response body. This could indicate an attacker enumerating scheduled tasks on a compromised system, potentially as part of reconnaissance or lateral movement activities. The rule specifically looks for 'schtasks' and '/query' (case-insensitive) in HTTP responses with a 200 status code.
This rule detects the presence of the 'schtasks /create' command within the HTTP response body. This could indicate an adversary attempting to schedule tasks on a compromised system by delivering the command via an HTTP response, potentially for persistence or execution.
This rule detects HTTP traffic where the User-Agent string contains the case-insensitive substring 'iot'. This is often indicative of compromised IoT devices or botnet activity attempting to blend in or identify themselves.
This rule detects attempts to exploit a buffer overflow vulnerability in Tenda routers via the `/goform/exeCommand` endpoint. Specifically, it looks for HTTP POST requests to this URI where the `cmdinput` parameter contains an unusually long string (100 characters or more) which is indicative of an attempt to overflow a buffer.
This rule detects attempts to exploit a command injection vulnerability in the DCN ip_block.php script. It specifically looks for HTTP POST requests to '/function/audit/newstatistics/ip_block.php' with an 'ip' parameter in the request body that contains command injection characters such as semicolons, newlines, backticks, pipes, or dollar signs.
This rule detects attempts to exploit an authentication bypass vulnerability (CVE-2025-54253) in Adobe Experience Manager Forms. The detection is based on specific HTTP URI patterns and content within the request, including '/adminui/updateLicense1.do', 'login. ', and 'debug=command', which are indicative of an exploit attempt against the application.
Page 204 of 211