Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,421 detections
Filters
Last updated
All Time
Detection languages
4,217
105
40
25
13
Contributors
1,327
1,003
725
627
332
Categories
2,253
2,239
1,434
1,144
973
Platforms
4,107
453
295
83
82
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
886
774
552
505
456
CVEs
18
12
12
12
10
IDS Classtypes
1,868
466
446
362
230
IDS Protocols
2,366
846
388
301
93
ET ATTACK_RESPONSE Koi Loader/Stealer CnC Config Inbound
This rule detects the presence of the PowerShell cmdlet 'Enable-ScheduledTask' within the HTTP response body. This could indicate an attacker using a web server to deliver or instruct a client to enable a scheduled task, potentially for persistence or privilege escalation. The detection specifically looks for 'enable-scheduledtask' case-insensitively, optionally preceded by '-taskname' or '-taskpath', within a successful HTTP 200 OK response.
This rule detects the string "schtasks" followed by "/end" and then "/tn" within the HTTP response body. This pattern indicates that a client is receiving a response that contains a command to end a scheduled task using the `schtasks` utility. This could be part of a command-and-control communication or a lateral movement attempt where an adversary is managing scheduled tasks on a compromised system.
This rule detects the presence of 'schtasks' followed by '/delete' and '/tn' (task name) in the HTTP response body with a 200 status code. This could indicate an attacker attempting to delete scheduled tasks on a compromised Windows system, potentially to remove forensic evidence or disrupt legitimate operations. The detection is case-insensitive and uses a PCRE to match the specific command structure.
This rule detects attempts to exploit CVE-2024-30043, a vulnerability in Microsoft SharePoint's SPXmlDataSource. The detection is based on the presence of specific content in HTTP response bodies, including '<!DOCTYPE', '<SharePoint:SPXmlDataSource', and 'DataFile="', combined with a PCRE regex matching file or SMB paths, indicating an attempt to fetch data via XML External Entity (XXE) injection.
This rule detects an attempted buffer overflow vulnerability (CVE-2025-9298) in Tenda routers. Specifically, it looks for HTTP POST requests to the '/goform/QuickIndex' URI where the 'PPPOEPassword' parameter contains an excessively long string (100 or more characters) that could lead to a buffer overflow.
This rule detects an attempt to exploit a buffer overflow vulnerability (CVE-2024-8573) in TOTOLINK devices. The exploit targets the `setParentalRules` function within the `/cgi-bin/cstecgi.cgi` endpoint, specifically looking for HTTP POST requests with multiple parameters (desc, week, sTime, eTime) containing excessively long values (100 or more characters), indicative of a buffer overflow attempt.
This rule detects attempts to exploit a critical authentication bypass vulnerability (CVE-2025-54309) in CrushFTP's WebInterface. The exploit leverages an alternative channel to bypass authentication, specifically targeting the '/WebInterface/function/' URI with a 'command=login' parameter and a 'crushadmin' string in the 'as2-to' HTTP header. Successful exploitation could lead to unauthorized administrative access.
ET MALWARE TA398 CurlBack_RAT CnC Activity - Fetch Commands M2
ET INFO Blockchain RPC Domain in TLS SNI (mainnet .infura .io)
ET ATTACK_RESPONSE Braodo Loader Inbound
ET ATTACK_RESPONSE KoiStealer Payload Inbound
ET ATTACK_RESPONSE TA399 Fake 404 WebPage Inbound
This rule detects attempts to exploit the Zip Slip vulnerability within TAR archives. Specifically, it looks for the sequence `../` (dot dot slash) in file paths within a TAR archive being transferred to a client, which is indicative of an attacker trying to write files outside of the intended directory.
This rule detects attempts to exploit the Zip Slip vulnerability in inbound ZIP archives. It specifically looks for the sequence '../' within the file data of a ZIP archive, which indicates an attempt to write files outside of the intended directory during extraction.
This rule detects the presence of the PowerShell cmdlet 'Register-ScheduledTask' within an HTTP response body. This could indicate an attacker attempting to establish persistence on a compromised system by creating a scheduled task, potentially delivered via a web-based command and control channel or a malicious download.
This rule detects the presence of the PowerShell cmdlet 'New-ScheduledTask' and related parameters ('-action', '-trigger', '-taskname', '-settings') within the HTTP response body. This could indicate a system receiving instructions to create a scheduled task, potentially for persistence or execution of malicious code. The detection specifically looks for successful HTTP status code 200 responses.
This rule detects HTTP responses (status code 200) that contain the string 'schtasks' followed by '/run' and '/tn' (case-insensitive) in the response body. This pattern indicates the potential for a client system to receive instructions to execute a scheduled task, which could be used for persistence, lateral movement, or other malicious activities.
ET ATTACK_RESPONSE ReverseLoader Base64 Encoded Executable In Image M2
ET ATTACK_RESPONSE ReverseLoader Base64 Encoded Executable In Image M1
ET ATTACK_RESPONSE Observed AsyncRat Installer Inbound
Page 206 of 211