Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,537 detections
Filters
Last updated
All Time
Detection languages
3,970
998
598
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,933
2,196
2,017
1,857
1,411
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
4,107
2,418
1,587
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
ET INFO Blockchain RPC Domain in DNS Lookup (api .avax .network)
ET ATTACK_RESPONSE PowerShell String Base64 Encoded Invoke-RestMethod (dm9rZS1SZXN0TWV0) in DNS TXT Reponse
ET MALWARE Observed Win32/Lumma Stealer Related Domain (sanguen .courses) in TLS SNI
ET INFO Observed DNS Query to Actor Abused Online Service Domain (getenjoyment .net)
ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (saeam .com)
ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (edentista .com)
ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (dolmain .com)
ET EXPLOIT_KIT LandUpdate808 Domain (imf1 .com) in TLS SNI
ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (imf1 .com)
ET ATTACK_RESPONSE ClickFix Obfuscated Payload Inbound
ET ATTACK_RESPONSE PowerShell String Base64 Encoded Invoke-RestMethod (Zva2UtUmVzdE1ld) in DNS TXT Reponse
This rule detects the 'Zip Slip' vulnerability pattern within TAR archive uploads. Specifically, it looks for the sequence '../' (dot dot slash) in the file data of a TAR archive, which indicates an attempt to traverse directories and potentially write files outside the intended extraction directory. This is a common technique used in Zip Slip attacks to achieve arbitrary file write.
ET WEB_SPECIFIC_APPS Monsta FTP Server Side Request Forgery Attempt (CVE-2022-31827)
ET WEB_SPECIFIC_APPS Cacti links.php Multiple Parameters Cross Site Scripting Attempt (CVE-2024-43362, CVE-2024-43364)
ET WEB_SPECIFIC_APPS IPFire urlfilter.cgi QUOTA_USERS Parameter Cross Site Scripting Attempt (CVE-2025-34313)
ET WEB_SPECIFIC_APPS IPFire ids.cgi IGNORE_ENTRY_REMARK Parameter Cross Site Scripting Attempt (CVE-2025-34303)
ET WEB_SPECIFIC_APPS IPFire fwhosts.cgi COUNTRY_CODE Parameter Cross Site Scripting Attempt (CVE-2025-34301)
ET MALWARE TA569 Middleware Server Domain in TLS SNI (buildtoolsrvcore .com)
ET MALWARE TA569 Middleware Server Domain in DNS Lookup (parserapiprocess .com)
ET MALWARE TA569 Middleware Server Domain in DNS Lookup (buildtoolsrvcore .com)
ET INFO DYNAMIC_DNS Query to a *.3trust .com domain
Page 273 of 312