Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,537 detections
Filters
Last updated
All Time
Detection languages
3,970
998
598
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,933
2,196
2,017
1,857
1,411
Platforms
39,954
7,270
6,537
3,867
3,651
Products / Services
4,107
2,418
1,587
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
ET WEB_SPECIFIC_APPS Ilevia index.php error Parameter Cross Site Scripting Attempt
ET WEB_SPECIFIC_APPS ICTBroadcast Command Injection (CVE-2025-2611)
ET WEB_SPECIFIC_APPS Gladinet CentreStack and Triofox Local File Inclusion (CVE-2025-11371)
ET WEB_SPECIFIC_APPS Planet formPingCmd Multiple Parameters Command Injection Attempt (CVE-2025-54405, CVE-2025-54406)
ET WEB_SPECIFIC_APPS LILIN dvr_box Server Parameter Command Injection Attempt (CVE-2025-34132)
ET WEB_SPECIFIC_APPS Tenda SetIpMacBind Multiple Parameters Buffer Overflow Attempt (CVE-2025-9089, CVE-2025-1853, CVE-2024-40417, CVE-2023-41556, CVE-2023-40902, CVE-2023-40896)
ET WEB_SPECIFIC_APPS D-Link web_keyword.data Multiple Parameters Buffer Overflow Attempt
ET WEB_SPECIFIC_APPS D-Link wan_ping.data wan_ping Parameter Buffer Overflow Attempt
ET WEB_SPECIFIC_APPS D-Link jingx.data Multiple Parameters Buffer Overflow Attempt
ET WEB_SPECIFIC_APPS D-Link hictlist_show.data enable Parameter Buffer Overflow Attempt
ET WEB_SPECIFIC_APPS D-Link dns_more_check.data enable Parameter Buffer Overflow Attempt
ET WEB_SPECIFIC_APPS D-Link SetWLanRadioSecurity Multiple XML Tags Buffer Overflow Attempt (CVE-2023-44839, CVE-2022-46569)
ET WEB_SPECIFIC_APPS D-Link ipportFilter sip_address Parameter Buffer Overflow Attempt (CVE-2023-43240)
ET MALWARE TA569 Middleware Server Domain in TLS SNI (taskrunnersrvmod .com)
ET MALWARE Observed DNS Query to Malicious Domain (tamku .shoplerter .opnetorologies .net)
ET MALWARE Observed VBScript Payload Downloader Inbound
ET MALWARE MEOWBACKCONN CnC Checkin - Server Response
ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (plesk .breeconsulting .net)
ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (plesk .breeconsulting .net)
ET INFO Remote Monitoring and Management (RMM) Tool in TLS SNI (gorelo .tech)
ET INFO Blockchain RPC Domain in DNS Lookup (polygon-rpc .com)
Page 278 of 312