Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,537 detections
Filters
Last updated
All Time
Detection languages
3,970
998
598
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,933
2,196
2,017
1,857
1,411
Platforms
39,949
7,270
6,537
3,866
3,651
Products / Services
4,107
2,418
1,587
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
ET INFO Blockchain RPC Domain in DNS Lookup (mainnet .optimism .io)
ET INFO Blockchain RPC Domain in TLS SNI (cloudflare-eth .com)
ET INFO Blockchain RPC Domain in DNS Lookup (cloudflare-eth .com)
ET INFO Observed Commonly Actor Abused Cloud Hosting Service Domain (caspio .com in TLS SNI)
ET INFO Observed Commonly Actor Abused Cloud Hosting Service Domain (vercel .app in TLS SNI)
ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (guiasexo .com)
ET ATTACK_RESPONSE Lumma Stealer Payload Inbound
ET ATTACK_RESPONSE Observed ClickFix Landing Page Inbound
ET ATTACK_RESPONSE ClickFix CnC Response (Click Logged Successfully)
ET ATTACK_RESPONSE Unknown Payload Downloader Inbound
ET ATTACK_RESPONSE Observed ClickFix Powershell Delivery Page (Portuguese)
This rule detects attempts to exploit multiple command injection vulnerabilities (CVE-2025-9149, CVE-2025-10958, CVE-2025-10960, CVE-2025-10961) in Wavlink wireless.cgi. The detection is based on HTTP POST requests to '/cgi-bin/wireless.cgi' with specific parameters ('Guest_ssid', 'macAddr', or 'delete_list') followed by command injection characters such as semicolon, newline, or backtick.
This rule detects HTTP traffic where the User-Agent string contains the case-insensitive substring 'iot'. This could indicate activity from Internet of Things (IoT) devices, potentially malicious botnet activity, or other suspicious automated traffic originating from or targeting IoT devices.
ET WEB_SPECIFIC_APPS IPFire dns.cgi TLS_HOSTNAME Parameter Cross Site Scripting Attempt (CVE-2025-34317)
ET WEB_SPECIFIC_APPS IPFire dnsforward.cgi REMARK Parameter Cross Site Scripting Attempt (CVE-2025-34305)
ET WEB_SPECIFIC_APPS IPFire weakeonlan.cgi CLIENT_COMMENT Parameter Cross Site Scripting Attempt (CVE-2025-34305)
ET WEB_SPECIFIC_APPS Tenda SafeClientFilter page Parameter Buffer Overflow Attempt (CVE-2025-12232)
ET WEB_SPECIFIC_APPS Tenda SetIpBind page Parameter Buffer Overflow Attempt (CVE-2025-12235)
ET WEB_SPECIFIC_APPS Draytek recvCMD Command Injection Attempt (CVE-2024-41585)
ET WEB_SPECIFIC_APPS Ilevia mbus_build_from_csv.php Multiple Parameters Command Injection Attempt (CVE-2025-34513)
ET WEB_SPECIFIC_APPS Brickcom syslog.dump action Parameter Information Disclosure Attempt (CVE-2017-9238)
Page 279 of 312