Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,537 detections
Filters
Last updated
All Time
Detection languages
3,970
998
598
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,933
2,196
2,017
1,857
1,411
Platforms
39,941
7,266
6,537
3,866
3,647
Products / Services
4,107
2,418
1,587
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
This rule detects the presence of 'schtasks' followed by '/delete' and '/tn' (task name) in the HTTP response body with a 200 status code. This could indicate an attacker attempting to delete scheduled tasks on a compromised Windows system, potentially to remove forensic evidence or disrupt legitimate operations. The detection is case-insensitive and uses a PCRE to match the specific command structure.
This rule detects attempts to exploit CVE-2024-30043, a vulnerability in Microsoft SharePoint's SPXmlDataSource. The detection is based on the presence of specific content in HTTP response bodies, including '<!DOCTYPE', '<SharePoint:SPXmlDataSource', and 'DataFile="', combined with a PCRE regex matching file or SMB paths, indicating an attempt to fetch data via XML External Entity (XXE) injection.
This rule detects an attempted buffer overflow vulnerability (CVE-2025-9298) in Tenda routers. Specifically, it looks for HTTP POST requests to the '/goform/QuickIndex' URI where the 'PPPOEPassword' parameter contains an excessively long string (100 or more characters) that could lead to a buffer overflow.
This rule detects an attempt to exploit a buffer overflow vulnerability (CVE-2024-8573) in TOTOLINK devices. The exploit targets the `setParentalRules` function within the `/cgi-bin/cstecgi.cgi` endpoint, specifically looking for HTTP POST requests with multiple parameters (desc, week, sTime, eTime) containing excessively long values (100 or more characters), indicative of a buffer overflow attempt.
This rule detects attempts to exploit a critical authentication bypass vulnerability (CVE-2025-54309) in CrushFTP's WebInterface. The exploit leverages an alternative channel to bypass authentication, specifically targeting the '/WebInterface/function/' URI with a 'command=login' parameter and a 'crushadmin' string in the 'as2-to' HTTP header. Successful exploitation could lead to unauthorized administrative access.
ET MALWARE TA398 CurlBack_RAT CnC Activity - Fetch Commands M2
ET INFO Blockchain RPC Domain in TLS SNI (mainnet .infura .io)
ET ATTACK_RESPONSE Braodo Loader Inbound
ET ATTACK_RESPONSE KoiStealer Payload Inbound
ET ATTACK_RESPONSE TA399 Fake 404 WebPage Inbound
This rule detects attempts to exploit the Zip Slip vulnerability within TAR archives. Specifically, it looks for the sequence `../` (dot dot slash) in file paths within a TAR archive being transferred to a client, which is indicative of an attacker trying to write files outside of the intended directory.
This rule detects attempts to exploit the Zip Slip vulnerability in inbound ZIP archives. It specifically looks for the sequence '../' within the file data of a ZIP archive, which indicates an attempt to write files outside of the intended directory during extraction.
This rule detects HTTP responses (status code 200) that contain the string 'schtasks' followed by '/run' and '/tn' (case-insensitive) in the response body. This pattern indicates the potential for a client system to receive instructions to execute a scheduled task, which could be used for persistence, lateral movement, or other malicious activities.
ET ATTACK_RESPONSE ReverseLoader Base64 Encoded Executable In Image M2
ET ATTACK_RESPONSE ReverseLoader Base64 Encoded Executable In Image M1
ET ATTACK_RESPONSE Observed AsyncRat Installer Inbound
ET ATTACK_RESPONSE TA399 Fake 404 WebPage Inbound
Detects network connections to known Command and Control (C2) servers associated with the LANDFALL Android spyware. The spyware communicates over HTTPS, often on non-standard ports.
This rule detects attempts to exploit a command injection vulnerability (CVE-2025-57105) in D-Link devices. Specifically, it looks for HTTP GET requests to '/mng_platform.asp' where the 'addr' parameter contains characters commonly used for command injection, such as semicolons, newlines, backticks, pipes, or dollar signs, which could lead to arbitrary command execution on the device.
This rule detects an attempt to exploit a buffer overflow vulnerability (CVE-2025-9299) in Tenda routers. The exploit targets the `/goform/getMasterPassengerAnalyseData` endpoint via an HTTP POST request, specifically looking for an overly long 'time' parameter in the request body, which could lead to a buffer overflow.
Lumma Stealer Payload Inbound
Suricata
This rule detects the inbound transfer of a Lumma Stealer payload over HTTP. Specifically, it looks for a unique content string within the HTTP response body, indicating the download of a DLL file associated with Lumma Stealer. The content string 'filename="fuckingdllENCR.dll"' is a strong indicator of this specific malware.
Page 284 of 312