Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,535 detections
Filters
Last updated
All Time
Detection languages
3,970
998
596
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,931
2,196
2,017
1,857
1,411
Platforms
39,931
7,261
6,535
3,864
3,642
Products / Services
4,107
2,418
1,585
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
This rule detects potential exploitation attempts of CVE-2023-23752, an improper access check vulnerability in Joomla's web service endpoints. The detection specifically looks for GET requests to the '/api/index.php/v1/' path with the 'public=true' query parameter, which is indicative of an attempt to bypass access controls.
This rule detects attempts to clear logging or archive history on Cisco network devices. Adversaries may clear command history or logging to remove forensic evidence of their activities, which is a common defense evasion technique.
Detects HTTP User-Agent strings that end with an equal sign, which can be an indicator of Base64 encoding. This technique is often used by malware to obfuscate C2 communications.
This rule detects exploitation attempts using the Pulse Connect Secure (PCS) vulnerability CVE-2021-22893. The detection logic looks for specific URI query patterns commonly associated with this exploit.
Detects suspicious access to specific URLs associated with the exploitation of the ADSelfService Plus vulnerability CVE-2021-40539. Attackers have been observed targeting these URLs to exploit the vulnerability.
Detects exploitation attempts of Sitecore Experience Platform Pre-Auth RCE CVE-2021-42237. This vulnerability allows for remote code execution without authentication. The rule specifically looks for POST requests to the '/sitecore/shell/ClientBin/Reporting/Report.ashx' endpoint that result in a 200 HTTP status code, indicating a successful interaction with the vulnerable component.
Detects URL patterns indicative of ProxyShell exploitation attempts against Microsoft Exchange servers. The rule looks for specific URI query strings and HTTP status codes (401) that are characteristic of both failed and successful exploitation attempts.
This rule detects potential Command and Control (C2) communication associated with the Goofy Guineapig backdoor. It specifically looks for HTTP/S requests originating from a user agent string characteristic of the malware ('Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36') communicating with the domain 'static.tcplog.com'. This combination of user agent and destination domain is indicative of Goofy Guineapig C2 activity.
Detects attempts to exploit the VMware Workspace ONE Access Authentication Bypass vulnerability (CVE-2022-31656). This vulnerability allows a malicious actor with network access to the UI to obtain administrative access without authentication by sending a specially crafted URI query.
This rule detects successful attempts to exploit the IIS shortname vulnerability, which allows enumeration of folders when IIS uses an old .Net Framework. The detection logic looks for HTTP GET or OPTIONS requests to URIs containing '~1' and ending with 'a.aspx', combined with successful HTTP status codes (200 or 301). This pattern is indicative of a successful fuzzing scan for the IIS shortname vulnerability.
This rule detects HTTP PUT requests where the User-Agent header contains 'WebDAV' and the destination IP address is not a private or loopback address. This activity could indicate an attempt to exfiltrate data to an external WebDAV share.
Cisco Discovery
Sigma
Find information about network devices that is not stored in config files
Detects suspicious DNS queries using base64 encoding
Cisco Collect Data
Sigma
Collect pertinent data from the configuration files
Detects strings used in command execution in DNS TXT Answer
Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.com/OTRF/detection-hackathon-apt29/
WebDav Put Request
Sigma
A General detection for WebDav user-agent being used to PUT files on a WebDav network share. This could be an indicator of exfiltration.
Transferring files with well-known filenames (sensitive files with credential data) using network shares
Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting
Detects suspicious DNS queries known from Cobalt Strike beacons
Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels.
Ensure that an encryption is used for all sensitive information in transit. Ensure that an encrypted channels is used for all administrative account access.
Ensure that an encryption is used for all sensitive information in transit. Ensure that an encrypted channels is used for all administrative account access.
Page 311 of 312