Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,052 detections
Filters
Last updated
All Time
Detection languages
463
288
122
64
50
Contributors
294
271
176
84
69
Categories
570
378
164
145
126
Platforms
991
73
50
37
21
Products / Services
10,670
9,758
6,693
4,421
3,749
1,052
MITRE Techniques
333
252
245
164
161
CVEs
13
12
12
12
10
Detects evidence of exploitation and post-exploitation activity related to CVE-2026-59310, an unauthenticated RCE vulnerability in the VMware vCenter Syslog Server. The rule monitors for suspicious child processes spawned by vmsyslogcollector, directory traversal patterns in command lines, and persistence mechanisms involving SSH authorized_keys modification, cron job creation, or systemd unit deployment on the VCSA shell.
Detects unauthorized process activity that reads, copies, archives, or transmits the NetScaler ns.conf configuration file. This file contains highly sensitive information, including AAA/LDAP bind credentials and certificates. Adversaries may stage or exfiltrate this file following the exploitation of vulnerabilities (such as CVE-2026-88771 or CVE-2026-88772) on NetScaler appliances to facilitate further network compromise.
This rule detects potential post-exploitation activity on a NetScaler appliance where a crontab modification occurs within a short window (1 hour) following suspicious syslog entries indicative of oversized-parameter buffer overflow exploitation attempts (CVE-2026-88771/CVE-2026-88772).
This rule detects potential command injection attacks targeting the Zimbra 'swatchdog' service, specifically involving the abuse of SNMP trap notifications (CVE-2026-73570). The attack works by injecting malicious shell metacharacters into the 'zimbra-MIB::zmServiceName' argument, which is processed by a Perl-invoked 'swatchdog' script. The rule monitors process execution events for shell commands spawned by the swatchdog utility that contain suspicious shell operators and the targeted MIB parameter.
This rule monitors NetScaler ADC/Gateway system logs for configuration modifications (save, add, or set commands) that occur outside of a designated maintenance window. Such activities, when performed off-hours, may indicate unauthorized persistence, defense evasion, or configuration tampering following successful exploitation.
This rule monitors Linux system authentication logs to identify potential unauthorized access attempts. It triggers when a single source IP initiates a high volume of failed SSH login attempts (brute force) or when a single user account is targeted by multiple distinct source IPs within a short time window (password spraying).
Detects outbound network connections from Citrix NetScaler appliances that exhibit high periodic regularity (beaconing behavior) towards rare external destinations. This pattern is indicative of potential command and control (C2) communication, possibly following the exploitation of vulnerabilities like CVE-2026-88771/88772.
Detects evidence of the SLAPSHOT backdoor on Citrix NetScaler appliances by identifying specific ephemeral IPC files (/tmp/.uxdport and /tmp/.uxdlock) or the associated python-based launcher process that uses base64-encoded arguments to initialize the proxy daemon.
This rule detects potential command injection attacks targeting the Zimbra 'swatchdog' service, specifically involving the abuse of SNMP trap notifications (CVE-2026-73570). The attack works by injecting malicious shell metacharacters into the 'zimbra-MIB::zmServiceName' argument, which is processed by a Perl-invoked 'swatchdog' script. The rule monitors process execution events for shell commands spawned by the swatchdog utility that contain suspicious shell operators and the targeted MIB parameter.
Detects potential misuse of SSH credentials by identifying successful SSH logins from source IP addresses that have not been observed in the previous 14 days, or successful SSH logins occurring within one hour of an authorized_keys file modification on the same host. This combination of behaviors is indicative of an adversary establishing or using persistence via SSH key manipulation.
Detects the use of standard Linux command-line utilities (e.g., cat, curl, vi) to read or reference sensitive cloud credential files or Kubernetes service account tokens. This behavior is a common indicator of credential theft or discovery activities following initial access to a Linux host.
Detects network connections or DNS resolutions to known anonymous file-sharing, cloud storage, and messaging-bot API endpoints (e.g., transfer.sh, Telegram Bot API, Discord CDN) commonly abused by adversaries for data staging and exfiltration. This rule specifically targets non-browser processes that attempt to communicate with these endpoints, helping identify potentially malicious exfiltration activities.
Detects command-line activity on a NetScaler appliance indicative of defense evasion by truncating, deleting, or disabling audit logs (ns.log) and syslog forwarding services. This activity often follows the exploitation of public-facing application vulnerabilities where an attacker seeks to hide their presence.
Detects the use of standard Linux command-line utilities (e.g., cat, curl, vi) to read or reference sensitive cloud credential files or Kubernetes service account tokens. This behavior is a common indicator of credential theft or discovery activities following initial access to a Linux host.
Detects execution of shell commands containing obfuscated patterns (such as base64 decoding, hex character sequences, or piped commands) when spawned by core Citrix NetScaler service processes (nsppe, httpd, or nsaaad). This behavior is often indicative of exploitation attempts or post-exploitation activities on network appliances.
Detects unauthorized access to or generation of Citrix NetScaler core dump files, trace outputs, or memory diagnostic artifacts. These artifacts are high-value targets for attackers, such as those exploiting CVE-2026-88772, who attempt to extract session tokens, credentials, and sensitive data residing in memory via these diagnostic mechanisms.
Detects command-line activity attempting to disable, unbind, or remove NetScaler AppFW (Web Application Firewall) profiles, signatures, or security policies. This activity is indicative of defense evasion following the exploitation of CVE-2026-88771 or CVE-2026-88772 to suppress security alerting on follow-on malicious activity.
Detects high volumes of DTLS/UDP session-initiation traffic targeting NetScaler VPN virtual servers that are immediately followed by appliance-level error logs or crashes. This behavior is indicative of active probing or exploitation attempts, such as those associated with CVE-2026-88772, where malicious payloads cause service instability.
Detects VMware ESXi shell activity associated with the ShinySp1d3r encryptor. This includes the termination of VM processes via esxcli or vim-cmd, the deletion of VM snapshots, and suspicious file renaming or encryption activity on datastores consistent with ransomware behaviors.
Detects command-line activity attempting to disable, unbind, or remove NetScaler AppFW (Web Application Firewall) profiles, signatures, or security policies. This activity is indicative of defense evasion following the exploitation of CVE-2026-88771 or CVE-2026-88772 to suppress security alerting on follow-on malicious activity.
Detects anomalous lateral movement behavior where a successful NetScaler VPN or gateway session is followed immediately by internal remote service logons (RDP, SSH, WinRM) or network connections from the same source IP. This pattern is indicative of potential exploitation of Citrix NetScaler vulnerabilities (e.g., CVE-2026-88771, CVE-2026-88772) or credential abuse to move laterally into the internal environment.
Page 4 of 51