Browse Rules

Search and filter across all detection sources

719 rules

sagan high other

[KISMET] Over-size SSID. Possible exploit attempt

[KISMET] Over-size SSID. Possible exploit attempt

sigma medium sigma

Path Traversal Exploitation Attempts

Detects path traversal exploitation attempts

sagan medium other

[ESET] Security vulnerability exploitation attempt

[ESET] Security vulnerability exploitation attempt

sagan medium other

[EXTRAHOP] Java Deserialization Exploit Attempt

[EXTRAHOP] Java Deserialization Exploit Attempt

sentinel high kql

Cynerio - Exploitation Attempt of IoT device

Exploitation Attempt of IoT device - Attack detection

sagan critical other

[CISCO-SECUREENDPOINT] Exploit attempt was detected

[CISCO-SECUREENDPOINT] Exploit attempt was detected

sagan critical other

[CISCO-SECUREENDPOINT] Exploit attempt was prevented

[CISCO-SECUREENDPOINT] Exploit attempt was prevented

sagan high other

[CITRIX-CORRELATED] Login after exploit attempt

[CITRIX-CORRELATED] Login after exploit attempt

sagan critical other

[COURIER-CORRELATED] Timeout after exploit attempt

[COURIER-CORRELATED] Timeout after exploit attempt

sagan medium other

[EXTRAHOP] [Multiple CVEs] Drupal Exploit Attempt

[EXTRAHOP] [Multiple CVEs] Drupal Exploit Attempt

sagan high other

[IMAPD-CORRELATED] Connection after exploit attempt

[IMAPD-CORRELATED] Connection after exploit attempt

sagan high other

[IMAPD-CORRELATED] Disconnect after exploit attempt

[IMAPD-CORRELATED] Disconnect after exploit attempt

sagan high other

[IMAPD-CORRELATED] Login after exploit attempt

[IMAPD-CORRELATED] Login after exploit attempt

sagan high other

[IMAPD-CORRELATED] Logout after exploit attempt

[IMAPD-CORRELATED] Logout after exploit attempt

sagan high other

[IMAPD-CORRELATED] Timeout after exploit attempt

[IMAPD-CORRELATED] Timeout after exploit attempt

sagan high other

[VSFTPD-CORRELATED] Authentication after exploit attempt

[VSFTPD-CORRELATED] Authentication after exploit attempt

sagan high other

[CISCO-CORRELATED] Console login after exploit attempt

[CISCO-CORRELATED] Console login after exploit attempt

sagan high other

[CISCO-CORRELATED] Login permitted after exploit attempt

[CISCO-CORRELATED] Login permitted after exploit attempt

sagan high other

[CISCO-CORRELATED] VPN login after exploit attempt

[CISCO-CORRELATED] VPN login after exploit attempt

sagan critical other

[CISCO-SCA] Suspected Zerologon RPC Exploit Attempt

[CISCO-SCA] Suspected Zerologon RPC Exploit Attempt

sagan informational other

[COURIER-CORRELATED] Logout/disconnect after exploit attempt

[COURIER-CORRELATED] Logout/disconnect after exploit attempt

sagan critical other

[COURIER-CORRELATED] User login after exploit attempt

[COURIER-CORRELATED] User login after exploit attempt

sagan medium other

[EXTRAHOP] CVE-2019-0708 RDP Exploit Attempt

[EXTRAHOP] CVE-2019-0708 RDP Exploit Attempt

sagan medium other

[EXTRAHOP] CVE-2019-10149 Exim Exploit Attempt

[EXTRAHOP] CVE-2019-10149 Exim Exploit Attempt

sagan medium other

[EXTRAHOP] CVE-2019-15846 Exim Exploit Attempt

[EXTRAHOP] CVE-2019-15846 Exim Exploit Attempt