Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,324 detections
Filters
Last updated
All Time
Detection languages
1,225
935
481
239
184
Contributors
626
512
469
337
261
Categories
20,437
11,828
5,871
5,150
4,864
3,324
Platforms
1,411
1,220
873
142
138
Products / Services
973
444
393
392
360
MITRE Techniques
1,525
1,085
885
593
540
CVEs
42
28
26
26
24
IDS Classtypes
390
220
127
40
26
IDS Protocols
671
150
30
18
12
Detects HTTP POST requests with multipart form data containing PHP session identifiers and PHP session upload progress parameters, indicative of an exploit attempt against a PHP application vulnerability (CVE-2026-109619).
This analytic detects suspicious PHP web application requests using Cisco Secure Firewall Threat Defense Intrusion Events.
The matching network signature identifies a serialized input pattern associated with attempts to exploit PHP request handling.
Investigate the source, targeted application, and related web server activity to determine whether the request was part of PHP2Shell exploitation.
The matching network signature identifies a serialized input pattern associated with attempts to exploit PHP request handling.
Investigate the source, targeted application, and related web server activity to determine whether the request was part of PHP2Shell exploitation.
Detects post-exploitation activity targeting PaperCut servers, including shells spawned by the PaperCut Java process or the creation of malicious files (such as .class files in lib/ or .txt webshells in custom/web/) by the Java application.
This analytic detects suspicious PHP web application upload activity using Cisco Secure Firewall Threat Defense Intrusion Events.
The matching network signature identifies a request pattern associated with attempts to exhaust server resources through PHP session handling.
Investigate the source, targeted application, and related web server activity to determine whether the request was part of PHP2Shell exploitation.
The matching network signature identifies a request pattern associated with attempts to exhaust server resources through PHP session handling.
Investigate the source, targeted application, and related web server activity to determine whether the request was part of PHP2Shell exploitation.
Detects suspicious post-exploitation activities, reconnaissance, and command execution originating from web server and PHP lineage processes, indicating potential webshell activity or compromised web applications.
Detects instances where the Apache web server spawns a shell process (sh, dash, bash) which subsequently executes common discovery or callback utilities (such as id, curl, wget, php, hostname, or uname), typically indicative of web application exploitation or remote code execution.
Detects potential SQL injection probing followed by a successful authentication response (HTTP 302) from the same external client IP within a short timeframe on IIS web servers.
This analytic detects multipart POST traffic with a serialized PHP structure in an uploaded filename, which may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity.
Suricata EVE's standard HTTP events do not expose multipart form field names, so this Suricata variant cannot confirm the PHP_SESSION_UPLOAD_PROGRESS field without additional request-body inspection.
Suricata EVE's standard HTTP events do not expose multipart form field names, so this Suricata variant cannot confirm the PHP_SESSION_UPLOAD_PROGRESS field without additional request-body inspection.
Inventories ConnectWise/SkyKick service principals in your tenant by app ID, vendor tenant ID (3f9cd7a0-127a-4ed4-bf06-2f830d5616b7) or name. Enabled apps need disabling first (disable, don’t delete, since deleting removes the consent). Disabled or deleted apps are contained but still need an audit of credentials and roles on other apps, because disabling doesn’t remove planted secrets. CanEscalateOrPlant shows apps holding app-only rights to add credentials or assign roles.
Detects observable consequences of remote code execution on a GitLab server (CVE-2026-97229), specifically where GitLab application services (such as Puma, Sidekiq, Ruby, GitLab Rails, or GitLab Workhorse) spawn a shell or interpreter with suspicious command-line parameters or external network utilities.
Correlates a CVE-2026-76504 encoded /%6a_security_check login POST with a follow-on /dataservice/admin/user request from the same client to the same vManage within 10 minutes. Summarized and sorted by follow-on count.
Detects suspicious post-exploitation activities, reconnaissance, and command execution originating from web server and PHP lineage processes, indicating potential webshell activity or compromised web applications.
Detects the execution of the public Horizon3.ai PoC exploit for CVE-2026-106173 (FortiSIEM gRPC path traversal RCE) utilizing python interpreters with specific command-line arguments indicative of the exploit tool.
Detects potential remote code execution against Xinference or Xoscar pool processes, identified by an inbound network connection accepted by a Python-based worker followed shortly by the spawning of a shell process (sh, bash, dash) by the same process.
Detects web server processes (Apache httpd, apache2, php-cgi, php-fpm) spawning a Unix shell (sh, bash, dash) that executes a wget or curl command piped directly into the shell for execution, indicative of potential remote code execution or web shell activity.
Detects multiple distinct source IPs sending forged 'pitboss PPE' authentication failure messages to NetScaler authentication endpoints within a short timeframe, associated with a fetch-based FreeBSD payload download (kw2-freebsd-x64-s11).
Detects HTTP requests containing serialized PHP objects in the Cookie header matching patterns associated with Zend Framework or Laminas gadget chains, characteristic of PHP object deserialization exploitation (e.g., PHPGGC style).
Detects potential local privilege escalation (LPE) attempts leveraging the afd.sys vulnerability by correlating LPEClient or FudModule artifact creation, image loads, or process execution with subsequent afd.sys driver loading or exploit guard blocking events within a 60-minute window.
Detects web server processes (such as apache2, nginx, httpd, php-fpm, or w3wp.exe) spawning shell interpreters (such as bash, sh, cmd.exe, or powershell.exe), which is a common indicator of web shell activity or application exploitation.
Detects web server worker processes (such as php-fpm, apache2, nginx, w3wp.exe) spawning download utilities like curl or wget, certutil with transfer flags, or initiating /dev/tcp network connections, which may indicate web application exploitation or webshell activity.
Correlates an inbound connection to a Python/Xoscar/Xinference pool process with an outbound connection from a shell spawned by that same pool process shortly afterward, potentially indicating exploitation and reverse shell activity.
Page 2 of 159