Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
189 detections
Filters
Last updated
All Time
Detection languages
95
36
19
18
10
Contributors
35
34
27
18
13
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
58
49
41
22
22
Products / Services
38
30
18
17
13
MITRE Techniques
90
44
34
28
25
CVEs
6
2
2
1
1
IDS Classtypes
14
8
6
3
1
IDS Protocols
20
9
4
1
Detects the upload of an ASPX web shell originating from a specific IP address (124.156.129.151) associated with the OP-512 threat group. The detection specifically looks for POST requests to .aspx endpoints with a user agent containing 'python-requests/2.33.0' in IIS logs.
This rule detects attempts to upload a web shell, specifically targeting PHP files, by looking for HTTP POST requests to a .php URI that contain the string "eval(" in the file data. This combination suggests an attacker is trying to upload or execute malicious PHP code, often used for persistence or further compromise.
This rule detects when an executable file (.exe) is copied to a share associated with a removable drive (indicated by 'USBSTOR') over the SMB protocol. This could indicate an attempt to transfer malicious executables to or from a removable device.
This rule detects HTTP PUT requests to known remote file hosting services (transfer.sh, file.io, gofile.io, anonfiles). This activity is indicative of payload staging, where an attacker uploads malicious files or tools to a remote server for later use in an attack, often as part of the resource development phase of the attack lifecycle.
This rule detects attempts to upload executable files (specifically Windows MZ executables) to common cloud storage services like Amazon S3, Google Cloud Storage, and Azure Blob Storage. It looks for HTTP PUT requests containing the 'MZ' magic bytes at the beginning of the file data, indicating a Windows executable, with a file size greater than 100KB, directed towards known cloud storage domains.
This rule detects the upload of a PNG image file over HTTP using a POST request. This could indicate an attacker exfiltrating screen captures, which aligns with MITRE ATT&CK technique T1113 (Screen Capture). The rule specifically looks for the HTTP POST method and the PNG file signature (89 50 4E 47) within the file data.
Box SaaS Suspicious File Upload
Cortex XDR
Detects suspicious file uploads to Box indicating potential data staging, tool upload, or exfiltration via shared folders. This rule specifically looks for the 'UPLOAD' operation within Box SaaS audit logs and extracts various file and user-related details.
This rule detects an attempt to exploit a path traversal vulnerability (CVE-2025-8088) in RAR files delivered via HTTP. The exploit leverages Alternate Data Streams (ADS) and specific path traversal patterns to potentially write files outside of the intended directory. The detection is based on the presence of 'STM' in the HTTP response body and a PCRE regex matching a specific path traversal pattern.
This rule detects attempts to exploit the Zip Slip vulnerability within TAR archives. Specifically, it looks for the sequence `../` (dot dot slash) within the file data of an inbound TAR archive, which indicates an attempt to write files outside of the intended directory during extraction. This is a common technique used in Zip Slip attacks to achieve directory traversal and potentially overwrite critical system files or place malicious files in arbitrary locations.
This rule detects the 'Zip Slip' vulnerability pattern within TAR archive uploads. Specifically, it looks for the sequence '../' (dot dot slash) in the file data of a TAR archive, which indicates an attempt to traverse directories and potentially write files outside the intended extraction directory. This is a common technique used in Zip Slip attacks to achieve arbitrary file write.
This rule detects attempts to exploit the Zip Slip vulnerability by identifying ZIP archive uploads containing directory traversal sequences ('../') within filenames. This technique allows attackers to write files outside the intended extraction directory, potentially leading to arbitrary file overwrite or remote code execution.
This rule detects the 'Zip Slip' vulnerability pattern within TAR archive uploads. Specifically, it looks for the sequence '../' (dot dot slash) in the file data of a TAR archive, which indicates an attempt to traverse directories and potentially write files outside the intended extraction directory. This is a common technique used in Zip Slip attacks to achieve arbitrary file write.
ET WEB_SPECIFIC_APPS Monsta FTP Arbitrary File Upload Attempt (CVE-2025-34299)
This rule detects attempts to exploit the Zip Slip vulnerability by identifying the sequence '../' within a ZIP archive being uploaded to a server. This pattern indicates an attempt to write files outside the intended directory, potentially leading to arbitrary file overwrite or remote code execution.
This rule detects attempts to exploit the Zip Slip vulnerability by identifying the sequence '../' within a ZIP archive being uploaded to a server. This pattern indicates an attempt to write files outside the intended directory, potentially leading to arbitrary file overwrite or remote code execution.
This rule detects attempts to exploit a vulnerability in Xerox FreeFlow Core (CVE-2025-8356) that allows for arbitrary file upload and directory traversal. The detection logic looks for HTTP POST requests with a specific content type ('multipart/related' and 'application/vnd.cip4-jmf+xml') and a 'Content-Disposition: attachment; filename="' header, combined with a PCRE regex matching directory traversal patterns (e.g., '../', '..\'). This indicates an attacker is trying to upload a malicious file or traverse directories on the server.
Detects the presence of SVG files containing obfuscated JavaScript and redirection logic. This technique is used by phishing campaigns, such as Tykit, to redirect victims to malicious sites.
The analytic detects the use of Windows Curl.exe to upload a file to a remote destination. It identifies command-line arguments such as `-T`, `--upload-file`, `-d`, `--data`, and `-F` in process execution logs. This activity is significant because adversaries may use Curl to exfiltrate data or upload malicious payloads. If confirmed malicious, this could lead to data breaches or further compromise of the system. Analysts should review parallel processes and network logs to determine if the upload was successful and isolate the endpoint if necessary.
This rule detects the upload of files to cloud storage services that are known to be used for data exfiltration or are associated with suspicious tunneling activities. It leverages a list of suspicious domains (LOTTunnels) to identify potentially malicious file uploads.
Detects PowerShell scripts leveraging the "Invoke-WebRequest" or "Invoke-RestMethod" cmdlets to send data using either the "PUT" or "POST" HTTP method. This behavior can indicate an attempt to exfiltrate data from the system.
KQL Query
Page 8 of 9