Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12 detections
Filters
Last updated
All Time
Detection languages
7
2
1
1
1
Contributors
12
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
10
2
Products / Services
10
1
1
1
1
MITRE Techniques
10
3
3
1
1
CVEs
10
9
IDS Classtypes
7
IDS Protocols
7
Detects ClickFix-style clipboard/paste-and-run execution: PowerShell, PowerShell ISE, mshta, or cmd spawned from the Windows Run dialog (explorer.exe/RunMRU) with IEX/Invoke-Expression/DownloadString/FromBase64String or mshta HTTP(S) invocation, consistent with the UNC5142 ClickFix lure delivering the DeviceManager RAT.
Detects the IntelSoftwareUpdaterV8.exe installer masquerading as a legitimate updater, bundling Python 3.11 runtime and dropping to Microsoft-looking WindowsApps path used by UNC5142 DeviceManager RAT
Detects a rapid sequence of blind boolean SQL injection probes against the author_exclude parameter using ASCII/SUBSTRING syntax and the X-WP-Total header oracle (CVE-2026-60137).
Detects [embed] shortcode content submitted to WordPress that references invalid or anonymous local post IDs, used in the wp2shell chain to forge oEmbed cache database rows as a render-time write primitive.
Detects [embed] shortcode content submitted to WordPress that references invalid or anonymous local post IDs, used in the wp2shell chain to forge oEmbed cache database rows as a render-time write primitive.
Detects the WordPress REST API batch-route confusion technique (CVE-2026-63030) via a malformed nested sub-request path combined with the co-occurring parse_path_failed/block_cannot_read/rest_batch_not_allowed error marker pattern.
Detects SQL injection syntax smuggled into the author_exclude parameter via the WordPress REST API batch endpoint desync (CVE-2026-60137/CVE-2026-63030).
Detects UNION-based blind SQL injection against the WordPress REST posts item route exploiting the split_the_query bypass (CVE-2026-60137) to exfiltrate database contents.
Detects requests to WordPress plugin-install/upload or privileged user REST endpoints occurring shortly after anomalous WordPress REST API batch activity, consistent with post-exploitation follow-through in the wp2shell chain.
Detects unauthenticated POST requests to the WordPress REST API batch endpoint (/wp-json/batch/v1 or ?rest_route=/batch/v1) containing a nested requests array or an anomalous sub-request method pattern, the network entry point for the wp2shell CVE-2026-63030/CVE-2026-60137 exploit chain.
Detects [embed] shortcode content submitted to WordPress that references invalid or anonymous local post IDs, used in the wp2shell chain to forge oEmbed cache database rows as a render-time write primitive.
Detects HTTP requests to the WordPress REST API batch endpoint carrying User-Agent strings associated with public wp2shell exploitation tooling (wp2shell, cve-2026-63030/1.0, rezwp2shell).