Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9 detections
Filters
Last updated
All Time
Detection languages
6
1
1
1
Contributors
6
1
1
1
Categories
3
2
2
2
1
Platforms
8
Products / Services
8
6
3
1
1
MITRE Techniques
6
6
4
4
2
CVEs
71
71
64
58
49
IDS Classtypes
1
IDS Protocols
1
Detects HTTP requests targeting Microsoft Exchange servers that combine the autodiscover.json URI with PowerShell endpoint parameters, indicative of ProxyNotShell vulnerabilities exploitation (CVE-2022-41040 and CVE-2022-41082).
Detects instances where the Exchange Server IIS worker process (w3wp.exe) spawns unexpected child processes like PowerShell, pwsh, or cmd, often indicating exploitation of vulnerabilities such as ProxyNotShell (CVE-2022-41040 and CVE-2022-41082) where an attacker leverages Exchange backend processes for arbitrary command execution.
Detection rule generated by AI system
This rule detects process executions that exhibit patterns commonly associated with China Chopper-like tiny webshells, specifically when they are spawned by the w3wp.exe process (IIS worker process). The detection logic looks for specific command-line arguments that include common discovery and system information commands such as 'ipconfig', 'quser', 'whoami', 'c:', 'cd', 'dir', and echo commands, often used by webshells to interact with the compromised system.
Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells
Detects suspicious file types (such as web shells, scripts, or executables) being dropped by the IIS worker process (w3wp.exe) associated with Microsoft Exchange. This behavior is indicative of successful exploitation of Exchange vulnerabilities, often leading to the deployment of web shells for persistent access.
Detects the creation of suspicious web shell files (ASPX, ASP, ASHX) by the IIS worker process (w3wp.exe) in directories commonly associated with Microsoft Exchange or IIS web roots. This activity is indicative of potential exploitation of Exchange vulnerabilities, such as those used in the ProxyShell or ProxyNotShell attacks, to establish persistence via web shells.
Detects suspicious file type dropped by an Exchange component in IIS
Detects suspicious file type dropped by an Exchange component in IIS into a suspicious folder