Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
2
Categories
1
1
1
Platforms
1
1
1
Products / Services
1
MITRE Techniques
1
1
1
1
CVEs
71
71
64
58
49
Detects HTTP requests attempting to access known vulnerable endpoints or submit potentially malicious serialized data payloads to specific vulnerable WordPress plugins identified in recent CVEs (CVE-2025-7697, CVE-2025-7384, CVE-2025-6464, CVE-2025-6742). This rule specifically looks for common PHP serialized object ('O:') or array ('a:') syntax indicators within the URI query string when targeting known vulnerable plugin paths.
Detects the arbitrary deletion of the critical WordPress configuration file (wp-config.php), which is a known impact of PHP object injection attacks (e.g., CVE-2025-7384) aiming to cause a denial of service.