Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
461 detections
Filters
Last updated
All Time
Detection languages
459
2
Contributors
132
104
86
64
24
Categories
408
390
281
37
35
Platforms
404
80
43
24
6
Products / Services
446
282
21
18
15
MITRE Techniques
320
196
58
43
30
CVEs
15
9
8
7
7
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
452
3
1
1
Detects common XSS attack patterns within HTTP URI requests, specifically monitoring for script tags or event handler attributes such as 'onerror' and 'onload' which are used to execute malicious JavaScript in a user's browser.
This rule detects attempts to perform directory traversal attacks by monitoring incoming HTTP requests for repetitive directory navigation sequences (e.g., ../, .., %2F, %5C). Such sequences are often used to bypass security controls and access unauthorized files or directories on the web server.
Detects inbound HTTP requests containing common Cross-Site Scripting (XSS) patterns, such as the <script> HTML tag or the 'javascript:' URI scheme, which are indicative of attempts to execute arbitrary client-side code.
This rule detects repeated path traversal sequences (../ or ..%2F) in the HTTP URI. This behavior is indicative of an attacker attempting to escape the intended web directory to access sensitive files or configuration files on the underlying filesystem.
This rule detects suspicious HTTP request bodies containing the 'LD_PRELOAD' environment variable assignment, targeting common temporary or writable directories. This behavior is indicative of an attempt to perform dynamic linker hijacking on a Linux system to inject malicious shared libraries into target processes.
This rule detects attempts to inject OLE (Object Linking and Embedding) objects into web requests, specifically looking for the keywords 'CLSID' and 'ProgID' within the HTTP client body. This technique can be used for inter-process communication and potentially lead to arbitrary code execution or other forms of attack.
This rule detects HTTP requests containing multiple common HTTP header names (X-Forwarded-For, X-Real-IP, X-Originating-IP) in the 'http.header_names' field. This pattern is often associated with attempts to bypass Web Application Firewalls (WAFs) or other security devices by injecting junk or spoofed headers to confuse or misdirect them.
This rule detects attempts to upload web shells for website defacement. It specifically looks for HTTP POST requests where the URI contains the string "deface" (case-insensitive). This combination suggests an attacker is trying to modify a website's content, potentially by uploading a malicious script or file.
This rule detects attempts to access sensitive credential-related files (e.g., configuration files, credential files, .env files, or files containing 'secret') via HTTP requests. This pattern is often associated with web shell activity where an attacker tries to exfiltrate sensitive information from a compromised web server.
This rule detects HTTP POST requests to a web server where the URI contains both 'plugin' and 'install' (case-insensitive). This combination of keywords in a POST request URI could indicate an attempt to install a malicious plugin on a web application.
This rule detects attempts to write or modify cron persistence entries via HTTP. Specifically, it looks for HTTP client body content containing the string "/etc/cron" (case-insensitive). This indicates a potential attacker trying to establish persistence on a Linux system by scheduling malicious tasks.
This rule detects attempts to modify web server files, specifically 'index.html' within a 'wwwroot' directory, over the Server Message Block (SMB) protocol. The detection is based on the presence of these strings in network traffic directed to port 445 (SMB) on the internal network. This activity could indicate an attacker attempting to deface a web server or inject malicious code.
This rule detects attempts to execute a system reboot command via a web shell. It specifically looks for the case-insensitive string "reboot" within the HTTP URI of established client-to-server HTTP traffic. This activity is indicative of an attacker who has gained control over a web server and is using a web shell to issue system-level commands, potentially to disrupt services or cover tracks.
This rule detects attempts to query the list of installed AntiVirus (AV) and Endpoint Detection and Response (EDR) products via a web shell. It specifically looks for HTTP requests containing 'wmic' and 'AntiVirus' in the URI, indicating an attempt to use Windows Management Instrumentation Command-line (WMIC) to enumerate security software.
This rule detects attempts to query software inventory using 'wmic product' via a web shell. It specifically looks for HTTP requests where the URI contains the string 'wmic product', indicating a potential command execution to enumerate installed software on a compromised system.
This rule detects character substitution obfuscation in web requests, specifically looking for three or more consecutive occurrences of URL-encoded characters that represent common path or null byte characters (e.g., '%5C' for '\', '%2F' for '/', '%00' for null, '%0A' for newline, '%0D' for carriage return). This pattern is often used by attackers to bypass security filters or to obscure malicious payloads in HTTP URIs.
This rule detects attempts to harvest private key files (with extensions like .key, .pem, .p12, .pfx, .pkcs12) via HTTP requests, often indicative of a web shell being used to exfiltrate sensitive cryptographic material from a compromised server. The detection is based on the URI of the HTTP request.
This rule detects attempts to delete files or directories using the 'rm -rf' command within a web request URI. This often indicates an attacker attempting to clean up traces of their activity or cause denial of service by removing critical files on a compromised web server.
This rule detects attempts to delete files on a web server using a web shell. It specifically looks for the 'unlink' command within HTTP URI requests, indicating a potential file deletion operation initiated through a compromised web application.
This rule detects attempts to enumerate USB devices on a system via a web shell. It specifically looks for HTTP URI requests containing 'wmic' and 'path Win32_USBHub', which are commands used to query USB device information using Windows Management Instrumentation (WMI). The 'nocase' modifier indicates that the content matching is case-insensitive.
This rule detects HTTP requests to a server that contain both 'password' and 'username' in the URI, case-insensitively. This pattern is indicative of a potential credential harvesting attempt where an attacker is trying to collect user credentials via a crafted web page or phishing site. The rule specifically looks for these keywords in the URI of an established HTTP connection flowing to the server.
Page 15 of 22