Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
461 detections
Filters
Last updated
All Time
Detection languages
459
2
Contributors
132
104
86
64
24
Categories
408
390
281
37
35
Platforms
404
80
43
24
6
Products / Services
446
282
21
18
15
MITRE Techniques
320
196
58
43
30
CVEs
15
9
8
7
7
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
452
3
1
1
This rule detects attempts to upload web shell files to a server's application directory. It specifically looks for HTTP POST requests where the URI contains common web shell file extensions (php, asp, aspx, jsp, cfm) and the file data contains the string "eval(" (case-insensitive), which is a common function used in web shells for code execution.
This rule detects attempts to upload malicious web server modules, plugins, or components. It specifically looks for HTTP PUT requests to URIs containing '/modules/', '/plugins/', or '/components/' and checks the file data for the 'MZ' header, indicating an executable file (likely a Windows executable or DLL). This combination suggests an attacker is trying to upload a malicious executable to a web server's module/plugin directory for persistence or further compromise.
This rule detects attempts to exploit a Local File Inclusion (LFI) vulnerability to read the `/etc/passwd` file on a web server. It specifically looks for HTTP requests where the URI contains the string `/etc/passwd`.
This rule detects web directory brute-force attempts by identifying HTTP requests where the User-Agent header contains the string "DirBuster". DirBuster is a well-known tool used for brute-forcing directories and file names on web servers.
This rule detects web directory brute-force attempts by identifying the 'gobuster' string in the HTTP User-Agent header. Gobuster is a common tool used for directory and file enumeration on web servers, often as part of reconnaissance or vulnerability scanning activities. The rule specifically targets HTTP traffic flowing to the server.
Cron Job Injection via Web Shell
Suricata
This rule detects attempts to inject cron job commands via web shell activity. It specifically looks for HTTP requests where the URI contains the case-insensitive string "crontab", indicating an attempt to modify scheduled tasks on a system through a web interface, likely a compromised web shell.
This rule detects attempts to deface a web server's homepage by replacing its content. It specifically looks for HTTP PUT requests targeting a URI containing "index" (case-insensitive), indicating an attempt to modify an index file. The rule also checks the size of the data being sent in the PUT request, looking for a size between 500 and 5000 bytes, which could indicate the insertion of defacement content.
This rule detects attempts to deface web server content by using an HTTP PUT request to modify files with extensions such as .html, .htm, .php, .asp, or .aspx. It specifically looks for HTTP PUT methods targeting these file types on an internal web server.
This rule detects attempts to list active network connections using the 'netstat' command via a web shell. It specifically looks for HTTP requests where the URI contains the case-insensitive string 'netstat'. This activity is indicative of an attacker trying to gain reconnaissance on the compromised system's network connections.
This rule detects attempts to enumerate services on a system using the 'sc query' command, typically executed via a web shell. The detection is based on the presence of 'sc query' within the HTTP URI, indicating a command injection attempt through a web application.
This rule detects attempts to query the system time using the 'net time' command via a web shell. It specifically looks for the string 'net time' within the HTTP URI of traffic flowing to the server. This activity is indicative of an attacker using a web shell to gather information about the compromised system, specifically its time synchronization status or current time.
This rule detects attempts to read the '/etc/shadow' file via a web shell or similar web-based attack. The rule specifically looks for the string '/etc/shadow' within the HTTP URI, indicating an attempt to access this sensitive file through a web request. This is a common technique used by attackers to exfiltrate credentials after gaining initial access to a web server.
This rule detects attempts to gain credential access through web application exploits, specifically looking for HTTP URI requests that contain both 'UNION SELECT' (indicative of SQL injection) and 'password' (suggesting an attempt to extract credential-related information). The detection is case-insensitive.
This rule detects HTTP responses that contain hidden keywords, a technique often used in SEO poisoning. It specifically looks for HTML content with 'display:none' and 'font-size:0' which are common methods to hide text from users while still being parsed by search engine crawlers.
Exposed Git Repository Discovery
Suricata
This rule detects attempts to discover exposed Git repositories on a web server. It triggers when an HTTP request URI contains the string "/.git/", indicating a client is probing for the presence of a Git repository's internal structure. This is a common reconnaissance technique used by attackers to find sensitive information or source code.
IIS Native Module Upload Attempt
Suricata
This rule detects attempts to upload a DLL file to an 'modules' directory on an IIS web server using an HTTP PUT request. This activity is indicative of an adversary attempting to establish persistence by installing a malicious IIS native module.
This rule detects HTTP requests containing 'phpinfo' in the URI, which is commonly used for system information reconnaissance. This activity is associated with MITRE ATT&CK technique T1082 (System Information Discovery).
This rule detects attempts to deliver a setuid shell payload via a web shell. It specifically looks for HTTP requests containing both 'chmod' and '+s' (case-insensitive) in the URI, indicating an attempt to modify file permissions to set the setuid bit.
This rule detects attempts to query the Windows Registry via a web shell for system reconnaissance purposes. It specifically looks for HTTP requests containing the string "reg query" in the URI, indicating a command execution attempt to gather system information.
This rule detects attempts to enumerate local administrator groups via a web shell. It specifically looks for HTTP requests containing the string "net localgroup" in the URI, which is a common command used to list local groups on a Windows system. The detection is case-insensitive and targets established HTTP connections from any source to the home network.
This rule detects attempts to enumerate device drivers on a system via a web shell. It specifically looks for HTTP requests containing the string "driverquery" in the URI, which is a command-line utility on Windows systems used to display a list of installed device drivers and their properties. The detection is case-insensitive and targets established HTTP connections to the server.
Page 16 of 22