Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
461 detections
Filters
Last updated
All Time
Detection languages
459
2
Contributors
132
104
86
64
24
Categories
408
390
281
37
35
Platforms
404
80
43
24
6
Products / Services
446
282
21
18
15
MITRE Techniques
320
196
58
43
30
CVEs
15
9
8
7
7
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
452
3
1
1
This rule detects attempts to query system language and locale information via a web shell. It specifically looks for HTTP requests where the URI contains the case-insensitive string "systeminfo". This activity is indicative of an attacker using a web shell to gather reconnaissance about the compromised system's configuration.
This rule detects HTTP requests that attempt to access the '.aws/credentials' file, which typically contains AWS access keys and secret keys. This indicates an attempt to discover or exfiltrate sensitive AWS credentials from a web server, potentially exposing cloud resources.
This rule detects attempts to exploit a Local File Inclusion (LFI) vulnerability to read the Windows Security Account Manager (SAM) database. It specifically looks for HTTP requests containing the string "\windows\system32\config\sam" in the URI, which is a common path for the SAM file on Windows systems. Successful exploitation of such a vulnerability could lead to the disclosure of hashed user credentials.
This rule detects attempts to upload a web shell, specifically targeting PHP files, by looking for HTTP POST requests to a .php URI that contain the string "eval(" in the file data. This combination suggests an attacker is trying to upload or execute malicious PHP code, often used for persistence or further compromise.
This rule detects HTTP web requests where the URI contains the string "/bin/sh" (case-insensitive). This pattern is often indicative of an attempt to execute a Unix shell command via a web application, which could be part of a command injection attack (ATT&CK T1059.004).
This rule detects HTTP requests where the URI contains the string "/var/log/" (case-insensitive). This pattern is indicative of an attempt to access system log files directly via a web server, which could be part of an information gathering or defense evasion tactic.
This rule detects HTTP PUT requests to a web server where the URI path ends with common web file extensions such as .html, .htm, .php, .asp, or .aspx. This behavior is suspicious as it could indicate an attempt at web defacement (T1491) by an attacker trying to modify web content directly on the server.
This rule detects attempts to drop a systemd timer unit file via a web shell. It specifically looks for HTTP POST requests (flow:to_server) containing both '.timer' and '[Timer]' in the client body, indicating the creation or modification of a systemd timer unit.
This rule detects attempts to execute AT commands via a web shell. It specifically looks for HTTP requests containing both 'at+' and 'cmd' in the URI, case-insensitively. This pattern is indicative of an attacker trying to run system commands through a compromised web application.
This rule detects attempts to abuse native Windows API functions, specifically 'NtCreateProcess', via web shell execution. It looks for HTTP requests where the URI content includes 'NtCreateProcess' in a case-insensitive manner, indicating a potential web shell trying to create a new process on the server.
This rule detects attempts to access directory listings on a web server via HTTP. It specifically looks for HTTP responses containing the string "Index of /" in the file data, which is a common indicator of an exposed directory listing. This exposure can allow attackers to discover sensitive files and directories on the server.
This rule detects HTTP web requests that contain the string "cmd.exe" in the URI, indicating an attempt to execute a command shell via a web request. This is often associated with web application attacks where an attacker tries to leverage a vulnerability to run system commands.
This rule detects attempts to manipulate application runtime memory via web shell activity. Specifically, it looks for HTTP requests where the URI content contains the string "WriteProcessMemory" (case-insensitive). This string is indicative of an attempt to use a function commonly associated with injecting code or modifying the memory of a running process, often a technique employed by web shells to achieve persistence or execute arbitrary code.
This rule detects attempts to discover the current user via a web shell by looking for HTTP requests containing the string "whoami" in the URI. This is a common command executed on compromised web servers to gain information about the user context of the web server process.
This rule detects attempts to discover password policy information by executing the 'net accounts' command via a web shell. The rule specifically looks for HTTP requests where the URI content contains 'net accounts' in a case-insensitive manner, indicating a potential web-based command execution to gather system information related to password policies.
This rule detects attempts to access SSH private key files (id_rsa, id_dsa, id_ecdsa, or .pem files) via HTTP. It specifically looks for these file extensions or names in the HTTP URI, indicating a potential exposure of sensitive SSH credentials on a web server.
This rule detects HTTP requests for the '.env' file, which often contains sensitive environment variables and credentials. An attacker successfully retrieving this file could gain access to critical system information, API keys, database credentials, and other secrets, leading to further compromise. The rule specifically looks for the string '/.env' in the HTTP URI, indicating an attempt to access this configuration file.
This rule detects attempts to access the AWS EC2 Instance Metadata Service (IMDS) by looking for HTTP requests containing the IP address '169.254.169.254' in the URI. This IP address is a well-known link-local address used by AWS instances to retrieve metadata. Such access attempts, especially when originating from an unexpected source or in an unusual context, can indicate a Server-Side Request Forgery (SSRF) vulnerability being exploited.
This rule detects attempts at Server-Side Template Injection (SSTI) by looking for specific patterns in HTTP URI requests. It triggers an alert if the URI contains sequences like `{{.*}}` or `${.*}`, which are commonly used in various template engines to inject and execute code.
This rule detects attempts to execute setuid binaries via a web shell by looking for the string "chmod+s" in HTTP URI requests. This indicates an attacker trying to set the SUID bit on a file, which is a common technique for privilege escalation on Linux/Unix systems.
This rule detects attempts at path traversal vulnerabilities by looking for the string "../../../" in HTTP URIs. This pattern is commonly used by attackers to navigate directory structures outside of the intended web root.
Page 17 of 22