Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
17 detections
Filters
Last updated
All Time
Detection languages
6
5
2
1
1
Contributors
4
4
2
1
1
Categories
7
6
5
5
4
Platforms
10
6
3
1
Products / Services
6
3
3
2
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
2
1
IDS Classtypes
1
IDS Protocols
1
Detects attempts to restore or extract files containing path traversal characters ('../' or '..\') commonly associated with the ZipSlip vulnerability. This technique was utilized in Operation Escaneo (via the mkzip34.py tool) to deploy webshells automatically upon legitimate archive restoration. The rule specifically looks for file creation or modification events where the initiating process is a common archive extraction tool (unzip, tar) or a Java application server (java, tomcat), the file extension is for a Java web application (.jsp, .jspx), and the resulting folder path contains path traversal sequences.
This rule detects communication patterns indicative of the ErrTraffic webshell by searching for specific parameters ('wp_debug_session=' and 'mode=php') within web server URI/URL fields. The presence of these parameters suggests an active webshell connection, likely used for remote access and command execution on a compromised web server.
Linux Interpreter with Command Execution
Cortex XDR
Detects the execution of PHP, Perl, or Ruby script interpreters on Linux systems when they are invoked with command-line arguments that suggest direct execution of code, especially when combined with commands or functions commonly used for remote code execution or data exfiltration. This rule aims to identify potential web shell activity or other forms of arbitrary command execution.
This rule detects the execution of known webshells such as Behinder, Neo-reGeorg, Godzilla, or reGeorg. The detection is specifically triggered when these webshells are found in the command line of a process whose parent process is a common web server application like w3wp.exe (IIS), httpd.exe (Apache), nginx.exe (Nginx), or java.exe (often used for Java-based web servers like Tomcat). This indicates potential webshell deployment and execution on a web server, which is a critical indicator of compromise, often associated with initial access or persistence by attackers.
This rule detects HTTP requests to the '.well-known/' directory that include common webshell file extensions (php, cfm, cgi, asp, aspx, jsp, rb, sh, py, pl). This activity is suspicious as the '.well-known/' directory is typically used for standardized metadata files (e.g., for ACME challenges, security.txt) and not for executable scripts. The rule specifically excludes requests from 'Let's Encrypt validation server' to reduce false positives.
Detects suspicious child processes spawned by SAP NetWeaver on Linux systems that could indicate potential exploitation of a vulnerability that allows arbitrary execution via webshells, such as CVE-2025-31324. The rule looks for common shell interpreters, scripting languages, and network utilities being executed from specific SAP NetWeaver directories.
Detects malicious ASP.NET webshell activity associated with the CL0P Ransomware Gang exploiting CVE-2023-34362. The rule looks for specific HTTP headers used by the webshell, indicators of Azure Blob Storage interaction, or SQL injection attempts.
Detects the creation of suspicious files (jsp, java, class) in specific SAP NetWeaver directories. This activity may indicate an attempt to establish a webshell or exploit vulnerabilities, such as CVE-2025-31324, to gain persistent access or execute arbitrary code within the SAP environment.
Detects command execution characteristic of the AntSword web shell's virtual terminal feature. This is identified by a web server process spawning a child process with a specific command-line structure, often involving `cmd.exe` and echoing unique start and end tags (`stag`/`etag`).
Detects the PHP file handler variant of BadIIS, used in the 'Operation Rewrite' campaign for SEO poisoning and traffic redirection.
Detects the creation of `spinstall0.aspx`, a known indicator of successful post-exploitation of the SharePoint vulnerability CVE-2025-53770.
This query was originally published in the threat analytics report, Sysrv botnet evolution.
Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptocurrency.
The following query finds instances of remote code execution on a vulnerable Linux server.
Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptocurrency.
The following query finds instances of remote code execution on a vulnerable Linux server.
'This query looks for messages related to file downloads of suspicious file types on an Exchange Server. This could indicate attempted deployment of webshells.
This query uses the Exchange HttpProxy AOBGeneratorLog, you will need to onboard this log as a custom log under the table http_proxy_oab_CL before using this query.
This log is commonly found at C:\Program Files\Microsoft\Exchange Server\V15\Logging\OABGeneratorLog on the Exchange server. Details on collecting custom logs into Sentinel
can be found here: https://learn.microsoft.com/azure/sentinel/connect-custom-logs
This query uses the Exchange HttpProxy AOBGeneratorLog, you will need to onboard this log as a custom log under the table http_proxy_oab_CL before using this query.
This log is commonly found at C:\Program Files\Microsoft\Exchange Server\V15\Logging\OABGeneratorLog on the Exchange server. Details on collecting custom logs into Sentinel
can be found here: https://learn.microsoft.com/azure/sentinel/connect-custom-logs
'This query looks for Microsoft Defender AV detections related to Europium actor.
In Microsoft Sentinel the SecurityAlerts table includes only the Device Name of the affected device, this query joins the DeviceInfo table to clearly connect other information such as Device group, ip, etc. This would allow the Microsoft Sentinel analyst to have more context related to the alert, if available.
Reference: https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government '
In Microsoft Sentinel the SecurityAlerts table includes only the Device Name of the affected device, this query joins the DeviceInfo table to clearly connect other information such as Device group, ip, etc. This would allow the Microsoft Sentinel analyst to have more context related to the alert, if available.
Reference: https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government '
'This query looks for messages related to file downloads of suspicious file types. This query uses the Exchange HttpProxy AOBGeneratorLog, you will need to onboard this log as a custom log under the table http_proxy_oab_CL before using this query.
Reference: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/'
Reference: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/'
This rule detects relevant ClamAV messages indicating the presence of various types of malware. It specifically looks for keywords like 'Trojan*FOUND', 'VirTool*FOUND', 'Webshell*FOUND', 'Rootkit*FOUND', and 'Htran*FOUND' in ClamAV logs. These keywords suggest that ClamAV has identified and reported a malicious file or component.
Detects the use of the "appcmd.exe" utility to create or modify global URL rewrite rules within Internet Information Services (IIS). This activity is suspicious because threat actors have been observed leveraging this method to establish persistence or facilitate access to webshells by redirecting traffic or enabling specific paths.