Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
1
1
1
Contributors
1
1
1
Categories
2
1
1
1
1
Platforms
1
1
1
Products / Services
1
1
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
This rule set looks for signs linked to the Shadow Campaigns espionage group. It flags the use of their loader, checks for connections to known servers they have used, spots fake security software used as bait, and highlights suspicious activity coming from web server processes that may indicate a hidden backdoor.
KQL Query from file: Fortigate Belsen Leak KQL Check
This rule detects potential ReGeorg webshell activity by looking for specific query parameters in web server logs. It focuses on requests that contain 'cmd=read', 'connect&target', 'cmd=connect', 'cmd=disconnect', or 'cmd=forward' in the URI query string, combined with a null referrer and null user agent, and using the POST method. This combination of indicators is highly suspicious for webshell communication.
