Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
4
2
1
Contributors
3
3
1
Categories
3
3
3
2
1
Platforms
3
3
1
1
1
Products / Services
2
2
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
2
Detects anomalous file modifications to web-accessible directories (such as index.html, dist, public, or wwwroot) by common JavaScript execution environments including node.exe, bun.exe, or npm. This activity is consistent with post-compromise tampering of web assets as observed in the Miasma/Hades campaign, likely involving the abuse of stolen repository credentials to deploy malicious content.
This rule detects attempts to upload web shells for website defacement. It specifically looks for HTTP POST requests where the URI contains the string "deface" (case-insensitive). This combination suggests an attacker is trying to modify a website's content, potentially by uploading a malicious script or file.
This rule detects attempts to deface a web server's homepage by replacing its content. It specifically looks for HTTP PUT requests targeting a URI containing "index" (case-insensitive), indicating an attempt to modify an index file. The rule also checks the size of the data being sent in the PUT request, looking for a size between 500 and 5000 bytes, which could indicate the insertion of defacement content.
Detects web defacement attempts via HTTP PUT requests to web server content files
KQL Query from file: External Attack Surface Monitoring KQL
KQL Query
KQL Query from file: Muddled Libra