Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
60 detections
Filters
Last updated
All Time
Detection languages
33
9
4
4
4
Contributors
20
9
4
3
3
Categories
24
19
12
7
7
Platforms
31
23
9
4
1
Products / Services
11
10
5
5
5
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
1
1
1
1
IDS Classtypes
3
1
IDS Protocols
3
1
The following analytic identifies the execution of suspicious processes typically associated with WebShell activity on web servers.
It detects when processes like `cmd.exe`, `powershell.exe`, or `bash.exe` are spawned by web server processes such as `w3wp.exe` or `nginx.exe`.
This behavior is significant as it may indicate an adversary exploiting a web application vulnerability to install a WebShell, providing persistent access and command execution capabilities.
If confirmed malicious, this activity could allow attackers to maintain control over the compromised server, execute arbitrary commands, and potentially escalate privileges or exfiltrate sensitive data.
It detects when processes like `cmd.exe`, `powershell.exe`, or `bash.exe` are spawned by web server processes such as `w3wp.exe` or `nginx.exe`.
This behavior is significant as it may indicate an adversary exploiting a web application vulnerability to install a WebShell, providing persistent access and command execution capabilities.
If confirmed malicious, this activity could allow attackers to maintain control over the compromised server, execute arbitrary commands, and potentially escalate privileges or exfiltrate sensitive data.
Detects suspicious use of Node.js package managers running malicious lifecycle hooks, installing rogue dependencies, or invoking script execution during package installation.
Detects suspicious exploitation activity against NetScaler ADC/Gateway appliances, including requests to CGI, VPN, or authentication endpoints with command execution, webshell, or encoded payload behavior associated with CVE-2026-88771.
Correlates a running ProFTPD FTP server process listening on TCP port 21 with commands checking or loading the mod_copy module on the same Linux device using Microsoft Defender XDR telemetry.
Detects a potential webshell being executed on linux server. Follow process tree of shell commands.
Detects suspicious use of Node.js package managers running malicious lifecycle hooks, installing rogue dependencies, or invoking script execution during package installation.
Detects post-exploitation activities associated with FortiMail vulnerability CVE-2026-104286 (FG-IR-26-175). The rule identifies potential unauthorized persistence and data exfiltration, including the creation or modification of archive accounts with remote destinations, execution of 'migadmin' via root cron, and specific admin logout anomalies.
Detects a potential webshell being executed on linux server. Follow process tree of shell commands.
Detects post-exploitation activity against Ivanti ICS / Connect Secure
appliances on Windows hosts, where a script host (cmd.exe, powershell.exe, w3wp.exe)
drops a web shell (.aspx/.ashx/.asmx) into the appliance WebRoot or reaches into the
CredentialStore / system binaries. These behaviors are the hallmark of attackers
converting an authenticated file-write or SSRF into persistent remote code execution
and credential theft on edge devices.
appliances on Windows hosts, where a script host (cmd.exe, powershell.exe, w3wp.exe)
drops a web shell (.aspx/.ashx/.asmx) into the appliance WebRoot or reaches into the
CredentialStore / system binaries. These behaviors are the hallmark of attackers
converting an authenticated file-write or SSRF into persistent remote code execution
and credential theft on edge devices.
A Build Work Zone site was created or its content was modified
Detects attempts to modify the Redis configuration (dir or dbfilename) followed by a SAVE command, which can be leveraged to write arbitrary data to critical system files such as crontabs for persistence.
Detects execution of Node.js processes loading specifically named JavaScript files ('sharedLoad.min.js') within the 'node_modules/indexed-btree' directory, or file modifications involving these specific paths, which may indicate a malicious loader or supply chain compromise attempt.
Detects file removal, write, or rename operations performed by the Node.js process within the 'node_modules' directory, specifically targeting sensitive files like 'sharedLoad.min.js' or paths containing 'extended' or 'btree'. This behavior is indicative of potential malicious activity related to software supply chain compromise or unauthorized modification of dependencies within a Node.js application environment.
Detects potential web shell or malicious DLL deployment into Microsoft Exchange or IIS directories by the IIS worker process (w3wp.exe), as well as suspicious child process execution (such as command-line shells or credential discovery tools) spawned directly from IIS worker processes.
Detects reconnaissance commands (e.g., file listing, directory enumeration) executed as child processes of the JFrog Artifactory service. This behavior is often associated with the exploitation of Artifactory plugins or misconfigured endpoints that allow arbitrary code execution, enabling an attacker to perform discovery actions.
Detects the creation of a PostgreSQL replication slot using an unrecognized or potentially malicious logical decoding plugin. Adversaries may use custom or unauthorized plugins to exfiltrate database contents or intercept replication data streams, bypassing standard monitoring for common plugins like pgoutput or test_decoding.
This rule identifies a discrepancy between actual network connections processed by HAProxy and the corresponding entries in its server-side logs. Such inconsistencies can indicate the presence of a malicious backdoor compiled into or injected into the HAProxy process, designed to facilitate C2 traffic while evading standard monitoring by suppressing or omitting logging for those connections.
Detects reconnaissance commands (e.g., file listing, directory enumeration) executed as child processes of the JFrog Artifactory service. This behavior is often associated with the exploitation of Artifactory plugins or misconfigured endpoints that allow arbitrary code execution, enabling an attacker to perform discovery actions.
This rule detects potential exploitation or unauthorized interaction with an HAProxy service. It correlates process execution on Linux systems involving the HAProxy PID file with subsequent network traffic containing the suspicious string 'writeservice_info' within a one-hour window.
Detects reconnaissance commands (e.g., file listing, directory enumeration) executed as child processes of the JFrog Artifactory service. This behavior is often associated with the exploitation of Artifactory plugins or misconfigured endpoints that allow arbitrary code execution, enabling an attacker to perform discovery actions.
Detects reconnaissance commands (e.g., file listing, directory enumeration) executed as child processes of the JFrog Artifactory service. This behavior is often associated with the exploitation of Artifactory plugins or misconfigured endpoints that allow arbitrary code execution, enabling an attacker to perform discovery actions.
Page 1 of 3