Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
553 detections
Filters
Last updated
All Time
Detection languages
243
124
45
35
32
Contributors
124
91
63
58
25
Categories
233
201
170
131
113
Platforms
364
242
56
8
7
Products / Services
255
130
110
98
60
MITRE Techniques
18,108
15,617
12,573
8,385
6,207
CVEs
15
14
14
9
8
IDS Classtypes
30
5
IDS Protocols
35
This rule detects potential web shell activity on Windows IIS servers by monitoring for two suspicious behaviors: the w3wp.exe process spawning shell processes (cmd.exe or powershell.exe) and the creation or modification of .aspx files within common web root directories (\wwwroot\, \inetpub\). These are common indicators of web shell installation and subsequent remote command execution.
Detects the execution of the SQL Server command-line utility (osql.exe) with specific command-line arguments (-Q and -o), originating from web server (w3wp.exe) or command interpreter (cmd.exe) processes. This pattern is consistent with an adversary utilizing a web shell to perform database reconnaissance or exfiltration.
Identifies potential Neo-reGeorg webshell execution by correlating HTTP POST requests to Java Server Pages (.jsp/.jspx) with reflection events (defineClass) in system logs. This specific mechanism is utilized by Operation Escaneo (MexicanMafia) to load AES-encrypted, base64/BLV-encoded payloads in memory.
This rule identifies newly created PHP files within specific WordPress plugin folders ("woocommerce-subscription" or "woocommerce-notification") that have a rare SHA256 hash count (less than 5 occurrences in the enterprise). This behavior is indicative of web shells or backdoored plugin files, potentially introduced via a supply chain compromise.
Detects the creation, modification, or renaming of a JSP file within the 'PSEMHUB.war' directory. This activity can indicate the deployment of a web shell or other malicious code within the PeopleSoft PSEMHUB web application, often associated with server compromise.
Detects interaction with the WordPress Theme Editor utility immediately followed by a file modification to functions.php, indicative of the ErrTraffic deployment phase. This activity can be a sign of web shell deployment or other malicious code injection.
Maps the attack path where the IIS worker process (w3wp.exe) executes certutil to download a payload, followed immediately by sideloading a malicious DLL into a signed binary. This rule specifically looks for `w3wp.exe` initiating `certutil.exe` and then a subsequent image load event where a DLL (`mscoree.dll`, `mpclient.dll`, or `oci.dll`) is loaded by a process with a valid signature.
This rule detects a highly complex correlation where a web server process (w3wp.exe) drops a file named 'install-persistent.php' and then, within one hour, 'schtasks.exe' executes a command that includes 'install-persistent.php'. This pattern is indicative of a web shell being dropped and then scheduled for execution, potentially as part of a supply chain compromise.
Detects exploitation of vulnerable web-facing assets where the IIS worker process (w3wp.exe) spawns a command shell (cmd.exe or powershell.exe). This activity is indicative of a webshell being used to execute commands on the compromised server, specifically linked to Medusa initial access scripts by Storm-1175.
Detects files or processes matching SHA256 indicators published by Google Threat Intelligence Group for the INFINITERED campaign. The hashes cover the help.php persistence component, credential harvesters, backdoors, and droppers. A match should be treated as a high-confidence indicator of compromise and investigated immediately.
This rule monitors for suspicious activity related to Microsoft Exchange servers and potential DLL side-loading. It detects the creation of web shell files (.aspx, .ashx, .asmx) in Exchange-related directories, the execution of command shells (cmd, powershell) by the IIS worker process (w3wp.exe) within Exchange, and the side-loading of DLLs by specific signed binaries (dfsvc.exe, rasautou.exe) from non-standard directories.
Detects the deployment of the 'session-manager.php' MU-Plugin backdoor characteristic of the ErrTraffic 'Analytics' cluster on WordPress servers by monitoring file creation events in the 'wp-content/mu-plugins' directory for the specific filename 'session-manager.php'.
Detects interaction with specific web shell or remote code execution parameters ('developer_api1_fm', 'developer_api1_eval') associated with the self-hiding backdoor plugin dropped during the OptinMonster supply chain attack. This rule identifies HTTP requests containing these parameters, which are highly specific to the threat actor involved in the OptinMonster supply chain compromise.
Detects the creation of web shells (.aspx, .ashx) in the SmarterMail web root directory by the mail service process. This is a common persistence mechanism used by attackers after exploiting vulnerabilities like CVE-2026-24423 to maintain remote access.
This rule monitors file system events for the creation of files with common web shell names (e.g., shell.php, cmd.php) within known web server directory paths (e.g., wwwroot, inetpub). The detection of these specific file names in directories typically used for serving web content is a strong indicator of a potential web shell deployment.
Detects creation, modification, or renaming of 'help.php' within a REDCap application path. This activity is indicative of a web shell deployment, as observed by GTIG with UNC6508 using 'help.php' for persistence and payload uploads. The combination of the campaign-specific filename and REDCap path provides a high-confidence signal.
Detects REDCap-associated PHP or web server processes launching operating system command interpreters. GTIG observed INFINITERED using trojanised REDCap components and web shell functionality to execute arbitrary shell commands. This behaviour is highly unusual for normal REDCap operations and may indicate post-exploitation activity.
This rule correlates the modification of 'Upgrade.php' with subsequent changes to REDCap authentication, login, or hook-related PHP files on the same device within a 30-minute window. This activity is indicative of the INFINITERED threat actor's technique to intercept the REDCap upgrade process and reinject credential harvesting, backdoor, and persistence code into new software versions. Such a sequence should be compared with approved maintenance windows and expected deployment activity to identify malicious behavior.
Detects web server processes (IIS/Nginx) spawning native Windows or Linux shells (cmd.exe, sh), immediately followed by reconnaissance or download tool execution.
Detects web shell files written to web server directories
Detects web shell files written to web server directories
Page 18 of 27