Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
553 detections
Filters
Last updated
All Time
Detection languages
243
124
45
35
32
Contributors
124
91
63
58
25
Categories
233
201
170
131
113
Platforms
364
242
56
8
7
Products / Services
255
130
110
98
60
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
CVEs
15
14
14
9
8
IDS Classtypes
30
5
IDS Protocols
35
Detects the campaign-specific REDCAP-TOKEN cookie name in available endpoint or network event metadata. GTIG reported that INFINITERED used this HTTP cookie to receive encrypted commands and return system, database, and configuration information. This query depends on the cookie value being retained in AdditionalFields by the available sensor or integrated telemetry source.
Detects the China Chopper web shell spawning CMD from IIS (w3wp.exe) with suspicious command line patterns.
Detects the creation or modification of suspicious web-related script files (PHP, ASPX, JSP, SHTML) in common web server directories, excluding activities from legitimate web server processes. This rule aims to identify potential webshell deployment or other post-exploitation activities, specifically linked to APT28's targeting of Roundcube webmail servers.
Detects the execution of the 'whoami' command when its base64 encoded string ('d2hvYW1p') appears in a process command line. This pattern is often associated with web shells or other malicious activity attempting to gain system information.
This rule detects the creation of web shell files (ASPX, PHP, JSP) in common web server directories such as 'wwwroot', 'inetpub', or 'var\\www'. This activity is indicative of an adversary establishing persistent access to a web server.
Identifies web server processes dropping PHP files. This is a strong indicator of web shell persistence following a successful PHP object injection or remote code execution attack in WordPress environments.
Detects manipulation of running application data via web shell commands
This rule detects attempts to delete files on a web server using a web shell. It specifically looks for the 'unlink' command within HTTP URI requests, indicating a potential file deletion operation initiated through a compromised web application.
Detects access to credential files through web shell commands
Detects the upload of an ASPX web shell originating from a specific IP address (124.156.129.151) associated with the OP-512 threat group. The detection specifically looks for POST requests to .aspx endpoints with a user agent containing 'python-requests/2.33.0' in IIS logs.
This rule detects attempts to upload a web shell, specifically targeting PHP files, by looking for HTTP POST requests to a .php URI that contain the string "eval(" in the file data. This combination suggests an attacker is trying to upload or execute malicious PHP code, often used for persistence or further compromise.
Identifies the SHA-256 hash associated with the BLUEBEAM (Godzilla) web shell payload (LoadLibrary.dll) dropped during KnowledgeDeliver exploitation. This rule looks for the specific hash across file creation, image load, or process execution events.
This rule detects the presence of a common China Chopper web shell pattern in HTTP client body content. Specifically, it looks for the string "eval(base64_decode(" (case-insensitive) within HTTP requests flowing to the server. This pattern is characteristic of how China Chopper web shells execute commands on compromised web servers.
This rule detects potential web shell access by looking for HTTP requests to PHP files that contain a 'cmd=' parameter in the URI. This pattern is commonly used by web shells to execute commands on a compromised web server, aligning with MITRE ATT&CK technique T1505.003 for web shell persistence.
Detects an IIS worker process (w3wp.exe) spawning cmd.exe with a specific chain of reconnaissance commands (whoami, hostname, ipconfig). This behavior matches the default execution pattern of the 'hc2.aspx' and 'health_check_t.aspx' webshells observed in an Iranian-Nexus operation against Oman's government.
Identifies the creation of specific web shell filenames associated with SHADOW-EARTH-053 within targeted IIS and Exchange Web application directories. This rule detects the creation of known web shell files in critical web server paths, indicating an adversary's attempt to establish persistent access and remote control over the compromised server.
Suspicious IIS Worker Child Process
Cortex XDR
Detects the IIS worker process (w3wp.exe) spawning anomalous or administrative child processes (e.g., rundll32.exe, csvde.exe, nltest.exe), indicative of post-exploitation web shell activity associated with SHADOW-EARTH-053.
Detects the creation of specific webshell files (GW.class, payload.bin, or dpr_<8-hex-digits>.jsp) associated with CVE-2026-4681 weaponization on PTC Windchill and FlexPLM servers, or suspicious web requests containing patterns which could indicate exploitation attempts.
Detects SessionReaper webshell activity on Magento e-commerce platforms, including process execution from suspicious media directories.
This rule detects PolyShell webshell activity on Linux systems, specifically targeting Magento e-commerce platforms. It identifies processes executing from or targeting a suspicious media directory (`/var/www/prod/shared/pub/media/custom_options/quote/i/n/`) in conjunction with `curl` processes retrieving payloads from the `gsocket.io` C2 network. The detection logic combines indicators of webshell presence (execution from a specific directory) with C2 communication (curl to gsocket.io).
This rule detects files by their SHA256 hash that are known to be associated with the exploitation of CVE-2026-1731. This includes payloads such as SparkRAT, VShell, and various web shells and droppers.
Page 19 of 27