Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
553 detections
Filters
Last updated
All Time
Detection languages
243
124
45
35
32
Contributors
124
91
63
58
25
Categories
233
201
170
131
113
Platforms
364
242
56
8
7
Products / Services
255
130
110
98
60
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
CVEs
15
14
14
9
8
IDS Classtypes
30
5
IDS Protocols
35
Detects common commands used in Windows webshells
Detects HTTP POST requests to F5 BIG-IP management or shared endpoints that contain long, base64-encoded payloads. Threat actors may use this technique to upload webshells or stage data for exfiltration.
Detects the use of command-line download tools to write a file with a web-related extension to a common web server directory. This behavior is consistent with webshell deployment, as seen in Sandworm campaigns.
Detects multiple TTPs associated with the exploitation of SharePoint ToolShell vulnerabilities (e.g., CVE-2025-53770) by the threat actor Storm-2603. This includes the initial exploit attempt, webshell creation, defense evasion using a vulnerable driver, and C2 communication.
Detects the creation of files commonly associated with Godzilla-forked webshells, such as 'error.aspx', on a web server. Threat actors deploy these webshells for persistent access after exploiting vulnerabilities in web applications like IIS.
Detects suspicious child processes spawned by SAP NetWeaver that could indicate potential exploitation of a vulnerability, such as CVE-2025-31324, allowing arbitrary code execution via webshells. The rule specifically looks for common command-line interpreters and scripting engines being launched from SAP NetWeaver's application directories.
Detects the deployment or activity of the TOLLBOOTH IIS module. This is achieved by identifying the creation of its specific DLLs by the IIS worker process (w3wp.exe), or by detecting outbound C2 communication from the IIS worker process to known TOLLBOOTH infrastructure.
Detects unexpected command shell execution (cmd.exe) from w3wp.exe when tied to CentreStack's portal.config, indicating potential exploitation (e.g., CVE-2025-30406). This behavior is highly indicative of a web shell or similar remote code execution vulnerability being exploited on the CentreStack portal.
Detects attempts to exploit a Rejetto HTTP File Server (HFS) via CVE-2014-6287. The rule looks for specific patterns in the URI query that indicate an attempt to inject commands or save files, which are characteristic of this vulnerability. The presence of '?search=%00{.' combined with keywords like 'powershell', 'cmd.exe', 'cscript', 'wscript', 'python', or paths like 'C:\Users\Public\' suggests an exploitation attempt.
Detects the modification of common WordPress PHP files to include content characteristic of the UNC5142 CLEARSHORT infection chain. This activity is indicative of a compromised web server. This rule requires a File Integrity Monitoring (FIM) solution or EDR that can inspect the contents of modified files.
Detects the use of qoperation.exe with specific command-line arguments to write a JSP file to the webroot, indicating a webshell drop. This activity is associated with a post-authentication step related to CVE-2025-57790, which involves a path traversal vulnerability in Commvault.
Detects suspicious file writes to the root directory of web applications, specifically targeting Apache or Tomcat servers. This activity often indicates an attempt to deploy malicious files like web shells or other unauthorized scripts, potentially after exploiting a public-facing application.
The following analytic detects the creation of new ASPX files in the MOVEit Transfer application's "wwwroot" directory. It leverages endpoint data on process and filesystem activity to identify processes responsible for creating these files. This activity is significant as it may indicate exploitation of a critical zero-day vulnerability in MOVEit Transfer, used by threat actors to install malicious ASPX files. If confirmed malicious, this could lead to exfiltration of sensitive data, including user credentials and file metadata, posing a severe risk to the organization's security.
Detects attempts to exploit a SQL injection vulnerability (CVE-2025-57819) in FreePBX via a malicious GET request to '/admin/ajax.php'. Attackers leverage this to achieve remote code execution by inserting a malicious cron job.
Detects suspicious file writes to the root directory of web applications, particularly Apache web servers or Tomcat servers.
This may indicate an attempt to deploy malicious files such as web shells or other unauthorized scripts.
This may indicate an attempt to deploy malicious files such as web shells or other unauthorized scripts.
Detects components of the NET-STAR malware suite, including IIServerCore and AssemblyExecuter, used by the Chinese-nexus APT group Phantom Taurus.
Detects the execution of `cmd.exe` originating from common web server processes (w3wp.exe, httpd.exe, tomcat.exe) with command-line arguments indicative of a webshell. This rule specifically looks for `cmd.exe /c` invocations where the command is not one of the common benign commands used by web servers, aiming to catch malicious command execution through a webshell.
Detects the attempted creation of a file containing 'spinstall0' in specific SharePoint LAYOUTS directories. This activity is a strong indicator of an attempt to exploit the SharePoint Server vulnerability CVE-2025-53770, which could lead to webshell deployment.
Detects when a command-line interpreter (cmd.exe or powershell.exe) writes or modifies a file within a SharePoint \TEMPLATE\LAYOUTS directory. This activity is suspicious as it could indicate an attempt to deploy a web shell or other malicious code to gain persistent access or execute commands on the SharePoint server. The rule specifically excludes a known legitimate SharePoint automation script to reduce false positives.
Detects the creation of a file named 'spinstall0.aspx' within specific SharePoint LAYOUTS directories. This activity is a strong indicator of successful post-exploitation of the SharePoint Server vulnerability CVE-2025-53770, where an attacker has likely placed a web shell for persistent access.
Detects the IIS worker process (w3wp.exe) spawning suspicious child processes like command shells or reconnaissance tools. This is a common post-exploitation pattern observed after compromise of web applications, particularly Microsoft Exchange Server.
Page 21 of 27