Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
553 detections
Filters
Last updated
All Time
Detection languages
243
124
45
35
32
Contributors
124
91
63
58
25
Categories
233
201
170
131
113
Platforms
364
242
56
8
7
Products / Services
255
130
110
98
60
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
15
14
14
9
8
IDS Classtypes
30
5
IDS Protocols
35
Detects the managed .NET IIS module variant of BadIIS, used in the 'Operation Rewrite' campaign for SEO poisoning and traffic redirection.
Detects the creation of a PHP web shell file named 'hafuab.php' in '/usr/local/webui/' by an 'echo' command, which includes PHP code to display 'test - Open source project (github.com/test/test)' and 'phpinfo()'. This activity is indicative of an attacker attempting to establish persistent access and gain information about the web server environment.
Detects the ASP.NET page handler (webshell) used in the 'Operation Rewrite' campaign for SEO poisoning and traffic redirection.
Detects the attempted creation of a file containing 'spinstall0' in specific SharePoint LAYOUTS directories. This activity is a strong indicator of an attempt to exploit the SharePoint Server vulnerability CVE-2025-53770.
This analytic identifies instances where a shell (PowerShell.exe or Cmd.exe) is spawned from W3WP.exe, the IIS worker process. This activity is significant as it may indicate webshell activity, often associated with exploitation attempts like those by the HAFNIUM Group on Exchange servers. If confirmed malicious, this behavior could allow attackers to execute arbitrary commands, potentially leading to system compromise, data exfiltration, or further lateral movement within the network.
This analytic identifies the execution of suspicious processes, such as `cmd.exe`, `powershell.exe`, or `bash.exe`, when they are spawned by web server processes like `w3wp.exe` or `nginx.exe`. This behavior is a strong indicator of WebShell activity, where an adversary exploits a web application vulnerability to gain persistent access and command execution capabilities on the web server. Successful exploitation could lead to arbitrary command execution, privilege escalation, and data exfiltration.
This analytic identifies the creation of suspicious .aspx or .ashx files in known drop locations for Exchange exploitation. Specifically, it targets paths associated with HAFNIUM group activity and vulnerabilities like ProxyShell and ProxyNotShell. This activity is a strong indicator of web shell deployment, a common method for persistent access and remote code execution. Successful exploitation could lead to unauthorized access, arbitrary command execution, and privilege escalation within the Exchange environment.
The following analytic identifies attempts to access the Remote ShellServlet on a web server, specifically targeting Confluence servers vulnerable to CVE-2023-22518 and CVE-2023-22515. It leverages web data to detect URLs containing "*plugins/servlet/com.jsos.shell/*" with a status code of 200. This activity is significant as it is commonly associated with web shells and other malicious behaviors, potentially leading to unauthorized command execution. If confirmed malicious, attackers could gain remote code execution capabilities, compromising the server and potentially the entire network.
The analytic detects the presence of the Supernova webshell, used in the SUNBURST attack, by identifying specific patterns in web URLs. The detection leverages Splunk to search for URLs containing "*logoimagehandler.ashx*codes*", "*logoimagehandler.ashx*clazz*", "*logoimagehandler.ashx*method*", and "*logoimagehandler.ashx*args*". This activity is significant as it indicates potential unauthorized access and arbitrary code execution on a compromised system. If confirmed malicious, this could lead to data theft, ransomware deployment, or other severe outcomes. Immediate steps include reviewing the web URLs, inspecting on-disk artifacts, and analyzing concurrent processes and network connections.
Detects on the execution arguments associated with cmd.exe invocations originating from an active ASP.NET webshell.
Detects the creation of a file containing 'spinstall0' in specific SharePoint LAYOUTS directories. This activity is a strong indicator of successful post-exploitation of the SharePoint Server vulnerability CVE-2025-53770, where an attacker has likely placed a web shell for persistent access.
Detects a command-line interpreter (cmd.exe or powershell.exe) writing a file to a SharePoint (\TEMPLATE\LAYOUTS) directory.
Detects potential exploitation of FortiWeb CVE-2025-25257, a pre-authentication SQL injection vulnerability. This rule identifies an SQL injection attempt against the '/api/fabric/device/status' endpoint, followed by either a suspicious Python file drop in a library directory or a request to a specific CGI script used to trigger the payload.
Detects the creation of specific ASPX web shells in the SharePoint LAYOUTS directory, a TTP associated with the exploitation of the 'ToolShell' vulnerabilities (e.g., CVE-2025-49706, CVE-2025-53770).
Detects suspicious IIS native-code module installations via command line
This rule detects the creation or modification of ASPX/ASP files within specific SharePoint web server directories on devices identified as vulnerable to CVE-2025-49706 or CVE-2025-53770. It leverages vulnerability management data to narrow down the scope to only vulnerable SharePoint servers, then monitors file events in common SharePoint LAYOUTS paths for web shell indicators. The rule also uses file profiling to identify potentially novel or malicious ASPX/ASP files that lack Defender visibility.
No description available.
Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation. This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.
No description available.
Detects the creation of the "spinstall0.aspx" web shell in a SharePoint server directory, which is a known post-exploitation indicator for the SharePoint vulnerability CVE-2025-53770.
This rule detects the execution of common command and scripting interpreters (cmd.exe, cscript.exe, powershell.exe, pwsh.exe, powershell_ise.exe, wmic.exe, wscript.exe) when their parent process is either w3wp.exe or svchost.exe, and the command arguments contain keywords related to SharePoint. This behavior can indicate suspicious activity within a SharePoint environment, potentially related to web shell execution, privilege escalation, or data exfiltration.
Page 22 of 27