Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
553 detections
Filters
Last updated
All Time
Detection languages
243
124
45
35
32
Contributors
124
91
63
58
25
Categories
233
201
170
131
113
Platforms
364
242
56
8
7
Products / Services
255
130
110
98
60
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
15
14
14
9
8
IDS Classtypes
30
5
IDS Protocols
35
This rule detects attempts to access a webshell that has been dropped into a keystore folder on an Oracle WebLogic server. The detection is based on the URI query containing '*/config/keystore/*.js*', which is indicative of an attacker trying to interact with a webshell placed in a specific directory often associated with the CVE-2018-2894 vulnerability.
Detects suspicious file types (such as web shells, scripts, or executables) being dropped by the IIS worker process (w3wp.exe) associated with Microsoft Exchange. This behavior is indicative of successful exploitation of Exchange vulnerabilities, often leading to the deployment of web shells for persistent access.
Detects suspicious activity where the MSExchangeMailboxReplication process writes .asp or .aspx files to disk. This behavior is often indicative of web shell deployment, potentially following an exploit like ProxyShell, to establish persistence or further access.
Detects attempts to export an Exchange mailbox to an unusual file path, specifically to a network share or a file with an .aspx extension, which could indicate an adversary attempting to place a webshell. It also detects the assignment of the 'Mailbox Import Export' role to a user, a prerequisite for performing mailbox exports.
Detects access attempts to the SUPERNOVA webshell, specifically looking for requests to 'logoimagehandler.ashx' with 'clazz' in the query string, or requests to 'logoimagehandler.ashx' resulting in a 500 HTTP status code. This activity is indicative of an adversary interacting with a deployed webshell.
This rule detects potential ReGeorg webshell activity by looking for specific query parameters in web server logs. It focuses on requests that contain 'cmd=read', 'connect&target', 'cmd=connect', 'cmd=disconnect', or 'cmd=forward' in the URI query string, combined with a null referrer and null user agent, and using the POST method. This combination of indicators is highly suspicious for webshell communication.
Detects possible successful exploitation of CVE-2021-26858 (ProxyLogon) by monitoring for the creation of non-standard files by the Exchange Server's Unified Messaging service (UMWorkerProcess.exe). This activity could indicate the dropping of web shells or other malicious content post-exploitation.
Detects access patterns indicative of the DEWMODE webshell, which was used in attacks exploiting Accellion FTA. The rule looks for specific query parameters ('?dwn=', '&fn=', '.html?' or '&dwn=', '?fn=', '.html?') within the URI query string, which are characteristic of how this webshell operates.
This rule detects suspicious Windows file path strings (e.g., 'C:/Users', 'C:/Windows', 'C:/Program Files') within the URI query component of web requests. The presence of such strings in a URI could indicate an attempt to exfiltrate data from a Windows system or communicate with a webshell that is attempting to access local files or directories. The rule looks for both standard and URL-encoded variations of these paths.
Detects attempts to exploit the Shellshock vulnerability (CVE-2014-6271) by looking for specific shellshock expressions in log files. These expressions are commonly used to inject and execute arbitrary commands.
This rule detects the creation of files with specific web-related extensions (.ashx, .asp, .ph, .soap) in common web server directories such as '\inetpub\wwwroot\', '\www\', '\htdocs\', or '\html\'. This activity is often indicative of an attacker uploading a web shell to maintain persistence or execute commands on the compromised web server.
This rule detects attempts to export an Exchange Certificate Signing Request (CSR) to an unusual directory or with an .aspx file extension. This activity is suspicious because it could indicate an adversary attempting to place a webshell on an Exchange web server for persistent access. The rule specifically looks for the PowerShell cmdlet 'New-ExchangeCertificate' with parameters '-GenerateRequest', '-BinaryEncoded', and '-RequestFile', combined with suspicious file paths like '\\localhost\C$', '\\127.0.0.1\C$', 'C:\inetpub', or the '.aspx' extension.
This rule detects attempts to modify the 'ExternalUrl' property of an Exchange OabVirtualDirectory to include script-related keywords. This activity can indicate an adversary attempting to establish persistence or execute malicious code by injecting a web shell or similar mechanism into the Exchange server's Outlook Web Access (OWA) configuration.
Detects the creation of suspicious web shell files (ASPX, ASP, ASHX) by the IIS worker process (w3wp.exe) in directories commonly associated with Microsoft Exchange or IIS web roots. This activity is indicative of potential exploitation of Exchange vulnerabilities, such as those used in the ProxyShell or ProxyNotShell attacks, to establish persistence via web shells.
Detects a program executing from common web server root folders such as 'wwwroot', 'wmpub', or 'htdocs'. This rule is designed to identify potential webshells, backdoors, or other malicious executables placed within web server directories for persistence or remote access. It filters out common legitimate executables found in 'bin', 'Tools', or 'SMSComponent' subdirectories, and processes spawned by 'services.exe' to reduce false positives.
Detects suspicious child processes spawned by the SQL Server process (sqlservr.exe). This activity is highly indicative of successful exploitation, such as Remote Code Execution (RCE) or SQL Injection, where an attacker leverages the SQL Server to execute arbitrary commands on the underlying operating system. The rule specifically looks for common system utilities and scripting interpreters that are often used by attackers for reconnaissance, persistence, or further compromise.
Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands. This activity is often associated with webshells attempting to understand the capabilities of the compromised server.
Detects shellshock expressions in log files
Detects suspicious Windows strings in URI which could indicate possible exfiltration or webshell communication
Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to place a webshell or the needed role assignment for it
Detects suspicious file type dropped by an Exchange component in IIS
Page 26 of 27