Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
553 detections
Filters
Last updated
All Time
Detection languages
243
124
45
35
32
Contributors
124
91
63
58
25
Categories
233
201
170
131
113
Platforms
364
242
56
8
7
Products / Services
255
130
110
98
60
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
15
14
14
9
8
IDS Classtypes
30
5
IDS Protocols
35
Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which could be a sign of ProxyShell exploitation
Detects the creation of files with certain extensions on a static web site. This can be indicative of potential uploads of a web shell.
Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.
Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be used to place a webshell
Rule to detect an adversary setting OabVirtualDirectory External URL property to a script in Exchange Management log
Detects suspicious file type dropped by an Exchange component in IIS into a suspicious folder
Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands
Page 27 of 27