Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
1
1
Platforms
1
Products / Services
1
MITRE Techniques
18,116
15,636
12,584
8,394
6,225
IDS Classtypes
1
IDS Protocols
1
This rule detects attempts to manipulate application runtime memory via web shell activity. Specifically, it looks for HTTP requests where the URI content contains the string "WriteProcessMemory" (case-insensitive). This string is indicative of an attempt to use a function commonly associated with injecting code or modifying the memory of a running process, often a technique employed by web shells to achieve persistence or execute arbitrary code.
