Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
216 detections
Filters
Last updated
All Time
Detection languages
63
55
53
15
9
Contributors
57
34
30
28
16
Categories
100
75
74
73
39
Platforms
126
94
59
5
4
Products / Services
10,650
9,755
6,688
4,418
3,745
MITRE Techniques
101
79
76
70
59
CVEs
6
5
5
5
4
IDS Classtypes
11
2
1
1
IDS Protocols
15
The following analytic identifies unusually long strings in the Content-Type HTTP header sent by the client to the server. It uses data from the Stream:HTTP source, specifically evaluating the length of the `cs_content_type` field. This activity is significant because excessively long Content-Type headers can indicate attempts to exploit vulnerabilities or evade detection mechanisms. If confirmed malicious, this behavior could allow attackers to execute code, manipulate data, or bypass security controls, potentially leading to unauthorized access or data breaches.
The following analytic identifies URL requests associated with CVE-2022-22965 (Spring4Shell) exploitation attempts, specifically targeting webshell access on a remote webserver. It detects HTTP GET requests with URLs containing ".jsp?cmd=" or "j&cmd=" patterns. This activity is significant as it indicates potential webshell deployment, which can lead to unauthorized remote command execution. If confirmed malicious, attackers could gain control over the webserver, execute arbitrary commands, and potentially escalate privileges, leading to severe data breaches and system compromise.
This analytic detects potential exploitation attempts against VMWare vRealize Network Insight, specifically targeting the CVE-2023-20887 vulnerability. It monitors web traffic for HTTP POST requests directed at the vulnerable endpoint "/saas./resttosaasservlet." Identifying this behavior is crucial for a SOC as it indicates an active exploit attempt. If confirmed malicious, the attacker could execute arbitrary code, leading to unauthorized access, data theft, or further network compromise.
This rule detects suspicious command-line activity originating from common web server processes, indicative of web shell usage for reconnaissance and system interaction. It looks for specific utilities and command-line arguments often used by attackers to discover system information, user accounts, network configurations, and execute arbitrary commands through a compromised web server.
Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system
Detects potential exploitation of CVE-2024-1212, an unauthenticated command injection vulnerability in Progress Kemp LoadMaster. The rule specifically looks for GET requests to the '/access/set' API with the parameters 'param=enableapi' and 'value=1', combined with an "Authorization" header containing a base64 encoded value with uncommon characters, indicative of an attempted exploit.
Detects exploitation attempts of CVE-2023-22518, an improper authorization vulnerability in Confluence Data Center and Server. Attackers can exploit vulnerable endpoints to create admin accounts or execute arbitrary commands. The rule specifically looks for POST requests to known vulnerable URIs associated with setup and restore functionalities.
Detects exploitation attempts targeting the VMware vCenter Server using the file upload vulnerability CVE-2021-22005. The rule specifically looks for POST requests to the '/analytics/telemetry/ph/api/hyper/send?' URI, which is indicative of an attempt to leverage this vulnerability for file upload.
This rule detects exploitation attempts against the Log4j RCE vulnerability, also known as Log4Shell (CVE-2021-44228). It looks for various JNDI (Java Naming and Directory Interface) lookup patterns, including LDAP, RMI, LDAPS, DNS, NIS, NDS, CORBA, and IIOP, as well as obfuscated forms of these patterns, which are commonly used to trigger the vulnerability. The rule specifically filters out known vulnerability scanning traffic from Nessus to reduce false positives.
This rule detects attempts to execute common Windows operating system commands via HTTP GET requests, which is a common characteristic of web shell activity. The rule specifically looks for URL-encoded versions of commands like 'whoami', 'net user', 'cmd /c', 'powershell', 'tasklist', 'wmic', 'ssh', 'python', 'ipconfig', 'wget', 'curl', 'certutil', 'copy \\', 'dsquery', and 'nltest'. These commands are often used by attackers to gain information about the compromised system, escalate privileges, or establish further persistence after deploying a web shell.
Detects exploitation attempts against the Log4j RCE vulnerability (CVE-2021-44228), commonly known as Log4Shell. The rule specifically looks for various JNDI injection patterns within web server log fields such as User-Agent, URI query, and Referer headers, which are common vectors for this vulnerability.
This rule detects suspicious sub-processes spawned by common web server processes on Linux systems. It specifically looks for web server processes (Apache, Nginx, Lighttpd, Node, Caddy, Tomcat, WebSphere) executing common system utilities and commands such as 'whoami', 'ifconfig', 'ip', 'uname', 'cat', 'crontab', 'hostname', 'iptables', 'netstat', 'pwd', and 'route'. This behavior is indicative of a web shell being used to execute commands on the compromised server.
Detects attempts to exploit Java-based web applications by identifying common payload strings often used in vulnerabilities like those affecting Confluence (CVE-2022-26134, CVE-2021-26084) and other Java deserialization or expression language injection flaws. The rule looks for specific patterns in web access logs that indicate the presence of Java code execution attempts, such as references to Java classes, runtime execution commands, and encoded characters often used in exploit payloads.
Detects Server-Side Template Injection (SSTI) attempts made via GET requests. The rule looks for common SSTI payload strings within the request, specifically excluding requests that result in a 404 Not Found status code to reduce false positives.
Detects exploitation attempts targeting the F5 BIG-IP vulnerability CVE-2020-5902. The rule looks for specific URI query patterns indicative of directory traversal within the '/tmui/' or '/hsqldb' paths, which are known to be vulnerable.
Detects the deletion of Apache Tomcat web server logs, which could indicate an adversary attempting to remove forensic evidence of their activities on the server. The rule specifically looks for deletion events targeting files within paths containing '\Tomcat\logs\' and filenames matching common Tomcat log patterns like 'catalina.', '_access_log.', or 'localhost.'.
This rule detects attempts to exploit CVE-2019-3398, a path traversal vulnerability in Confluence. The detection logic specifically looks for HTTP POST requests to '/upload.action' containing the path traversal sequence 'filename=../../../../'. This pattern indicates an attempt to upload a file to an arbitrary location on the server, which is characteristic of the CVE-2019-3398 exploitation.
Detects exploitation attempts against the Oracle WebLogic server vulnerability CVE-2021-2109. The rule specifically looks for GET requests containing 'com.bea.console.handles.JndiBindingHandle', 'ldap://', and 'AdminServer' in the URI query, which are indicators of an attempted JNDI injection via LDAP.
Detects exploitation attempts using the JNDI-Exploit-Kit by looking for specific URI patterns in web server logs. These patterns are indicative of various JNDI injection payloads designed to achieve remote code execution, reverse shells, or memory shell deployments on vulnerable applications like Tomcat, Jetty, Weblogic, JBoss, Websphere, and Spring.
Detects an authentication bypass vulnerability (CVE-2021-40539) affecting the REST API URLs in Zoho ManageEngine ADSelfService Plus. The rule specifically looks for requests to vulnerable endpoints that could be used to exploit this flaw.
Detects suspicious access to specific URLs associated with the exploitation of the ADSelfService Plus vulnerability CVE-2021-40539. Attackers have been observed targeting these URLs to exploit the vulnerability.
Page 10 of 11