Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
599 detections
Filters
Last updated
All Time
Detection languages
198
163
131
22
20
Contributors
127
91
73
69
62
Categories
331
304
132
129
59
Platforms
340
214
204
30
27
Products / Services
10,665
9,773
6,705
4,421
3,749
599
MITRE Techniques
293
211
151
137
110
CVEs
23
23
10
6
6
IDS Classtypes
13
1
1
1
IDS Protocols
16
This rule detects Server-Side Request Forgery (SSRF) attempts by monitoring for URL parameters containing malicious path injections. Specifically, it looks for sequences typical of differential parsing vulnerabilities where an attacker attempts to access sensitive local files (e.g., /proc/self/environ, /var/task/) or internal cloud metadata services (metadata.google.internal) by manipulating a 'url' parameter, often combined with attempts to bypass path validation using double-slash formatting.
This rule detects potentially suspicious modifications to Nginx configuration files or the usage of FastCGI directives such as fcgiwrap, fastcgi_pass, and proxy_pass. It specifically monitors for actions related to configuration changes (write, modify, create) or the establishment of backend communication via FastCGI parameters, which may indicate an attempt to gain remote code execution or persistence on a web server.
This rule detects common web application processes (such as nginx, python, node, etc.) accessing the /proc/[pid]/environ file, which contains environment variables that may include sensitive information like credentials or configuration secrets. The rule correlates this access with subsequent external network connections initiated by the same process, which is highly indicative of data exfiltration after sensitive information has been retrieved.
This rule detects instances where common web server processes (e.g., httpd, nginx) or system utility services (e.g., sshd, crond, dropbear) spawn shell processes like bash, sh, or ash. This activity is a classic indicator of potential remote command execution (RCE) via web application exploits or the abuse of legitimate system services to run arbitrary commands.
Detects web traffic where the referrer header contains keywords associated with gaming or educational themes (such as 'bioshock', 'game', 'puzzle', 'math', 'quiz') combined with access attempts to sensitive URI paths (like '/code', '/token', '/secret', '/private', '/api-key') resulting in a redirect status (301-308). This behavior pattern is often indicative of automated reconnaissance or exploitation attempts using non-standard or obfuscated referrers to bypass simple security filters.
Detects unauthorized attempts to escalate privileges within the MyBB Administrative Control Panel (ACP). The rule identifies malicious activity such as creating an administrator user by assigning usergroup 4, or accessing restricted configuration settings via HTTP POST/GET requests directed at the admin index script.
Detects suspicious activities indicative of a MyBB limited ACP user escalating privileges to full administrator. This includes web server processes (php, httpd, nginx) spawning command shells, interacting with database management tools, creating suspicious session files, or writing executable files to critical directories (cache, templates, uploads, inc).
Detects post-exploitation activities related to the PHP 8.5.7 CVE-2025-15661 StreamBucket SOAP vulnerability. This rule monitors for PHP worker processes spawning shells, writing executable files to suspicious directories, executing system binaries on Windows, or initiating outbound network connections on non-standard ports, including specific proof-of-concept markers.
Detects unauthenticated Engine.IO WebSocket handshake attempts targeting the Peyara Remote Mouse service on TCP port 1313. These requests, characterized by specific URI query parameters, are often used as an initial phase for exploitation against vulnerable instances of the application.
Detects instances where a user within the MyBB Admin Control Panel (ACP) attempts to create a new user account and assign it to the administrator usergroup (gid=4). This activity is indicative of a privilege escalation attempt by an authenticated user with limited administrative access or an attacker who has compromised such an account.
Detects exploitation attempts against Gitea instances where an attacker impersonates an admin user by injecting the 'X-WEBAUTH-USER' header. This vulnerability typically occurs when 'REVERSE_PROXY_TRUSTED_PROXIES' is misconfigured to trust all proxies ('*'), allowing unauthenticated users to gain administrative access via header manipulation. The rule covers web request headers, container logs for suspicious admin creation, and process execution arguments associated with the exploitation.
Detects the exploitation of CVE-2026-20896 in Gitea, where an unauthenticated attacker sends a crafted POST request to user registration or installation endpoints. The rule triggers when this network activity is followed by the creation of a new user account with administrative roles within a 10-minute window, indicating potential privilege escalation.
Detects outbound HTTP POST beaconing to known malicious C2 infrastructure (83.142.209.214) associated with the lambsys cryptominer campaign. The rule specifically looks for HTTP requests to /status.php or /setup_status.php utilizing the default Go HTTP client User-Agent, a common indicator of this specific malware.
Detects common web server processes (IIS, Apache, Nginx, PHP, Tomcat) spawning command-line interpreters or utilities (cmd.exe, powershell.exe, wscript.exe, cscript.exe, certutil.exe). This pattern is often indicative of exploitation of a web application to gain command execution on the host.
Detects HTTP requests where the URI or request body contains indicators of internal network references (e.g., localhost, 127.0.0.1, or RFC 1918 private IP address ranges). This pattern is consistent with Server-Side Request Forgery (SSRF) attempts, where an attacker tries to force a vulnerable web application to perform unauthorized requests to internal resources.
This rule detects the creation of web shell files (ASPX, PHP, JSP) in common web server directories such as 'wwwroot', 'inetpub', or 'var\\www'. This activity is indicative of an adversary establishing persistent access to a web server.
Detects the execution of the Linux uptime utility, either as a standalone process or via common web server parent processes (nginx, httpd, apache), particularly when associated with suspicious command-line arguments or network activity. This behavior is often associated with reconnaissance or post-exploitation activities.
This rule detects when an Nginx web server proxies HTTP POST requests to FastCGI backends located on internal network subnets (RFC1918) or local unix sockets. Such behavior often indicates exploitation attempts targeting internal FastCGI interfaces, which should typically not be reachable directly from the internet-facing web server.
This rule monitors for process creations spawned by common web application servers (e.g., nginx, python, java, php) where the command line arguments contain indicators of a Server-Side Request Forgery (SSRF) attempt. Specifically, it looks for suspicious URL schemes (file:, gopher:, dict:, ftp:), potential authority confusion patterns (targeting cloud metadata IPs), and encoded directory traversal characters when paired with sensitive paths like 'etc' or 'proc'.
Detects incoming HTTP requests that use URL-encoding (e.g., %2e%2e, %2f) to obfuscate path traversal sequences targeting sensitive operating system or container application files, such as /proc/self/environ or /etc/passwd. This technique is often used to bypass security filters or URL validation mechanisms in web applications.
Detects URL credential confusion attempts where an attacker injects an @ symbol into URL-based query parameters. By including an '@' character, the attacker forces a mismatch between how a hostname validator parses the URL (seeing a legitimate hostname like github.com as the userinfo component) and how the backend fetcher resolves the URL (ignoring the userinfo and resolving the host following the @ symbol), potentially enabling Server-Side Request Forgery (SSRF) or local file read bypasses.
Page 13 of 29