Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,141 detections
Filters
Last updated
All Time
Detection languages
3,219
1,086
504
478
469
Contributors
1,824
1,607
871
505
300
Categories
2,971
2,472
1,061
1,025
907
Platforms
39,766
7,141
6,517
3,850
3,601
Products / Services
1,324
1,068
971
657
488
MITRE Techniques
2,230
1,317
1,313
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects potential exploitation attempts targeting WordPress sites, specifically identifying unauthenticated REST API batch requests that attempt to forge posts with post_status 'parse' and post_type 'request' while including self-referential post_parent cycles. This pattern is associated with recent vulnerabilities enabling remote code execution.
Detects web server processes (Apache, Nginx, PHP-FPM) spawning a system shell to execute compound commands containing discovery utilities (like id, whoami, hostname, uname, or find) within a 'wp-content/plugins' directory. This behavior is indicative of post-exploitation activity following a remote code execution vulnerability, such as those associated with the wp2shell attack pattern.
Detects attempts to perform error-based SQL injection against WordPress instances associated with the wp2shell exploit chain. The rule monitors for the use of MySQL functions EXTRACTVALUE or UPDATEXML within query parameters that are typically targeted by the exploit (author_exclude, author__not_in) or when interacting with the batch REST endpoint.
Detects the wp2shell post-exploitation cleanup pattern where a shell spawned by a web server process determines its current working directory, matches it against a wp-content/plugins path using the specific `case "$d" in */wp-content/plugins/*) cd / && rm -rf "$d";; esac` one-liner shape, and recursively deletes that directory to remove the deployed web shell plugin. This is tightened to require the exact case-statement/one-liner construction executed by a shell that is a child of a web server process, rather than any generic recursive delete under wp-content/plugins, which would also fire on legitimate WordPress plugin uninstall hooks that remove their own plugin directory. Absence of the plugin directory afterward should not be treated as evidence the host is clean.
Detects creation of PHP web shell files or plugin directories under WordPress wp-content/plugins using the wp2shell_<hex> naming convention, associated with the wp2shell WordPress Core RCE exploitation chain.
Detects a POST to the WordPress REST API batch endpoint whose request body embeds a nested /wp/v2/users call granting the administrator role, consistent with the wp2shell exploit chain where a forged customize_changeset/parse_request replay temporarily assumes an existing admin's identity to pass current_user_can('create_users') and create a new administrator account without any preceding authenticated login. To reduce false positives from legitimate onboarding of administrator accounts, this rule now requires either the absence of an authenticated WordPress session cookie on the request, or a newly created username matching the randomized/generated wp2shell naming pattern (wp2_*, w2s_*).
Detects [embed] shortcode content submitted to WordPress that references invalid or anonymous local post IDs, used in the wp2shell chain to forge oEmbed cache database rows as a render-time write primitive.
Detects [embed] shortcode content submitted to WordPress that references invalid or anonymous local post IDs, used in the wp2shell chain to forge oEmbed cache database rows as a render-time write primitive.
Detects a WordPress admin plugin ZIP upload to wp-admin/update.php?action=upload-plugin only when correlated with high-risk context: the observed wp2shell_ plugin naming convention, evidence of a just-created/unfamiliar administrator account (wp-admin/user-new.php activity in the same capture), or the upload occurring immediately after REST API batch-route/SQLi anomalies (wp-json/batch/v1, author__not_in) tied to CVE-2026-63030 and CVE-2026-60137. Routine plugin uploads by established administrators without these correlating indicators are excluded.
Detects the WordPress REST API batch-route confusion technique (CVE-2026-63030) via a malformed nested sub-request path combined with the co-occurring parse_path_failed/block_cannot_read/rest_batch_not_allowed error marker pattern.
Detects cloning and building xmrig-proxy from source (git clone + cmake/make), used by JadeProx operators to relay cryptomining traffic from compromised hosts behind a single mining pool connection. Build commands must specifically reference the xmrig-proxy repository or directory to reduce false positives from generic development builds.
Detects creation or modification of a shell profile (.bashrc/.zshrc/etc.) containing the exact 'tensorflow hardware compatibility check' marker used by the mrmustard stealer to disguise its persistence hook.
Exact SHA256 match against the two known malicious mrmustard 0.7.4 PyPI sdist/wheel artifacts. Uses full-file (0, filesize) SHA256 equality only, not partial or truncated comparison.
Detects the mrmustard stealer's base64+XOR C2 endpoint deobfuscation routine, keyed on the 'tf_compat_v2' string combined with its decode-call markers.
Detects SSH private key file access by scripting interpreters while excluding legitimate SSH/git tooling, matching the mrmustard stealer's SSH key theft behavior.
Detects suspicious batch requests to the WordPress REST API (/wp-json/batch/v1) containing both a DELETE operation on category ID 0 and a POST operation to the core block-renderer, which is characteristic of attempts to exploit vulnerabilities like CVE-2024-27956 to achieve unauthenticated remote code execution.
Detects instances where the Claude AI code assistant process initiates a high volume (10 or more) of distinct child processes within a 5-minute window. This behavior could indicate anomalous activity, such as a compromised development environment or an unauthorized automated script execution originating from the assistant.
Detects the creation of a named pipe (FIFO) in the /tmp directory combined with commands associated with establishing a reverse shell, such as using 'nc' or executing '/bin/bash -i' with piped input/output redirection. These patterns are commonly used by adversaries to gain unauthorized interactive remote shell access to a Linux system.
Detects the execution of sendmail via a shell (sh, bash, dash) spawned by a web server process (Apache, Nginx, httpd) where the process working directory matches the wp2shell plugin pattern (wp2shell_<hex>). This is indicative of remote code execution or web shell activity associated with the wp2shell vulnerability, where the attacker uses sendmail for exfiltration or command output delivery.
Detects web server processes (Apache, Nginx, PHP-FPM) spawning a system shell to execute compound commands containing discovery utilities (like id, whoami, hostname, uname, or find) within a 'wp-content/plugins' directory. This behavior is indicative of post-exploitation activity following a remote code execution vulnerability, such as those associated with the wp2shell attack pattern.
Detects web server processes (Apache, Nginx, PHP-FPM) spawning a system shell to execute compound commands containing discovery utilities (like id, whoami, hostname, uname, or find) within a 'wp-content/plugins' directory. This behavior is indicative of post-exploitation activity following a remote code execution vulnerability, such as those associated with the wp2shell attack pattern.
Page 149 of 341