Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
576 detections
Filters
Last updated
All Time
Detection languages
175
168
120
26
25
Contributors
96
80
79
77
61
Categories
297
296
144
138
69
Platforms
347
214
188
27
21
Products / Services
10,665
9,758
6,692
4,421
3,749
576
MITRE Techniques
286
211
161
144
130
CVEs
23
23
11
6
6
IDS Classtypes
15
1
1
1
1
IDS Protocols
19
Detects web service accounts (e.g., www-data) unexpectedly spawning shells from FFmpeg. This behavior is strongly indicative of remote code execution (RCE) via the PixelSmash vulnerability, specifically targeting automated preview generation in platforms like Nextcloud.
Detects high-frequency requests (over 30 unique paths within a 5-minute window) to sensitive VPN-related URL paths that result in 403 (Forbidden) or 404 (Not Found) status codes from non-internal IP addresses. This behavior is indicative of an adversary performing directory enumeration or vulnerability scanning on public-facing infrastructure.
Detects high-frequency requests (over 30 unique paths within a 5-minute window) to sensitive VPN-related URL paths that result in 403 (Forbidden) or 404 (Not Found) status codes from non-internal IP addresses. This behavior is indicative of an adversary performing directory enumeration or vulnerability scanning on public-facing infrastructure.
Detects path traversal injection attempts within the 'url' parameter targeting GitHub repository URLs. The rule inspects web request query parameters for various path traversal techniques, including standard dots, URL-encoded patterns, double-encoding, null-byte injections, and common file path indicators like '/etc/passwd' or '/proc/self/environ'.
Detects path traversal attempts in web server access logs by searching for dot-dot-slash (../), dot-dot-backslash (..\), or their URL-encoded equivalents (..). These patterns are indicative of efforts to access files or directories outside the intended web root.
Detects high-frequency requests to sensitive management or API-related URL paths (/msp/, /api/, /wyse/, /wms/) that are not preceded by successful authentication attempts. This pattern is characteristic of automated exploitation attempts or unauthorized discovery against network management or configuration interfaces from external IP addresses.
Detects high-frequency requests to sensitive management or API-related URL paths (/msp/, /api/, /wyse/, /wms/) that are not preceded by successful authentication attempts. This pattern is characteristic of automated exploitation attempts or unauthorized discovery against network management or configuration interfaces from external IP addresses.
This rule detects suspicious web traffic patterns associated with potential Cross-Origin Resource Sharing (CORS) exploitation. It monitors for access to files containing 'cors_exploit_poc', HTTP POST requests containing sensitive 'AMAUTHID' cookies, or the presence of 'withCredentials' headers alongside 'Access-Control-Allow-Origin' configurations. These indicators, particularly when combined, suggest unauthorized attempts to bypass browser-based security models to access sensitive session identifiers or data.
This rule query identifies likely post‑exploitation activity associated with React2Shell (CVE-2025-55182) in which Part 1 identifies web servers spawning unusual child processes (such as command shells or system utilities) combined with suspicious command-line patterns, which may indicate post-exploitation behavior following a compromise. and part 2 detects web servers making outbound network connections to known malicious IPs or hostnames, or to domains associated with tunneling services (e.g., trycloudflare.com), suggesting potential command-and-control activity or data exfiltration.
Detects endpoint connections directly to Kali365 PhaaS panel domains, which are associated with phishing-as-a-service operations. This rule identifies network activity to specific domains used by the Kali365 platform, indicating potential compromise or interaction with phishing infrastructure.
This rule detects a POST request to the MyBB administrative interface (specifically the user-users module) that contains parameters indicating an attempt to escalate a limited administrative user to a full administrator by assigning the 'usergroup=4' or 'gid=4' identifier, which corresponds to the default Administrator group in MyBB.
Detects potential privilege escalation within the MyBB Administrative Control Panel (ACP). The rule identifies POST requests to user management modules that set a user's group ID (gid) or usergroup to 4, which typically corresponds to the administrator group in MyBB. It verifies the escalation by correlating it with a prior session that lacked administrator privileges and identifying a subsequent login event.
Detects unauthorized attempts to escalate privileges within the MyBB Admin Control Panel (ACP) by creating a new account or modifying an existing one to belong to the administrator group (gid=4). This is indicative of an attacker attempting to gain full administrative control by bypassing module-level access restrictions.
This rule detects communication patterns indicative of the ErrTraffic webshell by searching for specific parameters ('wp_debug_session=' and 'mode=php') within web server URI/URL fields. The presence of these parameters suggests an active webshell connection, likely used for remote access and command execution on a compromised web server.
Detects unauthorized privilege escalation attempts within the MyBB Admin Control Panel (ACP) by monitoring limited-privilege accounts accessing restricted modules (e.g., plugins, templates, user groups). It correlates these web requests with file system changes in the plugin directory by the web server process and monitors application logs for suspicious administrative activity.
Detects HTTP POST requests to MyBB Admin Control Panel modules restricted to superadministrators (e.g., user management, group configuration, settings) initiated by non-privileged accounts. This activity is consistent with privilege escalation exploitation patterns where internal authorization checks might be bypassed.
Detects HTTP requests directed at known MexicanMafia Operation Escaneo phishing infrastructure, specifically targeting tax authority and SeedDMS document management users. The rule alerts on access to identified artifact filenames used in the campaign, such as phishing poc and spoofed document management pages.
Detects PHP or web server processes launching interpreters with encoded, Base64-decoded, or dynamically evaluated command content. This behavior is often indicative of web shell or backdoor execution. The rule specifically looks for web server processes (e.g., php.exe, w3wp.exe, httpd, nginx) as initiating processes, which then launch command interpreters (e.g., cmd.exe, powershell.exe, bash, python) with command lines containing obfuscation techniques like -EncodedCommand, FromBase64String, base64 -d, eval(), exec(), IEX, or Invoke-Expression.
Detects a web server process creating at least two different backdoored WooCommerce files within a 5-minute window. This behavior is indicative of a supply chain compromise targeting ShapedPlugin, where malicious plugins distribute backdoored files.
C2 Connection Detection
YARA-L
Detects network connections to known C2 infrastructure using specific ports
Detects a web server or PHP runtime creating or renaming a PHP file inside a REDCap application directory. INFINITERED trojanised legitimate REDCap components and deployed PHP-based persistence. Production REDCap content should normally be changed through controlled deployment or upgrade activity, so unplanned PHP file creation by the serving process requires investigation.
Page 15 of 28