Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects HTTP traffic patterns characteristic of suo5 and Neo-reGeorg web shell tunnels. These tools facilitate bidirectional communication through JSP endpoints (e.g., /jmx/suo5.jsp, /common/themes/top_css.jsp) by utilizing hardcoded proxy identifiers in HTTP headers. This behavior is indicative of a compromised web server acting as a pivot point for command-and-control operations.
Detects high-frequency requests to WordPress REST API batch endpoints, which are commonly used in automated exploitation or scanning attempts against WordPress installations. An unusual volume of these requests from a single client IP within a short time window is a strong indicator of unauthorized probing or exploit activity.
This rule detects potentially malicious activity on WordPress servers by correlating the creation of a new administrator account via the REST API with subsequent plugin installation activity and the creation of PHP files within the plugin directory within a one-hour window. This sequence is characteristic of an adversary establishing persistence or backdooring a WordPress site after gaining unauthorized access.
Detects the execution of sendmail via a shell (sh, bash, dash) spawned by a web server process (Apache, Nginx, httpd) where the process working directory matches the wp2shell plugin pattern (wp2shell_<hex>). This is indicative of remote code execution or web shell activity associated with the wp2shell vulnerability, where the attacker uses sendmail for exfiltration or command output delivery.
Detects PHP files and their containing directories that follow the wp2shell_<hex> naming convention under WordPress wp-content subdirectories (plugins/upgrade/uploads), as dropped by the wp2shell WordPress Core RCE chain (CVE-2026-63030 / CVE-2026-60137). Requires the strict wp-content/<plugins|upgrade|uploads>/...wp2shell_<8-hex> path structure rather than any new plugin directory creation, to avoid flagging legitimate plugin installs. Correlate with process-creation telemetry confirming a web-server process (e.g. apache2) as the creator of the matched path.
Detects processes attempting to enumerate common CI/CD environment variables, a technique observed in the SleeperGem supply chain attack used for sandbox evasion and environment awareness to determine if the malware is running in a CI/CD build environment.
Detects processes accessing files within a user's ~/.ssh directory, excluding standard files like known_hosts and .pub files. This pattern is characteristic of malware attempting to exfiltrate SSH private keys, similar to the behavior observed in the mrmustard stealer.
Detects the wp2shell unauthenticated SQL injection chain (CVE-2026-63030 / CVE-2026-60137) abusing the REST API batch-route confusion via author_exclude/author__not_in parameters against wp-json/wp/v2/posts or wp-json/batch/v1, where the extraction result reflects the WordPress 6.9 $wp$2y$ bcrypt-over-HMAC-SHA384 hash marker in the request query or response body. Requires both the specific unauthenticated REST SQLi vector AND the hash-format marker to fire, excluding legitimate authenticated admin export/reporting tools that reference wp_users through normal means.
Detects attempts to exploit the WordPress wp2shell vulnerability (CVE-2026-63030/CVE-2026-60137) by correlating the identification of a vulnerable WordPress version (6.9.0-6.9.4 or 7.0.0-7.0.1) via response banners with anomalous Batch REST API requests utilizing the 'author__not_in' parameter.
Detects instances where common web server processes (such as php-fpm, apache, nginx, or w3wp) spawn a command interpreter (sh, bash, or cmd.exe). This pattern is highly indicative of potential web shell activity, where an adversary executes commands on the underlying host after exploiting a web application.
Detects SSH private key file access by scripting interpreters while excluding legitimate SSH/git tooling, matching the mrmustard stealer's SSH key theft behavior.
This rule detects the execution of the Screaming Frog SEO Spider application followed by outgoing network traffic to web ports (80/443). Screaming Frog is a legitimate web crawler often repurposed by adversaries for internal or external network reconnaissance and site scraping.
Detects the wp2shell unauthenticated SQL injection chain (CVE-2026-63030 / CVE-2026-60137) abusing the REST API batch-route confusion via author_exclude/author__not_in parameters against wp-json/wp/v2/posts or wp-json/batch/v1, where the extraction result reflects the WordPress 6.9 $wp$2y$ bcrypt-over-HMAC-SHA384 hash marker in the request query or response body. Requires both the specific unauthenticated REST SQLi vector AND the hash-format marker to fire, excluding legitimate authenticated admin export/reporting tools that reference wp_users through normal means.
Detects creation of PHP web shell files or plugin directories under WordPress wp-content/plugins using the wp2shell_<hex> naming convention, associated with the wp2shell WordPress Core RCE exploitation chain.
Detects creation of PHP web shell files or plugin directories under WordPress wp-content/plugins using the wp2shell_<hex> naming convention, associated with the wp2shell WordPress Core RCE exploitation chain.
This rule identifies devices running specific outdated and vulnerable versions of WordPress (6.9.0 through 7.0.1) using data from the DeviceTvmSoftwareInventory table. Identifying these versions is critical for vulnerability management and patching, as these versions may be susceptible to known security exploits.
Detects crontab modifications referencing hw_probe.pyc, the cron-based persistence mechanism used by the mrmustard stealer.
Detects AWS credentials or config file reads by scripting engines (Python/Node/Ruby/etc.) excluding known AWS tooling, matching the mrmustard stealer's credential-theft behavior.
Detects installation or require-time execution of known-malicious SleeperGem RubyGems package versions (git_credential_manager 2.8.0-2.8.3, Dendreo 1.1.3-1.1.4, fastlane-plugin-run_tests_firebase_testlab 0.3.2) via gem install/bin/install command lines, and matches the same version strings when found in Gemfile.lock dependency manifests.
Detects installation or require-time execution of known-malicious SleeperGem RubyGems package versions (git_credential_manager 2.8.0-2.8.3, Dendreo 1.1.3-1.1.4, fastlane-plugin-run_tests_firebase_testlab 0.3.2) via gem install/bin/install command lines, and matches the same version strings when found in Gemfile.lock dependency manifests.
Detects processes attempting to enumerate common CI/CD environment variables, a technique observed in the SleeperGem supply chain attack used for sandbox evasion and environment awareness to determine if the malware is running in a CI/CD build environment.
Page 154 of 347