Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects [embed] shortcode content submitted to WordPress that references invalid or anonymous local post IDs, used in the wp2shell chain to forge oEmbed cache database rows as a render-time write primitive.
Detects the ZIP archive staged during the wp2shell WordPress RCE chain, identified by the embedded 'wp2shell_<hex>' directory/file naming convention later unpacked under wp-content/upgrade/ and renamed into wp-content/plugins/. Static content matching cannot distinguish a legitimate wp-admin authenticated plugin/theme upload from an attacker-staged payload landing in wp-content/uploads/ -- this rule enforces a fullword, exact 8-hex-character wp2shell_<hex> naming match and MUST be correlated with EDR/process telemetry confirming the ZIP was created by the web-server process (e.g. apache2/php-fpm) outside of an authenticated wp-admin upload session before triggering high-confidence alerting.
Detects the WordPress REST API batch-route confusion technique (CVE-2026-63030) via a malformed nested sub-request path combined with the co-occurring parse_path_failed/block_cannot_read/rest_batch_not_allowed error marker pattern.
Detects cloning and building xmrig-proxy from source (git clone + cmake/make), used by JadeProx operators to relay cryptomining traffic from compromised hosts behind a single mining pool connection. Build commands must specifically reference the xmrig-proxy repository or directory to reduce false positives from generic development builds.
Exact SHA256 match against the two known malicious mrmustard 0.7.4 PyPI sdist/wheel artifacts. Uses full-file (0, filesize) SHA256 equality only, not partial or truncated comparison.
Detects the mrmustard stealer's base64+XOR C2 endpoint deobfuscation routine, keyed on the 'tf_compat_v2' string combined with its decode-call markers.
Detects SSH private key file access by scripting interpreters while excluding legitimate SSH/git tooling, matching the mrmustard stealer's SSH key theft behavior.
Detects the creation of a PHP file with a specific malicious naming convention ('disable-batch-api-for-unauth.php') commonly associated with wp2shell post-exploitation activity in WordPress plugin or upload directories.
Detects suspicious batch requests to the WordPress REST API (/wp-json/batch/v1) containing both a DELETE operation on category ID 0 and a POST operation to the core block-renderer, which is characteristic of attempts to exploit vulnerabilities like CVE-2024-27956 to achieve unauthenticated remote code execution.
Detects the creation of a named pipe (FIFO) in the /tmp directory combined with commands associated with establishing a reverse shell, such as using 'nc' or executing '/bin/bash -i' with piped input/output redirection. These patterns are commonly used by adversaries to gain unauthorized interactive remote shell access to a Linux system.
Detects instances where the Claude AI code assistant process initiates a high volume (10 or more) of distinct child processes within a 5-minute window. This behavior could indicate anomalous activity, such as a compromised development environment or an unauthorized automated script execution originating from the assistant.
Detects the execution of sendmail via a shell (sh, bash, dash) spawned by a web server process (Apache, Nginx, httpd) where the process working directory matches the wp2shell plugin pattern (wp2shell_<hex>). This is indicative of remote code execution or web shell activity associated with the wp2shell vulnerability, where the attacker uses sendmail for exfiltration or command output delivery.
Detects potential exploitation attempts targeting WordPress sites, specifically identifying unauthenticated REST API batch requests that attempt to forge posts with post_status 'parse' and post_type 'request' while including self-referential post_parent cycles. This pattern is associated with recent vulnerabilities enabling remote code execution.
Detects the execution of sendmail via a shell (sh, bash, dash) spawned by a web server process (Apache, Nginx, httpd) where the process working directory matches the wp2shell plugin pattern (wp2shell_<hex>). This is indicative of remote code execution or web shell activity associated with the wp2shell vulnerability, where the attacker uses sendmail for exfiltration or command output delivery.
Detects the wp2shell post-exploitation cleanup pattern where a shell spawned by a web server process determines its current working directory, matches it against a wp-content/plugins path using the specific `case "$d" in */wp-content/plugins/*) cd / && rm -rf "$d";; esac` one-liner shape, and recursively deletes that directory to remove the deployed web shell plugin. This is tightened to require the exact case-statement/one-liner construction executed by a shell that is a child of a web server process, rather than any generic recursive delete under wp-content/plugins, which would also fire on legitimate WordPress plugin uninstall hooks that remove their own plugin directory. Absence of the plugin directory afterward should not be treated as evidence the host is clean.
Detects a POST to the WordPress REST API batch endpoint whose request body embeds a nested /wp/v2/users call granting the administrator role, consistent with the wp2shell exploit chain where a forged customize_changeset/parse_request replay temporarily assumes an existing admin's identity to pass current_user_can('create_users') and create a new administrator account without any preceding authenticated login. To reduce false positives from legitimate onboarding of administrator accounts, this rule now requires either the absence of an authenticated WordPress session cookie on the request, or a newly created username matching the randomized/generated wp2shell naming pattern (wp2_*, w2s_*).
Detects a web server process (apache2/httpd/nginx/php-fpm) spawning a shell interpreter from a WordPress wp-content working directory, the durable behavioral signature of successful wp2shell exploitation regardless of entry vector.
Detects a web server process (apache2/httpd/nginx/php-fpm) spawning a shell interpreter from a WordPress wp-content working directory, the durable behavioral signature of successful wp2shell exploitation regardless of entry vector.
Detects a forged WordPress customize_changeset post that triggers wp_set_current_user with a mismatched or unauthenticated user context, the privilege-escalation bridge used in the wp2shell admin-takeover chain.
Detects SQL injection syntax smuggled into the author_exclude parameter via the WordPress REST API batch endpoint desync (CVE-2026-60137/CVE-2026-63030).
Detects UNION-based blind SQL injection against the WordPress REST posts item route exploiting the split_the_query bypass (CVE-2026-60137) to exfiltrate database contents.
Page 156 of 347