Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
576 detections
Filters
Last updated
All Time
Detection languages
175
168
120
26
25
Contributors
96
80
79
77
61
Categories
297
296
144
138
69
Platforms
347
214
188
27
21
Products / Services
10,665
9,758
6,692
4,421
3,749
576
MITRE Techniques
286
211
161
144
130
CVEs
23
23
11
6
6
IDS Classtypes
15
1
1
1
1
IDS Protocols
19
Detects a phishing page upgrading to WebSocket or polling transport with Socket.IO event framing during authentication. This behavior is indicative of an adversary-in-the-middle (AiTM) attack, specifically associated with the 'Tycoon' threat activity.
Detects use of Discord webhooks for covert C2 or data exfiltration
Identifies web server processes initiating network connections to the credential-stealing generate.2faplugin.org domain. This activity is indicative of a supply chain compromise targeting ShapedPlugin, where backdoored pro plugins are distributed via official channels, leading to data exfiltration.
Detects outbound network connections to 'filev2.getsession.org', a known Miasma payload hosting and exfiltration domain. This domain has been associated with Miasma malware for command and control and data exfiltration activities.
Detects interaction with the WordPress Theme Editor utility immediately followed by a file modification to functions.php, indicative of the ErrTraffic deployment phase. This activity can be a sign of web shell deployment or other malicious code injection.
This rule detects processes generating network connections to multiple known malicious ports (4444, 7211, 8000, 8001, 8002, 10000) within a 30-minute window. This behavior is indicative of command and control (C2) beaconing, where a compromised system periodically communicates with a C2 server. The rule is designed to identify a pattern of C2 activity that might be used across different threat campaigns, leveraging ports commonly associated with various C2 frameworks or custom C2 implementations.
Detects PHP or web server processes launching tools commonly used to download or upload files. This activity can indicate a web shell or other compromise where an attacker is attempting to transfer files to or from the compromised server. Investigate the transferred destination, remote endpoint, and whether the activity occurred during an approved deployment.
Detects PHP or web server processes launching common system, account, network, and domain reconnaissance utilities. This activity is often indicative of post-compromise internal reconnaissance, as web-facing application processes should not normally start these utilities. The rule specifically looks for processes like php.exe, w3wp.exe, httpd.exe, apache2, and nginx spawning reconnaissance tools such as whoami, hostname, systeminfo, ipconfig, ifconfig, net, nltest, dsquery, quser, and query.
Detects HTTP POST requests directed to /V1/Update/GetUpdate, indicative of the OceanLotus downloader retrieving the next-stage payload (SPECTRALVIPER).
This rule monitors file system events for the creation of files with common web shell names (e.g., shell.php, cmd.php) within known web server directory paths (e.g., wwwroot, inetpub). The detection of these specific file names in directories typically used for serving web content is a strong indicator of a potential web shell deployment.
Detects the deletion of .pkg_history or .pkg_logs, an anti-forensic attempt after the dropper completes, associated with the Mastra NPM compromise.
Detects REDCap-associated PHP or web server processes launching operating system command interpreters. GTIG observed INFINITERED using trojanised REDCap components and web shell functionality to execute arbitrary shell commands. This behaviour is highly unusual for normal REDCap operations and may indicate post-exploitation activity.
Detects PHP or web server processes launching archive and compression utilities. A compromised web application may use these tools to package REDCap files, database exports, credentials, or research data before exfiltration. This behaviour should be rare outside documented backup or deployment activity.
Detects use of WHOIS web services for domain property enumeration
This rule detects suspicious downloads of Python packages from pypi.org or pypi.python.org by pip or python executables. It specifically looks for a high volume (5 or more) of downloads of common package names (numpy, requests, pandas, util, common) within a one-hour window from a single device. This could indicate an attempt to compromise the software supply chain by introducing malicious versions of popular packages.
This rule detects DNS queries to known malicious domains associated with various APT groups and ransomware families. The domains are hardcoded indicators of compromise (IOCs) and their resolution suggests potential compromise or communication with adversary infrastructure.
Detects PHP or web server processes launching command-line database clients. INFINITERED collected database credentials and supported arbitrary SQL execution against compromised REDCap environments. Direct database-client execution by a web-serving process is uncommon and may indicate credential access, data collection, or backdoor command execution.
Detects attempts to overwrite web server content files for defacement
This rule detects DNS queries to known malicious domains associated with various APT groups and ransomware families. The domains are hardcoded indicators of compromise (IOCs) and their resolution suggests potential compromise or communication with adversary infrastructure.
Detects network connections to known or suspected Command and Control (C2) IP addresses and ports associated with ransomware activity. This rule specifically looks for outbound connections from devices to a predefined list of suspicious remote IP addresses on common C2 ports (443, 8443, 6379, 27017).
Detects web shell files written to web server directories
Page 16 of 28