Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
599 detections
Filters
Last updated
All Time
Detection languages
198
163
131
22
20
Contributors
127
91
73
69
62
Categories
331
304
132
129
59
Platforms
340
214
204
30
27
Products / Services
10,665
9,773
6,705
4,421
3,749
599
MITRE Techniques
293
211
151
137
110
CVEs
23
23
10
6
6
IDS Classtypes
13
1
1
1
IDS Protocols
16
Detects HTTP POST requests to MyBB Admin Control Panel modules restricted to superadministrators (e.g., user management, group configuration, settings) initiated by non-privileged accounts. This activity is consistent with privilege escalation exploitation patterns where internal authorization checks might be bypassed.
Detects HTTP requests directed at known MexicanMafia Operation Escaneo phishing infrastructure, specifically targeting tax authority and SeedDMS document management users. The rule alerts on access to identified artifact filenames used in the campaign, such as phishing poc and spoofed document management pages.
Detects HTTP requests initiated by common browser adblock extensions to remote API endpoints for retrieving rule configuration files. This behavior can be exploited by adversaries to perform remote scriptlet injection or change extension behavior via server-side updates, potentially enabling unauthorized JavaScript execution in the browser's context.
Detects Browser-in-the-Middle (BitM) phishing infrastructure associated with PhaaS kits (e.g., Bluekit). The detection monitors proxy access logs for patterns where page assets (images, fonts, CSS) are fetched through a proxy API endpoint on behalf of the victim, combined with WebSocket connections used for real-time relay of victim inputs to the attacker.
Detects PHP or web server processes launching interpreters with encoded, Base64-decoded, or dynamically evaluated command content. This behavior is often indicative of web shell or backdoor execution. The rule specifically looks for web server processes (e.g., php.exe, w3wp.exe, httpd, nginx) as initiating processes, which then launch command interpreters (e.g., cmd.exe, powershell.exe, bash, python) with command lines containing obfuscation techniques like -EncodedCommand, FromBase64String, base64 -d, eval(), exec(), IEX, or Invoke-Expression.
Detects a web server process creating at least two different backdoored WooCommerce files within a 5-minute window. This behavior is indicative of a supply chain compromise targeting ShapedPlugin, where malicious plugins distribute backdoored files.
C2 Connection Detection
YARA-L
Detects network connections to known C2 infrastructure using specific ports
Detects a web server or PHP runtime creating or renaming a PHP file inside a REDCap application directory. INFINITERED trojanised legitimate REDCap components and deployed PHP-based persistence. Production REDCap content should normally be changed through controlled deployment or upgrade activity, so unplanned PHP file creation by the serving process requires investigation.
Detects a phishing page upgrading to WebSocket or polling transport with Socket.IO event framing during authentication. This behavior is indicative of an adversary-in-the-middle (AiTM) attack, specifically associated with the 'Tycoon' threat activity.
Detects use of Discord webhooks for covert C2 or data exfiltration
Detects outbound network connections to 'filev2.getsession.org', a known Miasma payload hosting and exfiltration domain. This domain has been associated with Miasma malware for command and control and data exfiltration activities.
Detects interaction with the WordPress Theme Editor utility immediately followed by a file modification to functions.php, indicative of the ErrTraffic deployment phase. This activity can be a sign of web shell deployment or other malicious code injection.
This rule detects processes generating network connections to multiple known malicious ports (4444, 7211, 8000, 8001, 8002, 10000) within a 30-minute window. This behavior is indicative of command and control (C2) beaconing, where a compromised system periodically communicates with a C2 server. The rule is designed to identify a pattern of C2 activity that might be used across different threat campaigns, leveraging ports commonly associated with various C2 frameworks or custom C2 implementations.
Detects PHP or web server processes launching tools commonly used to download or upload files. This activity can indicate a web shell or other compromise where an attacker is attempting to transfer files to or from the compromised server. Investigate the transferred destination, remote endpoint, and whether the activity occurred during an approved deployment.
Detects PHP or web server processes launching common system, account, network, and domain reconnaissance utilities. This activity is often indicative of post-compromise internal reconnaissance, as web-facing application processes should not normally start these utilities. The rule specifically looks for processes like php.exe, w3wp.exe, httpd.exe, apache2, and nginx spawning reconnaissance tools such as whoami, hostname, systeminfo, ipconfig, ifconfig, net, nltest, dsquery, quser, and query.
Detects HTTP POST requests directed to /V1/Update/GetUpdate, indicative of the OceanLotus downloader retrieving the next-stage payload (SPECTRALVIPER).
This rule monitors file system events for the creation of files with common web shell names (e.g., shell.php, cmd.php) within known web server directory paths (e.g., wwwroot, inetpub). The detection of these specific file names in directories typically used for serving web content is a strong indicator of a potential web shell deployment.
Detects the deletion of .pkg_history or .pkg_logs, an anti-forensic attempt after the dropper completes, associated with the Mastra NPM compromise.
Detects REDCap-associated PHP or web server processes launching operating system command interpreters. GTIG observed INFINITERED using trojanised REDCap components and web shell functionality to execute arbitrary shell commands. This behaviour is highly unusual for normal REDCap operations and may indicate post-exploitation activity.
Detects PHP or web server processes launching archive and compression utilities. A compromised web application may use these tools to package REDCap files, database exports, credentials, or research data before exfiltration. This behaviour should be rare outside documented backup or deployment activity.
Detects web server processes (IIS/Nginx) spawning native Windows or Linux shells (cmd.exe, sh), immediately followed by reconnaissance or download tool execution.
Page 17 of 29