Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,217 detections
Filters
Last updated
All Time
Detection languages
714
206
154
38
26
Contributors
191
190
181
159
113
Categories
420
398
389
334
167
Platforms
838
349
199
85
56
Products / Services
10,680
9,761
6,694
4,418
3,744
1,217
MITRE Techniques
424
365
352
279
258
CVEs
16
12
11
10
8
IDS Classtypes
18
2
2
1
1
IDS Protocols
25
Detects the creation of executable script files (PHP, ASP, ASPX, JSP) by web server worker processes (e.g., httpd, nginx, w3wp.exe, php-fpm). This behavior is strongly indicative of the final stage of a web exploitation workflow where an attacker writes a web shell to the server to establish persistence or remote command execution capabilities.
Detects outbound network connections initiated by the Internet Information Services (IIS) worker process (w3wp.exe) to non-Microsoft IP addresses on suspicious or high-range ports. This behavior often indicates compromised web servers being used for command-and-control (C2) communication, reconnaissance, or data exfiltration.
Detects a Node or Bun process writing to Claude Code or VS Code autostart configuration. The
keyv/cacheable campaign plants a SessionStart hook in .claude/settings.json and a folderOpen
task in .vscode/tasks.json inside the trojanised source repository. Both execute the stage-1
loader when a developer or an AI coding agent opens the cloned repo, with no npm install
required - so lockfile pinning and registry blocking do not cover this path.
Note: this is the highest-value rule in the set for the agentic AI estate. It is also the one
most likely to need tuning, since tasks.json is legitimately written by many tools.
keyv/cacheable campaign plants a SessionStart hook in .claude/settings.json and a folderOpen
task in .vscode/tasks.json inside the trojanised source repository. Both execute the stage-1
loader when a developer or an AI coding agent opens the cloned repo, with no npm install
required - so lockfile pinning and registry blocking do not cover this path.
Note: this is the highest-value rule in the set for the agentic AI estate. It is also the one
most likely to need tuning, since tasks.json is legitimately written by many tools.
This rule monitors for Microsoft IIS worker processes (w3wp.exe) initiating common command-line shells or scripting engines. This behavior is indicative of successful remote code execution exploitation against internet-facing web applications, such as SharePoint or Telerik UI, often via deserialization vulnerabilities.
This rule monitors for a sequence of suspicious discovery commands (e.g., whoami, net, ipconfig) executed by web server processes (IIS w3wp.exe, Apache httpd, Nginx, or Tomcat). By requiring a threshold of at least three distinct discovery tools being executed by the same process within a 24-hour period, the rule identifies potential post-exploitation reconnaissance activity following a web server compromise.
This rule detects the extraction of a specific Python 3.13.3 embedded runtime archive ('python-3.13.3-embed-amd64-with-pip.zip') using tar.exe with a passphrase, targeted specifically at the Microsoft Edge User Data directory. The execution is flagged when initiated by processes like AutoHotkey or processes originating from within the Edge User Data directory, which is indicative of the 'Edgecution' malware suite's method for establishing a persistent native messaging host to facilitate malicious browser-based activity.
Detects incoming web requests (via URI queries or form data) containing common OS command injection characters, shell metacharacters, or command execution patterns indicative of attempts to execute unauthorized commands on the underlying web server.
This rule detects a potential credential exfiltration attempt following the launch of a terminal (cmd.exe, powershell.exe, bash, zsh, sh) by common IDE processes (Code.exe, Cursor.exe, Antigravity.exe). It monitors for sensitive configuration or credential files (such as .env, .aws/credentials, or .config/gh) being accessed within two minutes of a terminal process being spawned by the development environment.
Detects unauthorized POST requests to the '/Windchill/login/' directory targeting .jsp files. This path is not used by legitimate PTC Windchill/FlexPLM traffic and is indicative of an adversary attempting to interact with a webshell or exploit a vulnerability such as CVE-2026-12569.
This rule monitors web server access logs for common attack patterns, including SQL injection, Cross-Site Scripting (XSS), Path Traversal/LFI, Remote File Inclusion (RFI), potential JNDI-based RCE (e.g., Log4Shell patterns), web shell activity, and sensitive endpoint discovery or enumeration (specifically targeting WordPress/CMS).
This rule detects a potential credential exfiltration attempt following the launch of a terminal (cmd.exe, powershell.exe, bash, zsh, sh) by common IDE processes (Code.exe, Cursor.exe, Antigravity.exe). It monitors for sensitive configuration or credential files (such as .env, .aws/credentials, or .config/gh) being accessed within two minutes of a terminal process being spawned by the development environment.
Detects instances where the Internet Information Services (IIS) worker process (w3wp.exe) initiates execution of suspicious binaries such as cmd.exe, powershell.exe, or other script interpreters, which may indicate web-based exploitation or lateral movement.
Detects potential post-exploitation activity originating from the SharePoint worker process (w3wp.exe). The rule monitors for three primary indicators: w3wp.exe spawning command interpreters (cmd.exe or powershell.exe), unauthorized file modifications or creations within SharePoint web directories, and outbound network connections to public IP addresses initiated by w3wp.exe, which may indicate payload delivery or C2 communication. (CVE-2026-50522)
This rule detects the use of the Windows utility 'certutil.exe' to download external files, executed from the context of common web server or application processes (e.g., w3wp.exe, nginx.exe). This pattern is a common technique used by attackers to stage malicious payloads or tools in publicly accessible or temporary directories after initial web-based compromise.
This rule monitors for a sequence of suspicious discovery commands (e.g., whoami, net, ipconfig) executed by web server processes (IIS w3wp.exe, Apache httpd, Nginx, or Tomcat). By requiring a threshold of at least three distinct discovery tools being executed by the same process within a 24-hour period, the rule identifies potential post-exploitation reconnaissance activity following a web server compromise.
Detects unauthorized file system access to sensitive Gitea configuration files (app.ini) or internal directories (custom/conf, data/tmp) by the gitea/git service account. This pattern is indicative of post-exploitation credential or secret harvesting following remote code execution vulnerabilities, such as the diffpatch git hook RCE (CVE-2026-60004).
This rule detects the use of the Windows utility 'certutil.exe' to download external files, executed from the context of common web server or application processes (e.g., w3wp.exe, nginx.exe). This pattern is a common technique used by attackers to stage malicious payloads or tools in publicly accessible or temporary directories after initial web-based compromise.
This rule detects the creation of executable files within Git hooks directories ('.git/hooks') initiated by 'git' or 'gitea' processes. The logic specifically excludes files ending in '.sample' to focus on active hook deployment. This behavior is indicative of the 'diffpatch' collision technique (CVE-2026-60004), where attackers attempt to plant malicious Git hooks to achieve remote code execution (RCE) in the context of the Gitea service account.
Detects malicious SQL injection attempts targeting WordPress REST API endpoints that attempt to forge post parameters by injecting self-referential cycles. The pattern specifically looks for 'UNION SELECT' combined with 'author_exclude' and manipulated 'post_parent' values, matching known exploitation patterns for the wp2shell vulnerability (CVE-2026-63030 / CVE-2026-60137).
Detects malicious SQL injection attempts targeting WordPress REST API endpoints that attempt to forge post parameters by injecting self-referential cycles. The pattern specifically looks for 'UNION SELECT' combined with 'author_exclude' and manipulated 'post_parent' values, matching known exploitation patterns for the wp2shell vulnerability (CVE-2026-63030 / CVE-2026-60137).
Detects malicious SQL injection attempts targeting WordPress REST API endpoints that attempt to forge post parameters by injecting self-referential cycles. The pattern specifically looks for 'UNION SELECT' combined with 'author_exclude' and manipulated 'post_parent' values, matching known exploitation patterns for the wp2shell vulnerability (CVE-2026-63030 / CVE-2026-60137).
Page 19 of 58