Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
599 detections
Filters
Last updated
All Time
Detection languages
198
163
131
22
20
Contributors
127
91
73
69
62
Categories
331
304
132
129
59
Platforms
340
214
204
30
27
Products / Services
10,665
9,773
6,705
4,421
3,749
599
MITRE Techniques
293
211
151
137
110
CVEs
23
23
10
6
6
IDS Classtypes
13
1
1
1
IDS Protocols
16
This rule monitors for Linux web-server service accounts (such as www-data or nginx) attempting to elevate privileges by modifying file permissions to set SUID/SGID bits or by executing common system binaries with shell-escape patterns commonly documented in GTFOBins for privilege escalation.
Detects HTTP POST requests directed at Grav CMS endpoints where the __unique_form_id__ parameter contains directory traversal sequences (e.g., ../). This behavior is indicative of attempted exploitation of CVE-2026-42608, aimed at bypassing file system restrictions to write files to unauthorized locations outside the application's expected form data directory.
Detects a potential web shell deployment by identifying a web server process creating or modifying a file in common web directory locations, followed shortly (within 10 minutes) by the execution of that same file.
Detects web server processes (e.g., IIS w3wp.exe, Apache, Nginx, PHP-FPM) spawning suspicious child processes such as command shells (cmd, powershell, bash, sh), network utilities (curl, wget), or interpreters (python, perl). This behavior is strongly indicative of exploitation of a public-facing web application and the subsequent execution of a webshell or post-exploitation command activity.
Detects HTTP proxy traffic containing specific header or cookie patterns associated with the Evilginx2 or BigBear adversary-in-the-middle (AiTM) phishing frameworks. These frameworks use these artifacts to proxy connections and facilitate the theft of session tokens for MFA bypass.
The following analytic detects local file inclusion (LFI) attacks targeting Kubernetes Nginx ingress controllers. It leverages Kubernetes logs, parsing fields such as `request` and `status` to identify suspicious patterns indicative of LFI attempts. This activity is significant because LFI attacks can allow attackers to read sensitive files from the server, potentially exposing critical information. If confirmed malicious, this could lead to unauthorized access to sensitive data, further exploitation, and potential compromise of the Kubernetes environment.
Detects unauthenticated path traversal attempts targeting Grav CMS web servers. The rule identifies HTTP requests containing directory traversal sequences (e.g., ../, %2e%2e%2f) directed at sensitive configuration files (.yaml) or directories (/user/config, /system/config), consistent with exploitation patterns such as CVE-2026-42608.
Detects the creation of web scripts (aspx, php, jsp) in typical web server directories followed by suspicious shell activity (cmd, powershell, or shell execution) originating from web server processes within a 10-minute window. This behavior is indicative of a web shell being dropped and subsequently utilized for command execution.
This rule detects potential post-exploitation activity where a web server process spawns a command shell, executes system discovery commands, and immediately initiates an outbound network connection. This behavior is indicative of a web-based exploit leading to interactive command execution and subsequent C2 communication.
This rule detects potential credential stuffing attacks by monitoring high-volume authentication attempts against web application login endpoints. It specifically flags scenarios where a high number of unique source IP addresses interact with a login endpoint (e.g., /login, /signin) within a short window, which is characteristic of automated, distributed credential stuffing tools using proxy networks to rotate IPs.
Detects incoming web server requests containing suspicious, URL-encoded SQL injection patterns indicative of automated probing or exploitation attempts, such as UNION SELECT, boolean-based injection fragments, and comment sequences.
Detects HTTP requests containing common web exploit patterns (SQLi, XSS, RCE) that exhibit characteristics of automated, mutating payload generation often utilized in AI-assisted fuzzing or vulnerability scanning tools. The rule monitors for encoded, obfuscated, or highly varied payload syntax within URI query strings.
Detects network traffic indicators associated with Cobalt Strike beaconing activity, specifically focusing on common default or near-default Malleable C2 HTTP profile patterns. This includes hardcoded URI paths often used in default configurations (e.g., jQuery library names, pixel gifs) and specific combinations of HTTP headers and user-agent strings commonly observed in adversary C2 frameworks.
Detects the suspicious combination of a file modification within Magento frontend or checkout JavaScript/template directories followed by an outbound network connection initiated by web server processes (e.g., Apache, Nginx, PHP). This pattern is consistent with the injection of a digital skimmer (e.g., Magecart style) and the subsequent exfiltration of stolen payment card data to an attacker-controlled endpoint.
Detects when common web server worker processes spawn command-line tools or shell interpreters, which is a common post-exploitation technique used by web shells like Godzilla to execute arbitrary commands.
This rule detects high-frequency API endpoint access originating from a single source IP address within a one-minute window, where the User-Agent does not match common browser strings. This behavior is indicative of automated scanning, scraping, or brute-force enumeration of API resources by non-browser clients.
Detects a suspicious sequence of events where a known web server process (e.g., IIS, Nginx, Apache) spawns a command shell process, followed shortly by the creation of a file with a web shell-like extension (.aspx, .jsp, .php) in the same environment. This pattern is indicative of an adversary exploiting a public-facing application to upload and potentially access a web shell.
Detects a suspicious sequence of events where a common internet-facing server process (e.g., w3wp.exe, nginx.exe) spawns a potentially malicious child process (e.g., cmd.exe, powershell.exe), followed shortly thereafter by mass file modifications on the same host, which is characteristic of ransomware behavior following initial exploitation.
Detects a suspicious sequence of events where a common internet-facing server process (e.g., w3wp.exe, nginx.exe) spawns a potentially malicious child process (e.g., cmd.exe, powershell.exe), followed shortly thereafter by mass file modifications on the same host, which is characteristic of ransomware behavior following initial exploitation.
Detects web requests targeting Oracle PeopleSoft Integration Broker (PSIGW) endpoints that contain suspicious query parameters associated with exploitation attempts, such as path traversal sequences, command injection patterns, or Java-based class invocations. This rule is designed to identify exploitation attempts against PeopleSoft systems as observed in the mid-2026 ShinyHunters zero-day campaign.
Detects anomalous child processes, such as shells or interpreters, spawned by web server processes (PHP-FPM, Apache, Nginx). This behavior is often indicative of exploitation attempts, such as Remote Code Execution (RCE) via web application vulnerabilities.
Page 2 of 29