Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,217 detections
Filters
Last updated
All Time
Detection languages
714
206
154
38
26
Contributors
191
190
181
159
113
Categories
420
398
389
334
167
Platforms
838
349
199
85
56
Products / Services
10,680
9,761
6,694
4,418
3,744
1,217
MITRE Techniques
424
365
352
279
258
CVEs
16
12
11
10
8
IDS Classtypes
18
2
2
1
1
IDS Protocols
25
Detects potential data exfiltration activity to the file sharing service 'easyupload.io' by monitoring DNS queries, HTTP POST requests, and general network connections to the domain.
Detects Microsoft Exchange EWS (Exchange.asmx) requests containing a ReferenceAttachment call where the ProviderEndpointUrl parameter points to a non-Microsoft/external domain. This is consistent with SSRF exploitation techniques, such as those observed in CVE-2026-45504, where an attacker-controlled endpoint is provided to Exchange for fetching WOPI properties.
Detects known suspicious (default) user-agents related to scanning/recon tools
Detects unexpected crashes of critical macOS system processes such as sharingd, nsurlsessiond, airplayd, AirPlayXPCHelper, and NetAuthSysAgent. Frequent crashing of these components can indicate instability or potentially malicious attempts to interfere with system services.
Detects HTTP requests to Gitea instances containing the X-WEBAUTH-USER header, which facilitates user impersonation when Gitea is misconfigured with 'REVERSE_PROXY_TRUSTED_PROXIES = *' in a Docker environment. This vulnerability (CVE-2026-20896) allows an unauthenticated attacker to impersonate any user, including administrators.
This rule detects potential reconnaissance activity by identifying IP addresses that generate a high volume of HTTP requests with user agents indicating bots, crawlers, or scanners. It counts requests per IP address within one-hour bins and flags those with 50 or more such requests.
Detects the creation of files with extensions commonly associated with web shells (.php, .aspx, .jsp) within typical web application directories by common web server processes such as httpd, nginx, php-cgi, and w3wp. This activity is indicative of a potential web shell deployment for persistent access or command execution.
This rule detects post-exploitation activity related to the exploitation of PHP StreamBucket SOAP deserialization vulnerabilities. It monitors for child process execution from PHP web server processes (e.g., php-fpm, php.exe), the creation of specific proof-of-concept (PoC) marker files, and the presence of identified exploit script filenames on disk.
Detects the execution of known Impacket relay tools such as ntlmrelayx and smbrelayx, which are commonly used by adversaries to perform NTLM relay attacks to gain unauthorized access or execute code on remote systems.
Detects anomalous Python activity indicative of the InvisibleFerret backdoor, specifically focusing on instances where Python processes are spawned by developer tools (node.exe, code.exe, cursor.exe), access sensitive credential/wallet files, or initiate outbound network connections on common C2 ports.
This rule detects potential brute-force or credential stuffing attempts against web application authentication endpoints by monitoring patterns of success and failure. It aggregates requests over 5-minute intervals, calculating a risk score based on high volumes of authentication failures relative to successful requests from individual source IPs targeting sensitive API paths (e.g., auth, session, login, token).
This rule detects potential brute-force or credential stuffing attempts against web application authentication endpoints by monitoring patterns of success and failure. It aggregates requests over 5-minute intervals, calculating a risk score based on high volumes of authentication failures relative to successful requests from individual source IPs targeting sensitive API paths (e.g., auth, session, login, token).
This rule detects unauthorized exploitation attempts against Gitea environments vulnerable to CVE-2026-20896. When Gitea is configured with REVERSE_PROXY_TRUSTED_PROXIES set to permit all sources, an attacker can bypass authentication by injecting the 'X-WEBAUTH-USER: admin' header in HTTP requests. This allows the attacker to gain administrative privileges and perform unauthorized actions, such as creating new admin accounts or accessing restricted API endpoints.
Detects unexpected crashes of critical macOS system processes such as sharingd, nsurlsessiond, airplayd, AirPlayXPCHelper, and NetAuthSysAgent. Frequent crashing of these components can indicate instability or potentially malicious attempts to interfere with system services.
Detects the creation of web-executable files (e.g., .aspx, .ashx, .php, .jsp, .asmx) within sensitive web root directories (IIS, Exchange, SharePoint) when the writing process is identified as an IIS worker process (w3wp.exe) or an Exchange Unified Messaging worker process (UMWorkerProcess.exe). This activity is highly indicative of web shell deployment for post-exploitation persistence, commonly associated with vulnerabilities like CVE-2021-26855 or CVE-2022-41082.
This rule detects HTTP POST requests to the MyBB admin panel (admin/index.php) that attempt to create or modify a user account with membership in the Administrator group (gid=4). The detection requires the presence of an administrator session cookie (adminsid), indicating an attempt by a lower-privileged administrative account to escalate privileges by assigning administrative roles to users.
Detects the use of PowerShell to manually modify file system timestamps (CreationTime, LastWriteTime, LastAccessTime) on ASPX files or within common web-accessible directories. This technique is often used by adversaries to hide the true creation or modification time of webshells, facilitating anti-forensic activities and timeline corruption.
Detects suspicious child process creation originating from Adobe ColdFusion or IIS worker processes (w3wp.exe). This rule monitors for the execution of command-line shells, scripting engines, or download utilities often used in exploitation of vulnerabilities like CVE-2023-26360, CVE-2023-29298, or CVE-2023-29300.
Detects the use of appcmd.exe to disable HTTP logging for an IIS site by setting 'dontLog' to True. Adversaries may perform this action to evade detection and prevent security logging of their activities on a compromised web server.
This rule detects the creation of executable script files (.aspx, .php) within the webroot images directory or identifies known specific filenames associated with web shells. This behavior is indicative of an adversary attempting to establish a web shell for persistent access or command execution on a web server.
Detects the creation of .aspx files within common IIS web root directories (inetpub, wwwroot). The rule identifies potential web shell activity by monitoring for specific suspicious filenames (e.g., cmd, shell, upload, file) or by flagging any ASPX creation performed by processes not typically associated with legitimate web application deployments.
Page 21 of 58