Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,217 detections
Filters
Last updated
All Time
Detection languages
714
206
154
38
26
Contributors
191
190
181
159
113
Categories
420
398
389
334
167
Platforms
838
349
199
85
56
Products / Services
10,680
9,761
6,694
4,418
3,744
1,217
MITRE Techniques
424
365
352
279
258
CVEs
16
12
11
10
8
IDS Classtypes
18
2
2
1
1
IDS Protocols
25
Detects web traffic where the referrer header contains keywords associated with gaming or educational themes (such as 'bioshock', 'game', 'puzzle', 'math', 'quiz') combined with access attempts to sensitive URI paths (like '/code', '/token', '/secret', '/private', '/api-key') resulting in a redirect status (301-308). This behavior pattern is often indicative of automated reconnaissance or exploitation attempts using non-standard or obfuscated referrers to bypass simple security filters.
Monitors IIS web servers for signs of potential exploitation by tracking suspicious child processes spawned by worker processes (w3wp.exe/iisexpress.exe), tracking unexpected WER (Windows Error Reporting) crashes associated with IIS workers, aggregating IIS-related application crashes, and detecting anomalous W3C IIS log request patterns (e.g., malformed content-length, negative bytes, or suspicious URI characteristics).
Detects path traversal attempts in web server access logs by searching for dot-dot-slash (../), dot-dot-backslash (..\), or their URL-encoded equivalents (..). These patterns are indicative of efforts to access files or directories outside the intended web root.
Detects instances where common web server processes initiate command interpreters or system utilities. This behavior is a common indicator of web shell execution, where an adversary uses a web application vulnerability to gain remote code execution on the underlying server.
Detects incoming HTTP POST requests directed at PHP, ASPX, or JSP files that contain suspicious command execution patterns (such as cmd=, exec=, system(, or eval()). This behavior is highly indicative of an attacker interacting with a web shell to execute unauthorized commands on the server.
This rule monitors for potential Server-Side Template Injection (SSTI) exploitation by detecting web application processes (such as Java, Python, or Web Server binaries) that initiate child processes (such as shell interpreters or script engines) while their command line contains common SSTI markers or exploitation patterns like '{{7*7}}', 'subprocess.Popen', or 'java.lang.Runtime'. This indicates an attacker has successfully escalated from template injection to remote code execution.
This rule monitors Microsoft IIS access logs for unauthenticated POST requests targeting the '/accessv2' endpoint from non-private, external IP addresses. This activity may indicate an attempt to exploit a public-facing application, potential web shell interaction, or unauthorized access attempts.
Detects potential timestomping activities via PowerShell APIs or touch.exe usage, alongside the creation or modification of known webshell filenames in web directories or files placed in common web root subdirectories by web server processes.
Detects reconnaissance activities performed on compromised web servers, including the enumeration of installed security software, installed applications via WMI or registry queries, and service/process listing. These actions are often observed as a precursor to defense impairment or further exploitation originating from web server processes like w3wp.exe.
Detects attempts to uninstall, disable, or remove ModSecurity Web Application Firewall (WAF) modules on IIS or Apache servers. This behavior often indicates an adversary attempting to impair security defenses by disabling WAF protection to facilitate further malicious activity, such as web shell deployment or exploitation.
Detects the removal or uninstallation of the ModSecurity Web Application Firewall (WAF) module across Windows (via appcmd.exe) and Linux (via package managers or apxs). Adversaries often disable security controls like ModSecurity to facilitate the exploitation of web vulnerabilities or to maintain persistence without triggering defensive alerts.
Detects the execution of batch files that perform multiple actions to impair or disable security tools, including Windows Defender, Sysmon, Filebeat, and IIS logging components. The rule monitors for a pattern of suspicious process commands (stop, config, delete, kill, Set-MpPreference) originating from a .bat file, flagging hosts where two or more distinct impairment actions are executed by the same parent process.
This rule detects the creation or modification of .aspx or .php files within a 'wwwroot/images' directory, specifically where the time difference between consecutive creation events for the same file path exceeds 24 hours (86400 seconds). This behavior is often associated with the placement of web shells or backdoors in web server directories, where adversaries attempt to masquerade malicious scripts as image files.
This rule detects the potential tampering of IIS logging configurations within a short duration following suspected web shell activity. It monitors for the execution of appcmd.exe or PowerShell commands that disable or modify IIS logging, specifically targeting sites or configurations after an IIS worker process (w3wp.exe) has performed activity associated with a webshell. This pattern is indicative of an attacker attempting to conceal their footprint after gaining access.
This rule detects the uninstallation or removal of the ModSecurity module from an IIS server, followed by suspicious POST requests to .aspx files within a 30-minute window. This behavioral pattern is indicative of an attacker disabling web application firewall (WAF) protections before attempting to exploit vulnerabilities or upload web shells.
Detects the creation of ASPX files in sensitive SharePoint directories (masterpage, layouts) by the w3wp.exe process, which is indicative of web shell deployment. Additionally, this rule identifies instances where w3wp.exe spawns shell processes like cmd.exe or powershell.exe, suggesting potential command execution via a compromised web server.
This rule monitors file system events for the creation of files with common web shell names (e.g., shell.php, cmd.php) within known web server directory paths (e.g., wwwroot, inetpub). The detection of these specific file names in directories typically used for serving web content is a strong indicator of a potential web shell deployment.
This rule detects potential Log4Shell (CVE-2021-44228) exploitation attempts by identifying JNDI injection patterns in web request headers, process command lines, and syslog messages. It further identifies suspicious outbound network callbacks to known malicious infrastructure associated with these exploitation attempts.
Detects rapid post-exploitation activity where a developer's workstation, upon executing VS Code (Code.exe), initiates outbound network connections to major cloud service or CI/CD provider APIs (GitHub, AWS, Azure, GCP) within 60 minutes. This behavior is indicative of the Lazarus Group 'Contagious Interview' campaign, where stolen credentials from developer environments are used to pivot into cloud infrastructure or CI/CD pipelines.
This rule detects potential web shell activity on Windows IIS servers by monitoring for suspicious process creation and file write events originating from the w3wp.exe worker process. Specifically, it flags when w3wp.exe spawns command shells (cmd, powershell), database management utilities (sqlcmd, osql), or network discovery/transfer tools (curl, wget, certutil, bitsadmin). It also detects the creation or modification of common web shell file extensions (.aspx, .ashx, .asmx) within web root directories.
Detects instances where the Exchange Server IIS worker process (w3wp.exe) spawns unexpected child processes like PowerShell, pwsh, or cmd, often indicating exploitation of vulnerabilities such as ProxyNotShell (CVE-2022-41040 and CVE-2022-41082) where an attacker leverages Exchange backend processes for arbitrary command execution.
Page 24 of 58