Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
576 detections
Filters
Last updated
All Time
Detection languages
175
168
120
26
25
Contributors
96
80
79
77
61
Categories
297
296
144
138
69
Platforms
347
214
188
27
21
Products / Services
10,665
9,758
6,692
4,418
3,749
576
MITRE Techniques
286
211
161
144
130
CVEs
23
23
11
6
6
IDS Classtypes
15
1
1
1
1
IDS Protocols
19
Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands. This activity is often associated with webshells attempting to understand the capabilities of the compromised server.
Java Payload Strings
Sigma
Detects possible Java payloads in web access logs
Detects path traversal exploitation attempts
Detects an issue in apache logs that reports threading related errors
Detects potential SQL injection attempts via GET requests in access logs.
Detects suspicious Windows strings in URI which could indicate possible exfiltration or webshell communication
Detects a segmentation fault error message caused by a crashing apache worker process
JNDIExploit Pattern
Sigma
Detects exploitation attempt using the JNDI-Exploit-Kit
Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands
Page 28 of 28