Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,217 detections
Filters
Last updated
All Time
Detection languages
714
206
154
38
26
Contributors
191
190
181
159
113
Categories
420
398
389
334
167
Platforms
838
349
199
85
56
Products / Services
10,680
9,761
6,694
4,418
3,744
1,217
MITRE Techniques
424
365
352
279
258
CVEs
16
12
11
10
8
IDS Classtypes
18
2
2
1
1
IDS Protocols
25
Identifies potential Neo-reGeorg webshell execution by correlating HTTP POST requests to Java Server Pages (.jsp/.jspx) with reflection events (defineClass) in system logs. This specific mechanism is utilized by Operation Escaneo (MexicanMafia) to load AES-encrypted, base64/BLV-encoded payloads in memory.
Detects use of Discord webhooks for covert C2 or data exfiltration
Detects a single compromised host initiating a massive burst of outbound SMB (Port 445) connections, indicating the push of the ransomware encryptor to the entire domain.
Identifies web server processes initiating network connections to the credential-stealing generate.2faplugin.org domain. This activity is indicative of a supply chain compromise targeting ShapedPlugin, where backdoored pro plugins are distributed via official channels, leading to data exfiltration.
Detects w3wp.exe directly passing backdoor files as command line arguments to a PHP runtime. This activity is indicative of a supply chain compromise where malicious PHP files are executed by the IIS worker process.
Detects the explicit execution of the 'gh-token-monitor.sh' script, which is indicative of active credential harvesting on the endpoint. This script is designed to monitor and potentially exfiltrate GitHub tokens.
Detects outbound network connections to 'filev2.getsession.org', a known Miasma payload hosting and exfiltration domain. This domain has been associated with Miasma malware for command and control and data exfiltration activities.
Detects interaction with the WordPress Theme Editor utility immediately followed by a file modification to functions.php, indicative of the ErrTraffic deployment phase. This activity can be a sign of web shell deployment or other malicious code injection.
Detects the uploading of a plugin matching known disguised slugs ('content-delivery-helper' or 'database-optimizer') used by attackers to install backdoors after establishing a rogue admin account in WordPress environments. This rule specifically targets POST requests to the WordPress plugin update endpoint with these malicious plugin names in the query string.
This rule detects potential credential harvesting attempts by identifying a high volume of short-duration HTTP requests to common login, sign-in, verify, account, or authentication URI stems. It specifically looks for requests originating from user agents commonly associated with bots or scripting tools (e.g., 'bot', 'curl', 'python', 'powershell') and successful HTTP status codes (200). The 'short' session duration is inferred from small response sizes (less than 5000 bytes), suggesting automated access rather than human interaction.
This rule detects processes generating network connections to multiple known malicious ports (4444, 7211, 8000, 8001, 8002, 10000) within a 30-minute window. This behavior is indicative of command and control (C2) beaconing, where a compromised system periodically communicates with a C2 server. The rule is designed to identify a pattern of C2 activity that might be used across different threat campaigns, leveraging ports commonly associated with various C2 frameworks or custom C2 implementations.
Maps the attack path where the IIS worker process (w3wp.exe) executes certutil to download a payload, followed immediately by sideloading a malicious DLL into a signed binary. This rule specifically looks for `w3wp.exe` initiating `certutil.exe` and then a subsequent image load event where a DLL (`mscoree.dll`, `mpclient.dll`, or `oci.dll`) is loaded by a process with a valid signature.
This rule detects a highly complex correlation where a web server process (w3wp.exe) drops a file named 'install-persistent.php' and then, within one hour, 'schtasks.exe' executes a command that includes 'install-persistent.php'. This pattern is indicative of a web shell being dropped and then scheduled for execution, potentially as part of a supply chain compromise.
Detects exploitation of vulnerable web-facing assets where the IIS worker process (w3wp.exe) spawns a command shell (cmd.exe or powershell.exe). This activity is indicative of a webshell being used to execute commands on the compromised server, specifically linked to Medusa initial access scripts by Storm-1175.
Detects PHP or web server processes launching tools commonly used to download or upload files. This activity can indicate a web shell or other compromise where an attacker is attempting to transfer files to or from the compromised server. Investigate the transferred destination, remote endpoint, and whether the activity occurred during an approved deployment.
Detects PHP or web server processes launching common system, account, network, and domain reconnaissance utilities. This activity is often indicative of post-compromise internal reconnaissance, as web-facing application processes should not normally start these utilities. The rule specifically looks for processes like php.exe, w3wp.exe, httpd.exe, apache2, and nginx spawning reconnaissance tools such as whoami, hostname, systeminfo, ipconfig, ifconfig, net, nltest, dsquery, quser, and query.
This rule monitors for suspicious activity related to Microsoft Exchange servers and potential DLL side-loading. It detects the creation of web shell files (.aspx, .ashx, .asmx) in Exchange-related directories, the execution of command shells (cmd, powershell) by the IIS worker process (w3wp.exe) within Exchange, and the side-loading of DLLs by specific signed binaries (dfsvc.exe, rasautou.exe) from non-standard directories.
Detects attempts to exploit a path traversal vulnerability in SharePoint's Upload.aspx page by looking for requests to 'Upload.aspx' that include both 'List=' and 'RootFolder=' parameters, specifically targeting sensitive catalogs like '_catalogs'. This indicates an attempt to upload files to unauthorized locations.
Detects interaction with specific web shell or remote code execution parameters ('developer_api1_fm', 'developer_api1_eval') associated with the self-hiding backdoor plugin dropped during the OptinMonster supply chain attack. This rule identifies HTTP requests containing these parameters, which are highly specific to the threat actor involved in the OptinMonster supply chain compromise.
Detects HTTP POST requests directed to /V1/Update/GetUpdate, indicative of the OceanLotus downloader retrieving the next-stage payload (SPECTRALVIPER).
Identifies outbound network connections to the Microsoft Device Code authentication endpoint, which may indicate phishing attempts (e.g., via PhaaS kits like Kali365).
Page 29 of 58