Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
576 detections
Filters
Last updated
All Time
Detection languages
175
168
120
26
25
Contributors
96
80
79
77
61
Categories
297
296
144
138
69
Platforms
347
214
188
27
21
Products / Services
10,665
9,758
6,692
4,418
3,749
576
MITRE Techniques
286
211
161
144
130
CVEs
23
23
11
6
6
IDS Classtypes
15
1
1
1
1
IDS Protocols
19
Detects HTTP requests containing common web exploit patterns (SQLi, XSS, RCE) that exhibit characteristics of automated, mutating payload generation often utilized in AI-assisted fuzzing or vulnerability scanning tools. The rule monitors for encoded, obfuscated, or highly varied payload syntax within URI query strings.
Detects the suspicious combination of a file modification within Magento frontend or checkout JavaScript/template directories followed by an outbound network connection initiated by web server processes (e.g., Apache, Nginx, PHP). This pattern is consistent with the injection of a digital skimmer (e.g., Magecart style) and the subsequent exfiltration of stolen payment card data to an attacker-controlled endpoint.
Detects when common web server worker processes spawn command-line tools or shell interpreters, which is a common post-exploitation technique used by web shells like Godzilla to execute arbitrary commands.
Detects a suspicious sequence of events where a known web server process (e.g., IIS, Nginx, Apache) spawns a command shell process, followed shortly by the creation of a file with a web shell-like extension (.aspx, .jsp, .php) in the same environment. This pattern is indicative of an adversary exploiting a public-facing application to upload and potentially access a web shell.
Detects web requests targeting Oracle PeopleSoft Integration Broker (PSIGW) endpoints that contain suspicious query parameters associated with exploitation attempts, such as path traversal sequences, command injection patterns, or Java-based class invocations. This rule is designed to identify exploitation attempts against PeopleSoft systems as observed in the mid-2026 ShinyHunters zero-day campaign.
Detects anomalous child processes, such as shells or interpreters, spawned by web server processes (PHP-FPM, Apache, Nginx). This behavior is often indicative of exploitation attempts, such as Remote Code Execution (RCE) via web application vulnerabilities.
Detects web application server processes (such as IIS, Apache, Tomcat, Java, Nginx, or Node.js) spawning command-line interpreters or system utilities. This behavior is frequently associated with webshell execution or post-exploitation activities following the exploitation of a public-facing application, often seen in VPN or enterprise software compromises.
Detects HTTP POST requests directed at Grav CMS endpoints where the __unique_form_id__ parameter contains directory traversal sequences (e.g., ../). This behavior is indicative of attempted exploitation of CVE-2026-42608, aimed at bypassing file system restrictions to write files to unauthorized locations outside the application's expected form data directory.
Detects attempts to bypass Vite development server file access restrictions by appending query parameters such as ?raw, ?import&raw, or ?import&url&inline to request paths for sensitive files like .env, cloud credentials, and terraform state files.
This rule detects high-frequency API endpoint access originating from a single source IP address within a one-minute window, where the User-Agent does not match common browser strings. This behavior is indicative of automated scanning, scraping, or brute-force enumeration of API resources by non-browser clients.
Detects web requests targeting common LLM/AI inference API endpoints containing strings indicative of prompt injection attempts, such as attempts to bypass filters, exfiltrate system instructions, or force model behavior changes (e.g., DAN mode).
Detects web requests targeting sensitive Jenkins/CI-CD administrative and build-triggering endpoints, such as /script, /manage, and /job/*/build. These paths are high-value targets for reconnaissance and automated exploitation efforts. This rule identifies potentially malicious activity by monitoring for access to these specific paths, which should be correlated with frequency and source data to differentiate automated scanning from authorized administrative or system activities.
Detects a suspicious sequence of events where a known web server process (e.g., IIS, Nginx, Apache) spawns a command shell process, followed shortly by the creation of a file with a web shell-like extension (.aspx, .jsp, .php) in the same environment. This pattern is indicative of an adversary exploiting a public-facing application to upload and potentially access a web shell.
This rule detects attempts to exploit CVE-2026-5027 in Langflow by identifying path traversal sequences (such as '../', '..\', or absolute paths) within the query parameters of requests directed to the '/api/v2/files' endpoint.
Detects UNC6240 PSEMHUB.war web shell/tunnel/trojanized installer artifacts by distinctive content markers (x.jsp, u.jsp, tunnel.jsp/jspx, Ple64.exe)
Detects Neo-reGeorg tunnel.jsp/tunnel.jspx servlets used by UNC6240 to establish SOCKS5-over-HTTP(S) tunneling from compromised PeopleSoft PSEMHUB.war hosts
Detects Neo-reGeorg tunnel.jsp/tunnel.jspx servlets used by UNC6240 to establish SOCKS5-over-HTTP(S) tunneling from compromised PeopleSoft PSEMHUB.war hosts
Detects the execution of command shells or common post-exploitation utilities as child processes of network appliance management services (e.g., VPN gateways, firewalls, web servers). This pattern indicates potential exploitation of public-facing infrastructure where an attacker achieves code execution through the management daemon or its web components.
Detects the creation of ransom or extortion note files within known web server directories immediately following suspicious HTTP activity targeting an internet-facing host. This pattern aligns with known ShinyHunters extortion tactics where applications are exploited to deploy extortion notes.
Detects HTTP POST requests directed at Grav CMS endpoints where the __unique_form_id__ parameter contains directory traversal sequences (e.g., ../). This behavior is indicative of attempted exploitation of CVE-2026-42608, aimed at bypassing file system restrictions to write files to unauthorized locations outside the application's expected form data directory.
This rule detects when common web server processes or service accounts spawn unexpected interpreter, shell, or reconnaissance tools, which is a common indicator of post-exploitation activity following a successful Remote Code Execution (RCE) attempt.
Page 3 of 28