Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,217 detections
Filters
Last updated
All Time
Detection languages
714
206
154
38
26
Contributors
191
190
181
159
113
Categories
420
398
389
334
167
Platforms
838
349
199
85
56
Products / Services
10,680
9,761
6,694
4,418
3,744
1,217
MITRE Techniques
424
365
352
279
258
CVEs
16
12
11
10
8
IDS Classtypes
18
2
2
1
1
IDS Protocols
25
Identifies potentially malicious client-side redirects or forced OAuth flows initiating from the Outlook Web Access (OWA) interface, characterized by 302 statuses and redirect parameters. This activity may indicate post-exploitation actions related to CVE-2026-42897.
Detects unusual JavaScript-related URI query parameters in Exchange IIS logs accessing the OWA directory. This may indicate attempted exploitation of the CVE-2026-42897 XSS vulnerability.
Detects outbound network connections from web server processes to steamcommunity.com, which is used by this malware to fetch steganographically encoded C2 payloads from profile comments.
Detects a temporal pattern characteristic of CVE-2026-42897 XSS exploitation: an OWA user reads a message (via Bind, OpenMessage, or similar EWS/OWA endpoints), and within 60 seconds, the same session issues a POST request to create or modify an inbox rule. This rapid succession from the same session cookie indicates programmatic action (XSS-driven JavaScript) rather than human-driven workflow. The rule correlates events by client IP and username within a 60-second window.
Detects the execution of the public Proof-of-Concept for the "Dirty Frag" Linux Kernel Privilege Escalation vulnerability. It monitors for the specific command-line flags '--force-esp' and '--force-rxrpc', as well as the execution of /bin/sh or /bin/bash with the TERM=xterm environment variable, which is indicative of the PoC's payload.
Detects truncated 'whostmgrsession' cookies missing the comma delimiter, which is a necessary step for attackers to inject cleartext CRLF payloads into cPanel session files and bypass authentication. This rule specifically looks for the 'whostmgrsession' cookie in web or proxy logs where the cookie value matches a regex pattern indicating the absence of the expected comma delimiter, a characteristic of the CVE-2026-41940 exploitation.
Detects the generation of pre-authentication session cookies via intentionally failed login attempts to the `login_only` endpoint. This detects the initial staging phase of the CVE-2026-41940 exploit chain.
Detects the execution of commands used to disable the algif_aead module to mitigate CVE-2026-31431 (Copy Fail). While this is a mitigation step, monitoring for it ensures compliance and tracks remediation efforts.
Detects an IIS worker process (w3wp.exe) spawning cmd.exe with a specific chain of reconnaissance commands (whoami, hostname, ipconfig). This behavior matches the default execution pattern of the 'hc2.aspx' and 'health_check_t.aspx' webshells observed in an Iranian-Nexus operation against Oman's government.
Identifies the creation of specific web shell filenames associated with SHADOW-EARTH-053 within targeted IIS and Exchange Web application directories. This rule detects the creation of known web shell files in critical web server paths, indicating an adversary's attempt to establish persistent access and remote control over the compromised server.
Suspicious IIS Worker Child Process
Cortex XDR
Detects the IIS worker process (w3wp.exe) spawning anomalous or administrative child processes (e.g., rundll32.exe, csvde.exe, nltest.exe), indicative of post-exploitation web shell activity associated with SHADOW-EARTH-053.
Detects process executions containing SSH tunneling or port forwarding parameters correlated with outbound network connections to external public IPs. This may indicate protocol tunneling for evasion or data exfiltration.
Detects SSTI attempts sent via GET requests in access logs
Detects the addition of a new module to an IIS server.
Detects the removal of a previously installed IIS module.
Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.
Detects changes to of the IIS server configuration in order to disable HTTP logging for successful requests.
Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union)
Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence
Detects usage of "appcmd" to create new global URL rewrite rules. This behaviour has been observed being used by threat actors to add new rules so they can access their webshells.
Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common defense evasion technique used by attackers to cover their tracks.
Threat actors often abuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection.
Threat actors often abuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection.
Page 35 of 58