Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,208 detections
Filters
Last updated
All Time
Detection languages
708
203
154
38
26
Contributors
191
190
181
159
113
Categories
416
392
385
331
166
Platforms
829
343
197
84
56
Products / Services
10,650
9,755
6,688
4,418
3,745
1,208
MITRE Techniques
421
359
350
273
255
CVEs
16
12
11
10
8
IDS Classtypes
18
2
2
1
1
IDS Protocols
25
Detects attempts to execute the 'dsmain' utility with specific flags (-e, -d, -g) used by RESURGE for AES encryption/decryption of the coreboot RAM disk or to extract the vmlinux kernel image on Ivanti Connect Secure devices.
Detects HTTP requests to vulnerable Ivanti EPMM endpoints containing URI patterns associated with active exploitation of CVE-2026-1281 and CVE-2026-1340. The rule looks for specific URI paths and the presence of a 'gPath' parameter, which is indicative of an exploitation attempt.
Detects the creation of web shells (.aspx, .ashx) in the SmarterMail web root directory by the mail service process. This is a common persistence mechanism used by attackers after exploiting vulnerabilities like CVE-2026-24423 to maintain remote access.
Detects modification of the IIS global configuration file (applicationHost.config) by a process outside of the standard inetsrv directory. This is the primary method BADIIS malware uses to register its malicious module and intercept web traffic.
Detects modification of the IIS global configuration file (applicationHost.config) by a process outside of the standard inetsrv directory. This is the primary method BADIIS malware uses to register its malicious module and intercept web traffic.
Detects HTTP requests containing the specific parameter 'k0f53cf964d387' in the query string or POST body. This parameter is the unique trigger used to activate the dormant 'base.Info' in-memory loader on vulnerable Ivanti EPMM instances.
Detects attempts to deliver a Base64-encoded Java class to an Ivanti EPMM
server. This is characteristic of the "Sleeper Shell" campaign where attackers
plant a dormant in-memory backdoor. The rule looks for the Base64 string
'yv66vg', which corresponds to the 'CAFEBABE' Java magic bytes, in requests
targeting the known vulnerable path.
server. This is characteristic of the "Sleeper Shell" campaign where attackers
plant a dormant in-memory backdoor. The rule looks for the Base64 string
'yv66vg', which corresponds to the 'CAFEBABE' Java magic bytes, in requests
targeting the known vulnerable path.
This detection monitors for web requests to the specific URI path "/mifs/403.jsp". This path is known to be used by attackers to deploy a dormant Java-based webshell ("sleeper shell") on vulnerable Ivanti Endpoint Manager Mobile (EPMM) instances as part of an initial access campaign.
This detection identifies common web attack patterns including SQL Injection (SQLi), Cross-Site Scripting (XSS), and Local File Inclusion (LFI) by inspecting URL and POST data for specific malicious patterns. It looks for indicators such as script tags, onerror/onload attributes, javascript: URIs, alert() functions for XSS; SQL keywords like UNION SELECT, xp_cmdshell, sp_configure, and common SQLi bypass patterns for SQLi; and directory traversal sequences (../../, ..%2f..%2f), and sensitive file paths like /etc/passwd, /windows/win.ini, php://filter for LFI.
Detects the spawning of a Windows command shell, powershell, or reconnaissance tools by the IIS worker process (w3wp.exe). This behavior is a strong indicator of a successful web application exploit, such as the deserialization vulnerability in WSUS (CVE-2025-59287), where an attacker gains remote code execution. Also detects the WSUS Service as the parent process spawning another process.
Detects tar.exe being spawned by processes commonly associated with initial access or lateral movement, such as web servers or remote management services. This activity is highly indicative of post-exploitation activity like data staging.
Detects the IIS worker process (w3wp.exe) spawning a command-line interpreter or reconnaissance tool. This is a common behavior of web shells and in-memory backdoors like IIServerCore, which is part of the NET-STAR malware suite used by the Phantom Taurus APT group.
Detects attempts to exploit the SmarterMail authentication bypass vulnerability (WT-2026-0001) by sending a POST request to the /api/v1/auth/force-reset-password endpoint with 'IsSysAdmin' set to 'true'.
This rule detects an attempt to exploit an XML External Entity (XXE) vulnerability in GeoServer's Web Map Service (WMS) GetMap function. The detection logic looks for HTTP POST requests to the '/wms?' endpoint containing 'request=GetMap' in the URI, and specific XML elements like '<StyledLayerDescriptor>', '<!DOCTYPE', '<!ENTITY', and 'SYSTEM' within the request body, along with a URL-like pattern '://' indicating an attempt to fetch external content.
Detects indicators of React2shell exploitation originating from 'node' or 'next' processes on web-facing or internet-facing assets. This rule identifies suspicious network connections to common web ports (3000, 8080, 443, 80) or process executions containing command-line arguments indicative of prototype pollution exploitation (e.g., '__proto__', 'constructor:constructor', 'process.mainModule.require', 'execSync', 'vm.runInThisContext', 'fs.readFileSync') or common post-exploitation commands ('whoami', '/etc/passwd', 'id', 'env', 'hostname').
Detects HTTP POST requests to n8n '/form/*' endpoints where the Content-Type header is 'application/json'. This indicates an attempt to exploit the Content-Type confusion vulnerability (CVE-2026-21858) to achieve arbitrary file read and subsequent remote code execution.
Detects command injection attempts in HTTP POST requests targeting IoT device web interfaces, a technique used by the RondoDoX botnet to compromise vulnerable devices.
Detects HTTP POST requests containing WDDX XML payloads that attempt to exploit a deserialization vulnerability in Adobe ColdFusion (CVE-2023-26359). The attack leverages a JNDI injection with the 'com.sun.rowset.JdbcRowSetImpl' gadget chain.
This query identifies devices that have accepted inbound web traffic (ports 80/443) where the accepting process is IIS worker (w3wp.exe) or IIS Express (iisexpress.exe). It focuses on public IPv4 sources (excluding RFC1918/private, loopback, and IPv6), helping you surface internet-exposed web servers that are actively receiving external connections.
This rule query identifies likely post‑exploitation activity associated with React2Shell (CVE-2025-55182) in which Part 1 identifies web servers spawning unusual child processes (such as command shells or system utilities) combined with suspicious command-line patterns, which may indicate post-exploitation behavior following a compromise. and part 2 detects web servers making outbound network connections to known malicious IPs or hostnames, or to domains associated with tunneling services (e.g., trycloudflare.com), suggesting potential command-and-control activity or data exfiltration.
Detects outbound network connections from common web server processes to the Telegram API domain (api.telegram.org). This behavior is indicative of the BlackForce phishing kit exfiltrating stolen credentials, as newer versions use a server-side component to relay data to a Telegram channel.
Page 37 of 58