Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,208 detections
Filters
Last updated
All Time
Detection languages
708
203
154
38
26
Contributors
191
190
181
159
113
Categories
416
392
385
331
166
Platforms
829
343
197
84
56
Products / Services
10,650
9,755
6,688
4,418
3,745
1,208
MITRE Techniques
421
359
350
273
255
CVEs
16
12
11
10
8
IDS Classtypes
18
2
2
1
1
IDS Protocols
25
The following analytic identifies the execution of RAR utilities to archive files on a system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, GUIDs, and command-line arguments. This activity is significant as threat actors, including red-teamers and malware like DarkGate, use RAR archiving to compress and exfiltrate collected data from compromised hosts. If confirmed malicious, this behavior could lead to the unauthorized transfer of sensitive information to command and control servers, posing a severe risk to data confidentiality and integrity.
Detects the initial access attempt for the Oracle E-Business Suite vulnerability CVE-2025-61882. This involves a crafted POST request to the UiServlet component containing a malicious XML payload.
Detects command execution characteristic of the AntSword web shell's virtual terminal feature. This is identified by a web server process spawning a child process with a specific command-line structure, often involving `cmd.exe` and echoing unique start and end tags (`stag`/`etag`).
Detects attempts to exploit a SQL injection vulnerability (CVE-2025-57819) in FreePBX via a malicious GET request to '/admin/ajax.php'. Attackers leverage this to achieve remote code execution by inserting a malicious cron job.
Detects suspicious file writes to the root directory of web applications, particularly Apache web servers or Tomcat servers.
This may indicate an attempt to deploy malicious files such as web shells or other unauthorized scripts.
This may indicate an attempt to deploy malicious files such as web shells or other unauthorized scripts.
Detects the deletion of Internet Information Services (IIS) WebServer access logs, which could indicate an adversary attempting to remove forensic evidence of their activities on a compromised web server. The rule specifically looks for delete events targeting files within the common IIS log directory structure (`\inetpub\logs\LogFiles\`) with a `.log` extension.
Detects components of the NET-STAR malware suite, including IIServerCore and AssemblyExecuter, used by the Chinese-nexus APT group Phantom Taurus.
Detects attempts to exploit multiple vulnerabilities (CVE-2025-52905, CVE-2025-52906, CVE-2025-52907) in TOTOLINK X6000R routers. Attackers can leverage argument injection, unauthenticated command injection, and security bypasses through the '/cgi-bin/cstecgi.cgi' endpoint to achieve remote code execution or denial of service.
Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common defense evasion technique used by attackers to cover their tracks. Threat actors often abuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection.
Detects the execution of `cmd.exe` originating from common web server processes (w3wp.exe, httpd.exe, tomcat.exe) with command-line arguments indicative of a webshell. This rule specifically looks for `cmd.exe /c` invocations where the command is not one of the common benign commands used by web servers, aiming to catch malicious command execution through a webshell.
Detects the attempted creation of a file containing 'spinstall0' in specific SharePoint LAYOUTS directories. This activity is a strong indicator of an attempt to exploit the SharePoint Server vulnerability CVE-2025-53770, which could lead to webshell deployment.
This rule detects attempts to exploit CVE-2025-49706 in SharePoint by observing POST requests to a vulnerable aspx path, which could result in code execution or server compromise. Specifically, it looks for HTTP POST requests to URLs containing '/_layouts/1(5|6)/ToolPane.aspx' and 'DisplayMode=Edit' and 'a=/ToolPane.aspx', combined with a referrer URL ending in '/_layouts/1(5|6)/signout.aspx'. This combination of indicators suggests an attempt to leverage the vulnerability for unauthorized access or code execution.
Detects the IIS worker process (w3wp.exe) spawning suspicious child processes like command shells or reconnaissance tools. This is a common post-exploitation pattern observed after compromise of web applications, particularly Microsoft Exchange Server.
Detects the registration of a new IIS module using appcmd.exe, a technique used by adversaries to install malicious components like the BadIIS module for persistence and traffic interception. This rule looks for the specific 'chongxiede' module name or modules registered from suspicious file paths.
Detects the managed .NET IIS module variant of BadIIS, used in the 'Operation Rewrite' campaign for SEO poisoning and traffic redirection.
Detects the PHP file handler variant of BadIIS, used in the 'Operation Rewrite' campaign for SEO poisoning and traffic redirection.
Detects BadIIS malware variants associated with the 'Operation Rewrite' campaign (CL-UNK-1037). This rule identifies the native IIS module, PHP backdoors, and other related components used for SEO poisoning.
Detects the ASP.NET page handler (webshell) used in the 'Operation Rewrite' campaign for SEO poisoning and traffic redirection.
Detects the attempted creation of a file containing 'spinstall0' in specific SharePoint LAYOUTS directories. This activity is a strong indicator of an attempt to exploit the SharePoint Server vulnerability CVE-2025-53770.
This analytic identifies instances where a shell (PowerShell.exe or Cmd.exe) is spawned from W3WP.exe, the IIS worker process. This activity is significant as it may indicate webshell activity, often associated with exploitation attempts like those by the HAFNIUM Group on Exchange servers. If confirmed malicious, this behavior could allow attackers to execute arbitrary commands, potentially leading to system compromise, data exfiltration, or further lateral movement within the network.
Detects the addition of a new module to an IIS server. Adversaries may install malicious IIS modules to observe and/or modify traffic, execute commands on compromised machines, or proxy command and control traffic. This can be used to establish persistence or for defense evasion.
Page 40 of 58