Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
576 detections
Filters
Last updated
All Time
Detection languages
175
168
120
26
25
Contributors
96
80
79
77
61
Categories
297
296
144
138
69
Platforms
347
214
188
27
21
Products / Services
10,665
9,758
6,692
4,418
3,749
576
MITRE Techniques
286
211
161
144
130
CVEs
23
23
11
6
6
IDS Classtypes
15
1
1
1
1
IDS Protocols
19
Detects incoming HTTP requests to FortiSandbox administrative or management endpoints that contain suspicious shell metacharacters and command-injection patterns. These patterns are indicative of attempts to exploit CVE-2026-25089, an unauthenticated remote command injection vulnerability in the FortiSandbox Web UI.
The following analytic identifies attempts to inject Log4Shell JNDI payloads via web calls. It leverages the Web datamodel and uses regex to detect patterns like `${jndi:ldap://` in raw web event data, including HTTP headers. This activity is significant because it targets vulnerabilities in Java web applications using Log4j, such as Apache Struts and Solr. If confirmed malicious, this could allow attackers to execute arbitrary code, potentially leading to full system compromise. Immediate investigation is required to determine if the attempt was successful and to mitigate any potential exploitation.
Detects incoming HTTP requests where the 'pagename' parameter contains directory traversal sequences (e.g., '../', '..%2f'). These attempts are typically indicative of automated vulnerability scanning or exploitation attempts targeting WordPress page-template resolution logic, specifically related to CVE-2026-87902.
Detects non-browser automated HTTP clients (e.g., Python, Wget, Curl, Scrapy) downloading audio/video files from corporate public-facing pages such as Investor Relations, Press Releases, and Executive profiles. This activity is indicative of malicious reconnaissance used to harvest voice or video samples for synthetic media (deepfake) creation for future social engineering or impersonation attacks.
This rule detects potential web shell activity by identifying instances where a web server process creates or modifies a PHP file within a 'wp-content/themes' directory, followed closely (within 15 minutes) by that same web server process spawning a shell process (e.g., sh, bash, cmd.exe).
This rule detects potential web shell activity by identifying instances where a web server process creates or modifies a PHP file within a 'wp-content/themes' directory, followed closely (within 15 minutes) by that same web server process spawning a shell process (e.g., sh, bash, cmd.exe).
Detects web server processes (e.g., Apache, Nginx, PHP-FPM, IIS) launching suspicious shell or system administration utilities. This behavior is indicative of a web server compromise, potentially involving the use of web shells or the exploitation of public-facing web applications to execute arbitrary commands.
Detects HTTP requests that use URL-encoded backslash traversal sequences
("..%5C") to walk out of a Next.js dynamic route and request the
"server-reference-manifest" file, which discloses the Server Action
encryption key. This is the reconnaissance/priming stage of CVE-2026-75604
RCE exploitation, observed against both the App Router and the Pages
Router ("/_next/data/<buildId>/.../server-reference-manifest.json").
("..%5C") to walk out of a Next.js dynamic route and request the
"server-reference-manifest" file, which discloses the Server Action
encryption key. This is the reconnaissance/priming stage of CVE-2026-75604
RCE exploitation, observed against both the App Router and the Pages
Router ("/_next/data/<buildId>/.../server-reference-manifest.json").
Detects PHP web shells dropped into wp-content/uploads or plugin directories following WordPress plugin exploitation, characterized by host detail reporting and a browser-based file upload form
The following analytic identifies unusually long strings in the Content-Type HTTP header sent by the client to the server. It uses data from the Stream:HTTP source, specifically evaluating the length of the `cs_content_type` field. This activity is significant because excessively long Content-Type headers can indicate attempts to exploit vulnerabilities or evade detection mechanisms. If confirmed malicious, this behavior could allow attackers to execute code, manipulate data, or bypass security controls, potentially leading to unauthorized access or data breaches.
Detects malicious PHP web shell patterns (e.g., base64_decode, system, eval, passthru) within the WordPress plugins directory. This often indicates the presence of a trojanized plugin update or unauthorized file modification following a supply chain compromise.
Detects PHP web shells dropped into wp-content/uploads or plugin directories following WordPress plugin exploitation, characterized by host detail reporting and a browser-based file upload form
Detects instances where web server worker processes such as php-fpm, apache, or nginx spawn shell interpreters (sh, bash, dash). This behavior is often indicative of web shell execution, where an adversary leverages a compromised web application to execute arbitrary commands on the underlying host.
Detects suspicious Python execution patterns commonly associated with web shells or remote code execution, originating from typical web server or application middleware processes (e.g., w3wp, nginx, httpd, tomcat). The detection triggers on specific patterns including base64-encoded command execution, Python evaluation of base64-encoded strings, or long alphanumeric command-line strings suggesting obfuscated code execution.
Detects the forged Next.js Server Action invocation used to deliver the
RCE payload after the encryption key has been disclosed. The request is
a multipart/form-data POST containing a "$ACTION_REF_*" field together
with the numbered "$ACTION_<ref>:0/1/2" descriptor fields (action id,
argument list, base64-encoded AES-GCM ciphertext for the closure-bound
args) plus one additional attacker-controlled form field carrying the
payload. Legitimate Server Action calls originate only from the app's
own client bundle and do not normally arrive as raw multipart posts
crafted with a generic HTTP client / no browser fingerprint, especially
shortly after a manifest-disclosure request from the same source (see
companion rule "Next.js Server-Reference-Manifest Disclosure via
Backslash Path Traversal").
RCE payload after the encryption key has been disclosed. The request is
a multipart/form-data POST containing a "$ACTION_REF_*" field together
with the numbered "$ACTION_<ref>:0/1/2" descriptor fields (action id,
argument list, base64-encoded AES-GCM ciphertext for the closure-bound
args) plus one additional attacker-controlled form field carrying the
payload. Legitimate Server Action calls originate only from the app's
own client bundle and do not normally arrive as raw multipart posts
crafted with a generic HTTP client / no browser fingerprint, especially
shortly after a manifest-disclosure request from the same source (see
companion rule "Next.js Server-Reference-Manifest Disclosure via
Backslash Path Traversal").
Detects unauthorized attempts to modify WordPress user tables (wp_usermeta) by web server processes to escalate privileges, specifically targeting the 'wp_capabilities' or 'administrator' flags. This activity is indicative of an exploit or post-exploitation behavior following a web-based attack.
Detects PHP web shells dropped into wp-content/uploads or plugin directories following WordPress plugin exploitation, characterized by host detail reporting and a browser-based file upload form
Detects unauthenticated requests to the WordPress admin-ajax.php endpoint utilizing the 'super_create_nonce' action. This action allows an unauthenticated user to generate a valid session nonce, which is a critical bypass mechanism often required for the exploitation of vulnerabilities within the Super Forms plugin, such as CVE-2026-14894.
Detects anomalous serialized object payloads within authenticated GraphQL subscription requests to GitLab Duo Chat endpoints. This pattern is indicative of exploitation attempts targeting the insecure deserialization vulnerability in GitLab EE (CVE-2026-87719), where malicious payloads are injected into serialized data streams.
Detects anomalous, high-volume unauthenticated POST requests to the Elementor Pro 'admin-ajax.php' endpoint with the 'elementor_pro_forms_send_form' action. This behavior is indicative of potential exploitation attempts or reconnaissance associated with the Elementor Pro file upload vulnerability (CVE-2026-32475).
Detects instances where base64-encoded PHP code, obfuscated behind a 'data:image/gif;base64' MIME type prefix, is written to the disk as a .php file or initiated by web server processes. This pattern is commonly used in file upload bypass attacks to execute arbitrary code.
Page 5 of 28