Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,217 detections
Filters
Last updated
All Time
Detection languages
714
206
154
38
26
Contributors
191
190
181
159
113
Categories
420
398
389
334
167
Platforms
838
349
199
85
56
Products / Services
10,680
9,761
6,694
4,418
3,744
1,217
MITRE Techniques
424
365
352
279
258
CVEs
16
12
11
10
8
IDS Classtypes
18
2
2
1
1
IDS Protocols
25
Detects access patterns indicative of the DEWMODE webshell, which was used in attacks exploiting Accellion FTA. The rule looks for specific query parameters ('?dwn=', '&fn=', '.html?' or '&dwn=', '?fn=', '.html?') within the URI query string, which are characteristic of how this webshell operates.
This rule detects attempts to exploit CVE-2019-3398, a path traversal vulnerability in Confluence. The detection logic specifically looks for HTTP POST requests to '/upload.action' containing the path traversal sequence 'filename=../../../../'. This pattern indicates an attempt to upload a file to an arbitrary location on the server, which is characteristic of the CVE-2019-3398 exploitation.
This rule detects suspicious Windows file path strings (e.g., 'C:/Users', 'C:/Windows', 'C:/Program Files') within the URI query component of web requests. The presence of such strings in a URI could indicate an attempt to exfiltrate data from a Windows system or communicate with a webshell that is attempting to access local files or directories. The rule looks for both standard and URL-encoded variations of these paths.
Detects exploitation attempts against the Oracle WebLogic server vulnerability CVE-2021-2109. The rule specifically looks for GET requests containing 'com.bea.console.handles.JndiBindingHandle', 'ldap://', and 'AdminServer' in the URI query, which are indicators of an attempted JNDI injection via LDAP.
This rule detects a specific HTTP GET request pattern associated with potential exploitation of CVE-2023-36884 by the RomCom threat group. The pattern involves a URI containing '/MSHTML_C7/' and a query parameter 'd' followed by an IPv4 address.
Detects exploitation attempts using the JNDI-Exploit-Kit by looking for specific URI patterns in web server logs. These patterns are indicative of various JNDI injection payloads designed to achieve remote code execution, reverse shells, or memory shell deployments on vulnerable applications like Tomcat, Jetty, Weblogic, JBoss, Websphere, and Spring.
Detects exploitation attempts targeting Microsoft Exchange servers, specifically those associated with the HAFNIUM group's activity. The rule looks for suspicious POST requests to specific URI paths and user-agent strings that were observed during the HAFNIUM attacks.
Detects an authentication bypass vulnerability (CVE-2021-40539) affecting the REST API URLs in Zoho ManageEngine ADSelfService Plus. The rule specifically looks for requests to vulnerable endpoints that could be used to exploit this flaw.
This rule detects potential exploitation attempts targeting the Centos Web Panel (CWP) 7, specifically looking for indicators related to CVE-2022-44877, an unauthenticated remote code execution vulnerability. The detection logic focuses on POST requests to '/login/index.php' containing specific query parameters and keywords often associated with reverse shells or command injection, such as 'login=$(' or base64 encoded 'python' strings.
This rule detects potential exploitation attempts of CVE-2023-23752, an improper access check vulnerability in Joomla's web service endpoints. The detection specifically looks for GET requests to the '/api/index.php/v1/' path with the 'public=true' query parameter, which is indicative of an attempt to bypass access controls.
Detects the creation of suspicious web shell files (ASPX, ASP, ASHX) by the IIS worker process (w3wp.exe) in directories commonly associated with Microsoft Exchange or IIS web roots. This activity is indicative of potential exploitation of Exchange vulnerabilities, such as those used in the ProxyShell or ProxyNotShell attacks, to establish persistence via web shells.
This rule detects attempts to exploit CVE-2010-5278, a directory traversal vulnerability in MODx Revolution. Specifically, it looks for requests to `/manager/controllers/default/resource/tvs.php` with a `class_key` parameter containing a directory traversal sequence (`../../../../../../../../../../`) followed by `windows/win.ini%00`, indicating an attempt to read the `win.ini` file on a Windows server.
Detects exploitation attempts targeting CVE-2020-0688, a remote code execution vulnerability in Microsoft Exchange Server. The rule specifically looks for requests to '/ecp/default.aspx' containing '__VIEWSTATEGENERATOR=' and '__VIEWSTATE=' in the query string, which are indicators of the exploit.
Detects suspicious access to specific URLs associated with the exploitation of the ADSelfService Plus vulnerability CVE-2021-40539. Attackers have been observed targeting these URLs to exploit the vulnerability.
Detects exploitation attempts of Sitecore Experience Platform Pre-Auth RCE CVE-2021-42237. This vulnerability allows for remote code execution without authentication. The rule specifically looks for POST requests to the '/sitecore/shell/ClientBin/Reporting/Report.ashx' endpoint that result in a 200 HTTP status code, indicating a successful interaction with the vulnerable component.
Detects URL patterns indicative of ProxyShell exploitation attempts against Microsoft Exchange servers. The rule looks for specific URI query strings and HTTP status codes (401) that are characteristic of both failed and successful exploitation attempts.
Detects URL patterns and status codes that indicate a successful ProxyShell exploitation attack against Microsoft Exchange servers. The rule looks for requests to '/autodiscover.json' combined with specific URI paths like '/powershell', '/mapi/nspi', or '/EWS', and successful HTTP status codes (200 or 301).
Detects attempts to exploit the VMware Workspace ONE Access Authentication Bypass vulnerability (CVE-2022-31656). This vulnerability allows a malicious actor with network access to the UI to obtain administrative access without authentication by sending a specially crafted URI query.
Detects attempts to exploit an Apache Spark server via CVE-2022-33891, which is a shell command injection vulnerability, by looking for specific patterns in web server query strings.
This rule detects successful attempts to exploit the IIS shortname vulnerability, which allows enumeration of folders when IIS uses an old .Net Framework. The detection logic looks for HTTP GET or OPTIONS requests to URIs containing '~1' and ending with 'a.aspx', combined with successful HTTP status codes (200 or 301). This pattern is indicative of a successful fuzzing scan for the IIS shortname vulnerability.
This rule detects attempts to enumerate source code repositories, specifically Git repositories, by looking for '.git/' in the URL of GET requests. This activity often indicates an attacker attempting to discover exposed source code.
Page 57 of 58