Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,217 detections
Filters
Last updated
All Time
Detection languages
714
206
154
38
26
Contributors
191
190
181
159
113
Categories
420
398
389
334
167
Platforms
838
349
199
85
56
Products / Services
10,680
9,761
6,694
4,418
3,744
1,217
MITRE Techniques
424
365
352
279
258
CVEs
16
12
11
10
8
IDS Classtypes
18
2
2
1
1
IDS Protocols
25
Detects exploitation attempts targeting the TerraMaster TOS vulnerability CVE-2020-28188. This rule specifically looks for GET requests to '/include/makecvs.php' with a '?Event=' parameter, combined with common command injection payloads such as 'curl', 'wget', '.py', '.sh', 'chmod', or '_GET' in the URI query.
Detects attempts to exploit the VMware Workspace ONE Access Admin Remote Code Execution vulnerability (CVE-2022-31659) by monitoring for POST requests to the '/SAAS/jersey/manager/api/migrate/tenant' URI. This URI is associated with the migration API, and suspicious activity here could indicate an attacker attempting to leverage the vulnerability for remote code execution.
This rule detects suspicious registration of IIS modules, a technique used by adversaries to establish persistence on web servers. It specifically looks for `w3wp.exe` (IIS worker process) as the parent process executing commands related to adding modules via `appcmd.exe`, or using PowerShell with `system.enterpriseservices.internal.publish`, or using `gacutil` with the `/I` flag. These activities are indicative of malicious IIS extensions or backdoors being installed, as described in Microsoft's threat report on IIS backdoors.
This rule detects attempts to disable HTTP logging on a Windows Internet Information Services (IIS) web server using the 'appcmd.exe' utility. Specifically, it looks for command-line arguments that set the 'httplogging' section with 'dontLog:true'. This activity is associated with defense evasion tactics, as observed by threat groups like Threat Group-3390 (Bronze Union), to remove forensic evidence of their activities.
Detects the use of 'aspnet_regiis.exe' with specific command-line arguments to decrypt Microsoft IIS connection strings. This activity is indicative of an attacker, potentially with web shell access, attempting to extract sensitive credentials like MSSQL service account passwords from IIS configurations.
Detects the use of the "appcmd.exe" utility to create or modify global URL rewrite rules within Internet Information Services (IIS). This activity is suspicious because threat actors have been observed leveraging this method to establish persistence or facilitate access to webshells by redirecting traffic or enabling specific paths.
Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands. This activity is often associated with webshells attempting to understand the capabilities of the compromised server.
Java Payload Strings
Sigma
Detects possible Java payloads in web access logs
Detects path traversal exploitation attempts
Detects potential SQL injection attempts via GET requests in access logs.
Detects suspicious Windows strings in URI which could indicate possible exfiltration or webshell communication
Detects suspicious file type dropped by an Exchange component in IIS
Detects the creation of files with certain extensions on a static web site. This can be indicative of potential uploads of a web shell.
Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.
Detects a suspicious IIS module registration as described in Microsoft threat report on IIS backdoors
When IIS uses an old .Net Framework it's possible to enumerate folders with the symbol "~"
JNDIExploit Pattern
Sigma
Detects exploitation attempt using the JNDI-Exploit-Kit
Detects suspicious file type dropped by an Exchange component in IIS into a suspicious folder
Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords
Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands
Page 58 of 58