Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,217 detections
Filters
Last updated
All Time
Detection languages
714
206
154
38
26
Contributors
191
190
181
159
113
Categories
420
398
389
334
167
Platforms
838
349
199
85
56
Products / Services
10,680
9,761
6,694
4,418
3,744
1,217
MITRE Techniques
424
365
352
279
258
CVEs
16
12
11
10
8
IDS Classtypes
18
2
2
1
1
IDS Protocols
25
Detection of common web server reconnaissance, enumeration, and brute-force patterns targeting IIS environments. This includes detection of short-name (~1) probes, WebDAV method usage, NTFS alternate data stream requests, and brute-force attempts on login endpoints originating from PowerShell user agents.
Detects the spawning of common administrative or script-execution tools as child processes from SharePoint-related processes (w3wp.exe or OWSTIMER.EXE). This behavior is often indicative of exploitation attempts targeting SharePoint application pools to execute arbitrary code.
Detects modifications to the creation time of web-accessible script files (.aspx, .php, .asp, .jsp) located in common web directories (wwwroot, inetpub). Adversaries often use timestomping to hide the creation of backdoored web shells, making them appear older and potentially bypassing forensic or integrity-checking mechanisms.
This rule detects potential web shells that employ steganographic techniques by embedding malicious executable script code within image file structures (JPG or PNG). It specifically flags files containing common web shell markers 'ONEPIECE' or 'x_best_911' in combination with embedded script tags (e.g., <script, eval, <%, <?php) within files identified as having image magic bytes.
Detects the creation or renaming of files to a .aspx extension within specific web application directories (member file-upload). The rule specifically filters for file operations initiated by the IIS worker process (w3wp.exe) and requires a non-zero file size, identifying potential web shell deployment attempts.
Detects suspicious activities associated with ysoserial.net gadget chain exploitation targeting SharePoint's w3wp.exe process. The rule correlates the loading of specific .NET assemblies (PresentationFramework, System.Xaml, System.Data.Services) with the subsequent execution of command shells (cmd, powershell) or the presence of common ysoserial.net-related strings (ActivitySurrogateSelector, LosFormatter) within command lines originating from the w3wp.exe process, indicating a potential web shell.
Detects activity associated with the SharePoint ToolShell exploitation chain, specifically monitoring the w3wp.exe process for spawning suspicious child processes like cmd.exe or powershell.exe, and the creation of unexpected .aspx files within the SharePoint LAYOUTS directory.
This rule monitors for the installation of specific known-malicious or suspicious NPM packages that are commonly used in supply chain attacks. It identifies the execution of npm (or node) commands to install or add packages explicitly listed as malicious by security research, which may indicate a supply chain compromise or an attempt to introduce unauthorized code into the development environment.
Detects SQL injection exploitation attempts against MOVEit Transfer targeting the CVE-2023-34362 vulnerability, followed by the deployment and subsequent interaction with the 'human2.aspx' webshell associated with Cl0p ransomware mass-exploitation campaigns.
Detects evidence of a SharePoint pre-authentication RCE exploit chain where an adversary injects a malicious Namespace containing an ExpandedWrapper-wrapped XamlServices payload (e.g., ObjectDataProvider or LosFormatter gadget) into the w3wp.exe worker process. This specifically looks for command-line arguments indicative of deserialization-based exploit attempts targeting SharePoint web server components.
Detects malicious JavaScript injection on e-commerce checkout or payment pages designed to harvest sensitive payment card information (PAN, CVV, expiry) and exfiltrate the stolen data to an external endpoint. This behavior is indicative of a digital credit card skimmer (e.g., Magecart style) deployed following a compromise of the web application.
This rule detects when common web server processes or service accounts spawn unexpected interpreter, shell, or reconnaissance tools, which is a common indicator of post-exploitation activity following a successful Remote Code Execution (RCE) attempt.
Detects the SharePoint application pool worker process (w3wp.exe) spawning command-line interpreters or scripting engines. This behavior is indicative of post-exploitation activity where an attacker, having gained remote code execution via techniques like insecure deserialization, executes commands or deploys in-memory webshells within the context of the IIS worker process.
Detects unauthorized attempts to access SharePoint's WebPartPage ToolPane and Gallery endpoints via anonymous web requests. This pattern, characterized by the 'DisplayMode=Design' query parameter and suspicious markup in the request body, is indicative of exploitation attempts targeting vulnerable SharePoint installations to execute arbitrary code or bypass authentication mechanisms.
Detects anomalous child process execution from SharePoint's w3wp.exe worker process following the loading of suspicious .NET assemblies (PresentationFramework.dll, System.Xaml.dll, System.Data.Services.dll). This behavior is indicative of a post-exploitation stage for SharePoint SafeControls bypass vulnerabilities, where a gadget chain is utilized to execute unmanaged or child processes.
Detects a multi-stage attack chain where an AI-agent's configuration file (e.g., mcp.json) is modified, followed immediately by the execution of a tool process (node/python) spawned by the agent, the subsequent spawning of a shell process, and finally an outbound network connection to a rare, non-standard domain. This sequence is indicative of AI agent tool poisoning, where malicious tool definitions are introduced to execute arbitrary commands and exfiltrate data. Coverts T1195.002, T1565.001, T1059
Detects a multi-stage attack chain where an AI-agent's configuration file (e.g., mcp.json) is modified, followed immediately by the execution of a tool process (node/python) spawned by the agent, the subsequent spawning of a shell process, and finally an outbound network connection to a rare, non-standard domain. This sequence is indicative of AI agent tool poisoning, where malicious tool definitions are introduced to execute arbitrary commands and exfiltrate data. Coverts T1195.002, T1565.001, T1059
Detects a multi-stage attack chain where an AI-agent's configuration file (e.g., mcp.json) is modified, followed immediately by the execution of a tool process (node/python) spawned by the agent, the subsequent spawning of a shell process, and finally an outbound network connection to a rare, non-standard domain. This sequence is indicative of AI agent tool poisoning, where malicious tool definitions are introduced to execute arbitrary commands and exfiltrate data. Coverts T1195.002, T1565.001, T1059
Detects a multi-stage attack chain where an AI-agent's configuration file (e.g., mcp.json) is modified, followed immediately by the execution of a tool process (node/python) spawned by the agent, the subsequent spawning of a shell process, and finally an outbound network connection to a rare, non-standard domain. This sequence is indicative of AI agent tool poisoning, where malicious tool definitions are introduced to execute arbitrary commands and exfiltrate data. Coverts T1195.002, T1565.001, T1059
Detects a multi-stage attack chain where an AI-agent's configuration file (e.g., mcp.json) is modified, followed immediately by the execution of a tool process (node/python) spawned by the agent, the subsequent spawning of a shell process, and finally an outbound network connection to a rare, non-standard domain. This sequence is indicative of AI agent tool poisoning, where malicious tool definitions are introduced to execute arbitrary commands and exfiltrate data. Coverts T1195.002, T1565.001, T1059
Detects a post-compromise pattern on a WordPress site where an attacker, after an initial login, rapidly accesses multiple sensitive administrative pages (plugins.php, profile.php, etc.) within a short window, suggesting nonce harvesting. This activity is correlated with the subsequent creation of a suspected webshell file named 's.php'.
Page 6 of 58