Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
216 detections
Filters
Last updated
All Time
Detection languages
63
55
53
15
9
Contributors
57
34
30
28
16
Categories
100
75
74
73
39
Platforms
126
94
59
5
4
Products / Services
10,660
9,755
6,689
4,418
3,748
MITRE Techniques
101
79
76
70
59
CVEs
6
5
5
5
4
IDS Classtypes
11
2
1
1
IDS Protocols
15
Detects suspicious command-line activity spawned by the GoAnywhere MFT Tomcat service. This behavior is indicative of post-exploitation techniques observed following the exploitation of CVE-2025-10035, as detailed by Microsoft Threat Intelligence. The detection looks for specific discovery and execution commands launched via cmd.exe or powershell.exe from the GoAnywhere parent process.
Detects suspicious child processes spawned by the GoAnywhere MFT Tomcat service. This behavior is consistent with post-exploitation activity following a successful remote code execution exploit of CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.
Detects suspicious file writes to the root directory of web applications, particularly Apache web servers or Tomcat servers.
This may indicate an attempt to deploy malicious files such as web shells or other unauthorized scripts.
This may indicate an attempt to deploy malicious files such as web shells or other unauthorized scripts.
Detects attempts to exploit multiple vulnerabilities (CVE-2025-52905, CVE-2025-52906, CVE-2025-52907) in TOTOLINK X6000R routers. Attackers can leverage argument injection, unauthenticated command injection, and security bypasses through the '/cgi-bin/cstecgi.cgi' endpoint to achieve remote code execution or denial of service.
Detects the execution of `cmd.exe` originating from common web server processes (w3wp.exe, httpd.exe, tomcat.exe) with command-line arguments indicative of a webshell. This rule specifically looks for `cmd.exe /c` invocations where the command is not one of the common benign commands used by web servers, aiming to catch malicious command execution through a webshell.
This analytic identifies the execution of suspicious processes, such as `cmd.exe`, `powershell.exe`, or `bash.exe`, when they are spawned by web server processes like `w3wp.exe` or `nginx.exe`. This behavior is a strong indicator of WebShell activity, where an adversary exploits a web application vulnerability to gain persistent access and command execution capabilities on the web server. Successful exploitation could lead to arbitrary command execution, privilege escalation, and data exfiltration.
The following analytic identifies attempts to access the Remote ShellServlet on a web server, specifically targeting Confluence servers vulnerable to CVE-2023-22518 and CVE-2023-22515. It leverages web data to detect URLs containing "*plugins/servlet/com.jsos.shell/*" with a status code of 200. This activity is significant as it is commonly associated with web shells and other malicious behaviors, potentially leading to unauthorized command execution. If confirmed malicious, attackers could gain remote code execution capabilities, compromising the server and potentially the entire network.
This analytic detects unexpected outbound network connections initiated by known webserver processes such as `httpd.exe`, `nginx.exe`, or `tomcat.exe` to common file sharing or public content hosting services like GitHub, Discord CDN, Transfer.sh, or Pastebin. Webservers are rarely expected to perform outbound downloads, especially to dynamic or anonymous file hosting domains. This behavior is often associated with server compromise, where an attacker uses a reverse shell, webshell, or injected task to fetch malware or tools post-exploitation. The detection leverages Cisco Network Visibility Module flow data, enriched with process context, to identify this highly suspicious behavior.
This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. Threat actors like Static Tundra have been observed configuring TFTP servers to make device configuration files accessible for exfiltration after gaining initial access. The detection specifically looks for commands that expose critical configuration files such as startup-config, running-config, and other sensitive system information through TFTP. This activity is particularly concerning as it may represent an attempt to steal credentials, network topology information, and other sensitive data stored in device configurations.
Detects attempts to exploit a remote code execution vulnerability (CVE-2024-36401) in GeoServer. Attackers leverage crafted JXPath queries in WFS, WMS, or WPS requests to execute arbitrary commands via Java's getRuntime().exec() method.
The analytic detects when a Windows RDP client attempts to execute an RDP file from a temporary directory, downloads directory, or Outlook directories. This detection is significant as it can indicate an attempt for an adversary to deliver a .rdp file, which may be leveraged by attackers to control or exfiltrate data. If confirmed malicious, this activity could lead to unauthorized access, data theft, or further lateral movement within the network.
This analytic leverages alerts from Splunk AppDynamics SecureApp to identify and monitor exploit attempts targeting business applications. It specifically looks for vulnerabilities in web applications, including injection attacks (SQL, API abuse), deserialization vulnerabilities, remote code execution attempts, LOG4J, and zero-day attacks. These attacks typically aim to gain unauthorized access, exfiltrate sensitive data, or disrupt application functionality. Splunk AppDynamics SecureApp provides real-time detection by analyzing application-layer events and correlating attack behavior with known vulnerability signatures, categorizing attack severity, providing visibility into attacker tactics, and generating risk-based scoring and contextual alerts.
The analytic identifies the execution of the native mimikatz.exe binary on Windows systems, including instances where the binary is renamed. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names. This activity is significant because Mimikatz is a widely used tool for extracting authentication credentials, posing a severe security risk. If confirmed malicious, this activity could allow attackers to obtain sensitive credentials, escalate privileges, and move laterally within the network, leading to potential data breaches and system compromise.
The following analytic identifies the addition and quick deletion of a Service Principal Name (SPN) to a domain account within 5 minutes. This detection leverages EventCode 5136 from the Windows Security Event Log, focusing on changes to the servicePrincipalName attribute. This activity is significant as it may indicate an attempt to perform Kerberoasting, a technique used to crack the cleartext password of a domain account offline. If confirmed malicious, this could allow an attacker to gain unauthorized access to sensitive information or escalate privileges within the domain environment.
This rule detects attempts at Local File Inclusion (LFI) or Remote File Inclusion (RFI) vulnerabilities by analyzing web server logs for specific patterns in the request URI. It looks for directory traversal sequences ('../'), attempts to access common sensitive files like '/etc/passwd', or patterns indicating file inclusion via HTTP or file:// protocols.
KQL Query
The analytic detects outbound SMB (Server Message Block) connections from internal hosts to external servers. It identifies this activity by monitoring network traffic for SMB requests directed towards the Internet, which are unusual for standard operations. This detection is significant for a SOC as it can indicate an attacker's attempt to retrieve credential hashes through compromised servers, a key step in lateral movement and privilege escalation. If confirmed malicious, this activity could lead to unauthorized access to sensitive data and potential full system compromise.
This query was originally published in the threat analytics report, Sysrv botnet evolution.
Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptocurrency.
The following query finds instances of Apache Tomcat 8 being exploited to execute encoded PowerShell commands.
Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptocurrency.
The following query finds instances of Apache Tomcat 8 being exploited to execute encoded PowerShell commands.
This analytic detects suspicious modifications to Unix shell configuration files, such as `.bashrc` or `.profile`, which may indicate an attempt to alter system behavior or gain unauthorized access. Unauthorized changes to these files can be used to execute malicious commands, escalate privileges, or hide malicious activities. By monitoring for unusual or unauthorized modifications to shell configuration files, this analytic helps identify potential security threats, allowing security teams to respond quickly and mitigate risks.
The query checks for suspicious Tomcat process launches associated with likely exploitation of Confluence - CVE-2022-26134
Read more here:.
https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html
https://nvd.nist.gov/vuln/detail/CVE-2022-26134
Tags: #exploit #CVE-2022-26134
Read more here:.
https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html
https://nvd.nist.gov/vuln/detail/CVE-2022-26134
Tags: #exploit #CVE-2022-26134
This query was originally published in the threat analytics report, Operation Soft Cell.
Operation Soft Cell is a series of campaigns targeting users' call logs at telecommunications providers throughout the world. These attacks date from as early as 2012.
Operation Soft Cell operators sometimes use legitimate web server processes to launch commands, especially for network discovery and user/owner discovery. The following query detects activity of this kind.
Reference - https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers
Operation Soft Cell is a series of campaigns targeting users' call logs at telecommunications providers throughout the world. These attacks date from as early as 2012.
Operation Soft Cell operators sometimes use legitimate web server processes to launch commands, especially for network discovery and user/owner discovery. The following query detects activity of this kind.
Reference - https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers
Page 7 of 11