Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
599 detections
Filters
Last updated
All Time
Detection languages
198
163
131
22
20
Contributors
127
91
73
69
62
Categories
331
304
132
129
59
Platforms
340
214
204
30
27
Products / Services
10,665
9,773
6,705
4,421
3,749
599
MITRE Techniques
293
211
151
137
110
CVEs
23
23
10
6
6
IDS Classtypes
13
1
1
1
IDS Protocols
16
Detects instances where common web server applications (e.g., Apache, Tomcat, IIS, Nginx) or Java runtime environments spawn suspicious child processes like command shells (cmd.exe, powershell.exe, sh, bash) or network utilities (wget, curl). This behavior often indicates exploitation of a web vulnerability, such as Remote Code Execution (RCE), allowing an adversary to execute commands or download further malicious payloads.
Detects JNDI lookup patterns associated with Log4Shell (CVE-2021-44228) exploitation attempts.
This rule detects suspicious process execution originating from web server applications (e.g., php-fpm, apache2, nginx). It looks for common shell interpreters or command-line utilities (e.g., bash, curl, python) triggered by these web server processes when they contain command execution function strings in their command lines (e.g., system, shell_exec, passthru), which is a common indicator of web shell activity or post-exploitation command execution.
Detects unexpected child process execution (php, bash, sh) by web server processes (php-fpm, apache, nginx) while accessing specific Magento application directories (var/report, var/log/system.log) or parameters often associated with the StyleSmuggler exploitation technique, indicating potential Remote Code Execution.
Detects unexpected child process execution (php, bash, sh) by web server processes (php-fpm, apache, nginx) while accessing specific Magento application directories (var/report, var/log/system.log) or parameters often associated with the StyleSmuggler exploitation technique, indicating potential Remote Code Execution.
Detects instances where common web server processes (e.g., PHP, Apache, Nginx) spawn child processes associated with command-line utilities (e.g., curl, bash, python). The rule specifically monitors for command-line arguments referencing log files or traces, which is indicative of potential exploitation attempts or post-exploitation activities such as log poisoning or remote code execution.
Detects abnormally long request URIs, often indicating fuzzing or buffer-overflow probing.
Detects instances where common web server applications (e.g., Apache, Tomcat, IIS, Nginx) or Java runtime environments spawn suspicious child processes like command shells (cmd.exe, powershell.exe, sh, bash) or network utilities (wget, curl). This behavior often indicates exploitation of a web vulnerability, such as Remote Code Execution (RCE), allowing an adversary to execute commands or download further malicious payloads.
Detects common SQL injection attack patterns such as UNION SELECT, OR 1=1, DROP TABLE, and others within the request URI of Caddy web server logs.
Detects User-Agent strings belonging to common attack/scanning tools.
Detects incoming HTTP requests to a Caddy web server using the TRACE or TRACK methods. These methods are rarely used in legitimate production traffic and are frequently associated with Cross-Site Tracing (XST) attempts, which can be used to bypass security controls and steal sensitive data such as cookies.
Detects instances where common web server processes (e.g., PHP, Apache, Nginx) spawn child processes associated with command-line utilities (e.g., curl, bash, python). The rule specifically monitors for command-line arguments referencing log files or traces, which is indicative of potential exploitation attempts or post-exploitation activities such as log poisoning or remote code execution.
Detects unauthenticated requests to the WordPress admin-ajax.php endpoint utilizing the 'super_create_nonce' action. This action allows an unauthenticated user to generate a valid session nonce, which is a critical bypass mechanism often required for the exploitation of vulnerabilities within the Super Forms plugin, such as CVE-2026-14894.
Detects local/remote file inclusion attempts via php wrappers and similar schemes.
Detects upload requests targeting executable or server-side script file extensions.
Detects access to common authentication/login endpoints.
Detects HTTP upload attempts to web directories where a request URL contains a suspicious double file extension pattern (e.g., a web shell extension followed by an image or document extension). This technique is commonly used to bypass web server or application-level security filters that check for forbidden file types by looking at the final extension while the server might execute the underlying script.
Detects requests for files with names suggesting sensitive content (password, secret, apikey, etc.).
Detects instances where common web server processes (e.g., PHP, Apache, Nginx) spawn child processes associated with command-line utilities (e.g., curl, bash, python). The rule specifically monitors for command-line arguments referencing log files or traces, which is indicative of potential exploitation attempts or post-exploitation activities such as log poisoning or remote code execution.
Detects HTML content that mimics Cloudflare CAPTCHA challenges to perform social engineering (ClickFix). The rule specifically identifies the combination of fake CAPTCHA UI text, connection to suspicious domains (DDR patterns), and JavaScript snippets used to fetch and execute secondary payloads or redirects.
Detects the use of non-standard, unusual, or potentially dangerous HTTP methods within Caddy web server logs, which may indicate reconnaissance, web application exploitation, or attempts to abuse server functionalities like WebDAV.
Page 8 of 29