Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
599 detections
Filters
Last updated
All Time
Detection languages
198
163
131
22
20
Contributors
127
91
73
69
62
Categories
331
304
132
129
59
Platforms
340
214
204
30
27
Products / Services
10,665
9,773
6,705
4,421
3,749
599
MITRE Techniques
293
211
151
137
110
CVEs
23
23
10
6
6
IDS Classtypes
13
1
1
1
IDS Protocols
16
Detects instances where common web server applications (e.g., Apache, Tomcat, IIS, Nginx) or Java runtime environments spawn suspicious child processes like command shells (cmd.exe, powershell.exe, sh, bash) or network utilities (wget, curl). This behavior often indicates exploitation of a web vulnerability, such as Remote Code Execution (RCE), allowing an adversary to execute commands or download further malicious payloads.
Detects SSRF attempts targeting cloud metadata endpoints or internal/private network addresses.
Detects C2Looper v1 malware communication patterns, specifically plaintext HTTP beaconing to /api/beacon or /api/result endpoints with characteristic JSON body fields (id, user, host, pid, cmd, arg, seq), as well as direct network connections to known C2Looper command-and-control infrastructure on TCP port 8888.
Detects shell metacharacters combined with common OS commands in the request URI.
Detects suspicious sub processes of web server processes
Detects the creation of .php files within the wp-content/uploads directory tree by common web server or PHP-FPM processes. This behavior is indicative of an adversary attempting to drop a web shell via file upload bypass vulnerabilities, such as those exploiting MIME-type manipulation.
This rule detects potential webshell activity by monitoring the correlation between web server processes spawning suspicious child processes (e.g., cmd.exe, powershell.exe, rundll32.exe) and the creation of executable or script files within identified web directories. The logic establishes a high-confidence correlation when both events occur on the same device within a 15-minute window, while also surfacing uncorrelated individual process spawns or suspicious file writes as lower-confidence indicators. It includes exclusions for known administrative and deployment processes to reduce noise.
Detects the creation of executable script files (PHP, ASP, ASPX, JSP) by web server worker processes (e.g., httpd, nginx, w3wp.exe, php-fpm). This behavior is strongly indicative of the final stage of a web exploitation workflow where an attacker writes a web shell to the server to establish persistence or remote command execution capabilities.
This rule monitors for a sequence of suspicious discovery commands (e.g., whoami, net, ipconfig) executed by web server processes (IIS w3wp.exe, Apache httpd, Nginx, or Tomcat). By requiring a threshold of at least three distinct discovery tools being executed by the same process within a 24-hour period, the rule identifies potential post-exploitation reconnaissance activity following a web server compromise.
Detects incoming web requests (via URI queries or form data) containing common OS command injection characters, shell metacharacters, or command execution patterns indicative of attempts to execute unauthorized commands on the underlying web server.
This rule monitors web server access logs for common attack patterns, including SQL injection, Cross-Site Scripting (XSS), Path Traversal/LFI, Remote File Inclusion (RFI), potential JNDI-based RCE (e.g., Log4Shell patterns), web shell activity, and sensitive endpoint discovery or enumeration (specifically targeting WordPress/CMS).
This rule monitors for a sequence of suspicious discovery commands (e.g., whoami, net, ipconfig) executed by web server processes (IIS w3wp.exe, Apache httpd, Nginx, or Tomcat). By requiring a threshold of at least three distinct discovery tools being executed by the same process within a 24-hour period, the rule identifies potential post-exploitation reconnaissance activity following a web server compromise.
Detects an nginx HTTP Server response header containing a version number identified as vulnerable to CVE-2026-42533 (specifically 0.9.6 through 1.30.3, or 1.31.0 through 1.31.2). This rule identifies potentially exposed or unpatched infrastructure that may be susceptible to exploitation.
Detects repeated Nginx worker process crashes terminated by signals 6 (SIGABRT) or 11 (SIGSEGV) accompanied by core dumps. High-frequency crashes originating from a single source are indicative of an adversary brute-forcing ASLR in preparation for exploitation of memory corruption vulnerabilities (e.g., buffer overflows or heap clobbering) to achieve remote code execution.
Detects instances where an nginx worker process spawns a shell interpreter, such as sh or bash. This behavior is highly irregular for a web server and is often indicative of exploitation of a remote code execution vulnerability, such as the referenced CVE-2026-42533.
This rule detects the use of the Windows utility 'certutil.exe' to download external files, executed from the context of common web server or application processes (e.g., w3wp.exe, nginx.exe). This pattern is a common technique used by attackers to stage malicious payloads or tools in publicly accessible or temporary directories after initial web-based compromise.
This rule detects the use of the Windows utility 'certutil.exe' to download external files, executed from the context of common web server or application processes (e.g., w3wp.exe, nginx.exe). This pattern is a common technique used by attackers to stage malicious payloads or tools in publicly accessible or temporary directories after initial web-based compromise.
Detects potential SQL injection attempts targeting the WordPress REST API batch endpoint (/wp-json/batch/v1) specifically attempting to query the wp_users table for credential fields such as user_pass or user_login.
This rule detects proxy requests directed to the legitimate Microsoft OAuth 2.0 device authorization endpoint (/common/oauth2/deviceauth). This activity is indicative of OAuth device code phishing, where a user is tricked into entering a malicious or attacker-provided device code into the legitimate Microsoft device login page to complete an authentication flow and grant unauthorized access to an attacker-controlled application.
Detects malicious SQL injection attempts targeting WordPress REST API endpoints that attempt to forge post parameters by injecting self-referential cycles. The pattern specifically looks for 'UNION SELECT' combined with 'author_exclude' and manipulated 'post_parent' values, matching known exploitation patterns for the wp2shell vulnerability (CVE-2026-63030 / CVE-2026-60137).
Detects malicious SQL injection attempts targeting WordPress REST API endpoints that attempt to forge post parameters by injecting self-referential cycles. The pattern specifically looks for 'UNION SELECT' combined with 'author_exclude' and manipulated 'post_parent' values, matching known exploitation patterns for the wp2shell vulnerability (CVE-2026-63030 / CVE-2026-60137).
Page 9 of 29