Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
101 detections
Filters
Last updated
All Time
Detection languages
39
22
17
7
6
Contributors
39
16
12
11
5
Categories
52
50
32
10
9
Platforms
69
61
11
5
5
Products / Services
10,660
9,755
6,689
4,418
3,748
MITRE Techniques
46
36
27
19
18
CVEs
5
3
3
2
2
IDS Classtypes
1
IDS Protocols
1
Detects post-exploitation activity targeting PaperCut servers, including shells spawned by the PaperCut Java process or the creation of malicious files (such as .class files in lib/ or .txt webshells in custom/web/) by the Java application.
Detects backup service processes writing server-side scripts into web-accessible directories, indicating potential web shell deployment after application compromise.
Detects instances where the Windchill Java/Tomcat application server process spawns command-line interfaces such as cmd.exe, powershell.exe, or bash.exe. This activity is indicative of post-exploitation behavior associated with CVE-2026-12569, where an attacker exploits a deserialization vulnerability to execute arbitrary commands, often for the purpose of dropping web shells.
Detects the execution of discovery or credential access utilities (e.g., whoami, net, reg, ldapsearch) spawned by Java-based server processes like java.exe or tomcat.exe. This activity is often indicative of an attacker leveraging a vulnerable web application to perform reconnaissance or credential harvesting on the host system.
The following analytic detects Log4Shell JNDI payload injections via outbound connections. It identifies suspicious LDAP lookup functions in web logs, such as `${jndi:ldap://PAYLOAD_INJECTED}`, and correlates them with network traffic to known malicious IP addresses. This detection leverages the Web and Network_Traffic data models in Splunk. Monitoring this activity is crucial as it targets vulnerabilities in Java web applications using log4j, potentially leading to remote code execution. If confirmed malicious, attackers could gain unauthorized access, execute arbitrary code, and compromise sensitive data within the affected environment.
Experimental behavioral hunt for a Java process directly spawning a root-owned shell or selected command-line utility on explicitly inventoried ISE devices. Potential post-exploitation signal relevant to ISE Java RCE investigations. It does not prove Java deserialization or identify CVE-2026-20307/20211, and requires verified appliance process telemetry.
Detects potential SQL injection attempts by monitoring for 'INSERT INTO' SQL commands executed via command-line arguments. The rule specifically looks for operations targeting user or role tables and including administrative keywords, originating from database or application-related processes like mysql or java.
Detects potential SQL injection attempts by monitoring for 'INSERT INTO' SQL commands executed via command-line arguments. The rule specifically looks for operations targeting user or role tables and including administrative keywords, originating from database or application-related processes like mysql or java.
This rule detects potential exploitation activities targeting Atlassian Confluence by monitoring for unauthorized access to administrative configuration actions (e.g., setup/setupadministrator.action) and the subsequent addition of accounts to the 'confluence-administrators' group. It correlates process execution, network request patterns, and local user account modifications to identify successful or attempted privilege escalation and configuration manipulation.
Detects Java-based Metasploit/Meterpreter payload files (.class/.jar) dropped post-exploitation, as observed following PaperCut RCE exploitation chain
Detects Java-based Metasploit/Meterpreter payload files (.class/.jar) dropped post-exploitation, as observed following PaperCut RCE exploitation chain
Detects instances where common web server applications (e.g., Apache, Tomcat, IIS, Nginx) or Java runtime environments spawn suspicious child processes like command shells (cmd.exe, powershell.exe, sh, bash) or network utilities (wget, curl). This behavior often indicates exploitation of a web vulnerability, such as Remote Code Execution (RCE), allowing an adversary to execute commands or download further malicious payloads.
Detects cmd.jar, a JAR-based command executor used by threat actors on compromised Cisco Secure FMC to run arbitrary shell commands via /bin/sh -c
Detects Java-based Metasploit/Meterpreter payload files (.class/.jar) dropped post-exploitation, as observed following PaperCut RCE exploitation chain
This rule monitors incoming HTTP requests for the presence of the Base64-encoded string 'rO0AB', which is the standard header for serialized Java objects. The presence of this header in an HTTP request body is a strong indicator of a Java deserialization exploitation attempt.
Detects cmd.jar, a JAR-based command executor used by threat actors on compromised Cisco Secure FMC to run arbitrary shell commands via /bin/sh -c
Detects Java-based Metasploit/Meterpreter payload files (.class/.jar) dropped post-exploitation, as observed following PaperCut RCE exploitation chain
Detects cmd.jar, a JAR-based command executor used by threat actors on compromised Cisco Secure FMC to run arbitrary shell commands via /bin/sh -c
Detects instances where common web server applications (e.g., Apache, Tomcat, IIS, Nginx) or Java runtime environments spawn suspicious child processes like command shells (cmd.exe, powershell.exe, sh, bash) or network utilities (wget, curl). This behavior often indicates exploitation of a web vulnerability, such as Remote Code Execution (RCE), allowing an adversary to execute commands or download further malicious payloads.
Detects instances where common web server applications (e.g., Apache, Tomcat, IIS, Nginx) or Java runtime environments spawn suspicious child processes like command shells (cmd.exe, powershell.exe, sh, bash) or network utilities (wget, curl). This behavior often indicates exploitation of a web vulnerability, such as Remote Code Execution (RCE), allowing an adversary to execute commands or download further malicious payloads.
Detects EDR or JVM stack-trace or exception telemetry indicating the invocation of insecure deserialization methods associated with Log4jLogEvent$LogEventProxy, such as marshalledMessage.get() or MarshalledObject.get(). This pattern is indicative of potential exploitation attempts leveraging vulnerable Log4j libraries for remote code execution.
Page 1 of 5