Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,217 detections
Filters
Last updated
All Time
Detection languages
714
206
154
38
26
Contributors
191
190
181
159
113
Categories
420
398
389
334
167
Platforms
838
349
199
85
56
Products / Services
10,680
9,761
6,694
4,418
3,744
1,217
MITRE Techniques
424
365
352
279
258
CVEs
16
12
11
10
8
IDS Classtypes
18
2
2
1
1
IDS Protocols
25
Detects potential web server remote code execution through suspicious child processes launched by PHP, FastCGI, Apache, and IIS workers. Identifies reverse shells, encoded commands, payload retrieval, reconnaissance, and temporary PHP execution.
Further than have the PHP software updated with the supported versions and take actions over the Exposed Devices,having the latest PHP version installed doesn't mean your web applications are actually using it. I would recommend a double check over IIS, Apache or other process that could be executing old PHP Versions even if the server has installed the newest ones, see example : https://lnkd.in/esrKn-FK
Detects HTTP requests carrying a Brotli Content-Encoding request body, which serves as the delivery vector for Node2Shell (CVE-2026-111497), an out-of-bounds write vulnerability in the Brotli decoder bundled with Node.js and Bun.
Detects HTTP POST requests directed at PHP endpoints using scripting-library or vulnerability scanner user agents, which is consistent with PHP2Shell (CVE-2026-109618 / CVE-2026-109619) scanning and exploit probing activity.
Detects web requests attempting to exploit PHP-CGI command-line argument injection vulnerabilities (such as CVE-2012-1823 or the soft-hyphen variant CVE-2024-4577) or inject PHP configuration directives (e.g., allow_url_include, auto_prepend_file, php://input) via query strings or URIs to achieve pre-authentication remote code execution.
Detects when typical discovery commands (whoami, id, uname, ipconfig) are executed under a web server or PHP process parent, potentially indicating post-exploitation activity following a web application compromise. The rule aggregates distinct commands within a 15-minute window to reduce false positives.
Detects hosts running vulnerable or end-of-life (EOL) versions of PHP based on software inventory data, exposing them to potential remote code execution and application-level exploits.
Detects post-compromise persistence activity following PHP Remote Code Execution (RCE), where web server or PHP worker processes spawn commands to create accounts, set up cron jobs, configure scheduled tasks, or write PHP web shell files directly into web server document roots.
Detects potential SQL injection probing followed by a successful authentication response (HTTP 302) from the same external client IP within a short timeframe on IIS web servers.
Detects PHP or web server worker processes spawning network or transfer utilities such as curl, wget, nc, or certutil, which is indicative of post-exploitation activity like web shell command execution.
Detects high volume and diverse URI requests targeting login, search, or inquiry endpoints on IIS servers within a short time window, indicative of web brute force or active reconnaissance scanning.
Detects the creation or modification of web script files (.aspx, .jsp) within common web application directories by unusual processes (such as command shells or download utilities) or by non-standard user accounts, indicating potential web shell deployment.
Detects a suspicious sequence of HTTP requests to an upload endpoint (/upload.php) characterized by alternating GET and POST requests across multiple session cookies, culminating in a large POST body within a short time window. This behavior often indicates web shell staging, file upload exploitation, or automated scanning and exploitation tools targeting web applications.
Detects common reconnaissance commands (whoami, id, uname, ipconfig) executed directly by web server workers or via shells spawned by web workers, indicative of web shell usage or exploitation.
Detects indicators of ToolShell web shell creation (spinstall0.aspx) and ASP.NET machine key harvesting activities (reading web.config or accessing validationkey/decryptionkey materials via w3wp child processes or file access audits) on SharePoint servers.
Detects a sequence where a SharePoint application pool worker process (w3wp.exe) spawns a command shell (cmd.exe, powershell.exe, pwsh.exe) related to SharePoint, followed shortly (within 1 hour) by high-fidelity lateral movement tooling or remote execution techniques (such as PsExec, WMI, PowerShell remoting, or scheduled tasks) on the same host.
Detects high volume and diverse URI requests targeting login, search, or inquiry endpoints on IIS servers within a short time window, indicative of web brute force or active reconnaissance scanning.
Detects a high volume of HTTP POST requests targeting .php endpoints directly on an IIS server without routing through a CDN or WAF, identified by missing X-Forwarded-For headers or empty user agents.
Detects HTTP requests to the PeopleSoft PSEMHUB servlet using alternate
encodings such as the percent-encoded path %50SEMHUB. ShinyHunters/UNC6240 mass-exploit
Oracle PeopleSoft CVE-2026-35273 against internet-facing systems and encode the path to
defeat literal WAF signatures for /PSEMHUB/ (T1190, T1027).
encodings such as the percent-encoded path %50SEMHUB. ShinyHunters/UNC6240 mass-exploit
Oracle PeopleSoft CVE-2026-35273 against internet-facing systems and encode the path to
defeat literal WAF signatures for /PSEMHUB/ (T1190, T1027).
Detects the creation or modification of web script files (.aspx, .jsp) within common web application directories by unusual processes (such as command shells or download utilities) or by non-standard user accounts, indicating potential web shell deployment.
Detects when the IIS worker process (w3wp.exe) spawns command-line utilities or script interpreters such as cmd.exe, powershell.exe, mshta.exe, wscript.exe, or cscript.exe. This behavior often indicates web application exploitation or webshell activity.
Page 1 of 58