Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,421 detections
Filters
Last updated
All Time
Detection languages
4,217
105
40
25
13
Contributors
1,327
1,003
725
627
332
Categories
2,253
2,239
1,434
1,144
973
Platforms
4,107
453
295
83
82
Products / Services
10,665
9,758
6,693
4,421
3,749
MITRE Techniques
886
774
552
505
456
CVEs
18
12
12
12
10
IDS Classtypes
1,868
466
446
362
230
IDS Protocols
2,366
846
388
301
93
Detects a malformed PHPSESSID Set-Cookie header indicative of CVE-2026-109618, which may result in stale session ID memory disclosure in PHP applications.
Detects HTTP POST requests containing multipart/form-data with PHP_SESSION_UPLOAD_PROGRESS, which is associated with CVE-2026-109618 and CVE-2026-109619 exploitation attempts, tracked via a detection filter.
This analytic detects Suricata multipart POST events with an uploaded filename containing a PHP opening tag.
Suricata EVE HTTP events do not expose multipart form field names, so this variant cannot confirm the PHPSESSID or PHP_SESSION_UPLOAD_PROGRESS fields without additional request-body inspection. The filename pattern may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.
Suricata EVE HTTP events do not expose multipart form field names, so this variant cannot confirm the PHPSESSID or PHP_SESSION_UPLOAD_PROGRESS fields without additional request-body inspection. The filename pattern may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.
This analytic detects multipart POST traffic with a serialized PHP structure in an uploaded filename, which may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity.
Suricata EVE's standard HTTP events do not expose multipart form field names, so this Suricata variant cannot confirm the PHP_SESSION_UPLOAD_PROGRESS field without additional request-body inspection.
Suricata EVE's standard HTTP events do not expose multipart form field names, so this Suricata variant cannot confirm the PHP_SESSION_UPLOAD_PROGRESS field without additional request-body inspection.
This analytic detects HTTP POST requests with a declared body size of at least one megabyte that receive an HTTP 500 response or have no response status recorded.
Large failed or unanswered uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.
Large failed or unanswered uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.
Detects HTTP requests containing serialized PHP objects in the Cookie header matching patterns associated with Zend Framework or Laminas gadget chains, characteristic of PHP object deserialization exploitation (e.g., PHPGGC style).
Detects suspicious DNS queries to external service interaction domains often used for out-of-band interactions after successful RCE
Detects HTTP requests targeting Microsoft Exchange servers that combine the autodiscover.json URI with PowerShell endpoint parameters, indicative of ProxyNotShell vulnerabilities exploitation (CVE-2022-41040 and CVE-2022-41082).
Detects the Mir0Auth phishing kit sequence within a single HTTP flow: POST /task_queue.cs beacon followed by POST /context.go device-code request, both with application/octet-stream bodies. Requires both requests (flowbits) and exact path endings to limit false positives. SIDs made unique.
Detects connections from internal hosts to the ARTEX-linked actor host 38.244.50.120, including requests for the exposed .claude/CLAUDE.md file and its open-directory port 18899.
Detects repeated octet-stream POST polling of /window.rs (5+ in 20s, alerting once per window), matching the ~3s Mir0Auth session polling while the victim completes device login. SID de-duplicated from another rule.
Detects bursts (3+ in 60s) of octet-stream POSTs to URI paths ending in .cs/.go/.rs, matching Mir0Auth XOR-obfuscated C2. Path must be a single short segment and the threshold is raised to cut noise from dev/API traffic.
Detects bursts (3+ in 60s) of octet-stream POSTs to URI paths ending in .cs/.go/.rs, matching Mir0Auth XOR-obfuscated C2. Path must be a single short segment and the threshold is raised to cut noise from dev/API traffic.
Detects bursts (3+ in 60s) of octet-stream POSTs to URI paths ending in .cs/.go/.rs, matching Mir0Auth XOR-obfuscated C2. Path must be a single short segment and the threshold is raised to cut noise from dev/API traffic.
Detects connections from internal hosts to the ARTEX-linked actor host 38.244.50.120, including requests for the exposed .claude/CLAUDE.md file and its open-directory port 18899.
Detects network activity (DNS queries, HTTP Host headers, and TLS SNI) directed towards the known Blinder Tunnel staging domain 'asdfafadafg.online'. This behavior is indicative of command-and-control (C2) communication or initial staging of malicious payloads.
Detects the Mir0Auth phishing kit sequence within a single HTTP flow: POST /task_queue.cs beacon followed by POST /context.go device-code request, both with application/octet-stream bodies. Requires both requests (flowbits) and exact path endings to limit false positives. SIDs made unique.
Detects repeated octet-stream POST polling of /window.rs (5+ in 20s, alerting once per window), matching the ~3s Mir0Auth session polling while the victim completes device login. SID de-duplicated from another rule.
Detects P7 DarkSword implant C2 beaconing: HTTP/1.0 JSON POSTs to /beacon, /event or /a with the hardcoded iPhone OS 18_5 Safari 18.5 User-Agent. Requires the full combination of protocol version, method, URI, UA and content type, and alerts only after 3 matching requests from one source within 120 seconds (detection_filter) to suppress one-off matches.
Detects P7 DarkSword implant C2 beaconing: HTTP/1.0 JSON POSTs to /beacon, /event or /a with the hardcoded iPhone OS 18_5 Safari 18.5 User-Agent. Requires the full combination of protocol version, method, URI, UA and content type, and alerts only after 3 matching requests from one source within 120 seconds (detection_filter) to suppress one-off matches.
Detects HTTP responses and requests involving exposed Claude Code open directories (.claude/CLAUDE.md) tied to ARTEX operator infrastructure.
Page 1 of 211