Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,439
11,829
5,873
5,151
4,864
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
This correlation analytic identifies likely PHP2Shell exploitation attempts by correlating a PHP memory disclosure indicator
with either of two independent PHP web exploitation indicators from Cisco Secure Firewall Threat Defense Intrusion Events.
Seeing these behaviors from the same source against the same destination within a short period can indicate an attempt to
improve the reliability of subsequent exploitation. Investigate the complete network and web server activity.
with either of two independent PHP web exploitation indicators from Cisco Secure Firewall Threat Defense Intrusion Events.
Seeing these behaviors from the same source against the same destination within a short period can indicate an attempt to
improve the reliability of subsequent exploitation. Investigate the complete network and web server activity.
Detects a malformed PHPSESSID Set-Cookie header indicative of CVE-2026-109618, which may result in stale session ID memory disclosure in PHP applications.
Detects HTTP POST requests containing multipart/form-data with PHP_SESSION_UPLOAD_PROGRESS, which is associated with CVE-2026-109618 and CVE-2026-109619 exploitation attempts, tracked via a detection filter.
This analytic detects Suricata multipart POST events with an uploaded filename containing a PHP opening tag.
Suricata EVE HTTP events do not expose multipart form field names, so this variant cannot confirm the PHPSESSID or PHP_SESSION_UPLOAD_PROGRESS fields without additional request-body inspection. The filename pattern may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.
Suricata EVE HTTP events do not expose multipart form field names, so this variant cannot confirm the PHPSESSID or PHP_SESSION_UPLOAD_PROGRESS fields without additional request-body inspection. The filename pattern may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.
This analytic detects suspicious PHP web application requests using Cisco Secure Firewall Threat Defense Intrusion Events.
The matching network signature identifies a serialized input pattern associated with attempts to exploit PHP request handling.
Investigate the source, targeted application, and related web server activity to determine whether the request was part of PHP2Shell exploitation.
The matching network signature identifies a serialized input pattern associated with attempts to exploit PHP request handling.
Investigate the source, targeted application, and related web server activity to determine whether the request was part of PHP2Shell exploitation.
This analytic detects suspicious PHP web application upload activity using Cisco Secure Firewall Threat Defense Intrusion Events.
The matching network signature identifies a request pattern associated with attempts to exhaust server resources through PHP session handling.
Investigate the source, targeted application, and related web server activity to determine whether the request was part of PHP2Shell exploitation.
The matching network signature identifies a request pattern associated with attempts to exhaust server resources through PHP session handling.
Investigate the source, targeted application, and related web server activity to determine whether the request was part of PHP2Shell exploitation.
This analytic detects HTTP POST requests with a declared body size of at least one megabyte that receive an HTTP 500 response or have no response status recorded.
Large failed or unanswered uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.
Large failed or unanswered uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.
This analytic detects multipart POST traffic with a serialized PHP structure in an uploaded filename, which may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity.
Suricata EVE's standard HTTP events do not expose multipart form field names, so this Suricata variant cannot confirm the PHP_SESSION_UPLOAD_PROGRESS field without additional request-body inspection.
Suricata EVE's standard HTTP events do not expose multipart form field names, so this Suricata variant cannot confirm the PHP_SESSION_UPLOAD_PROGRESS field without additional request-body inspection.
Detects HTTP requests containing serialized PHP objects in the Cookie header matching patterns associated with Zend Framework or Laminas gadget chains, characteristic of PHP object deserialization exploitation (e.g., PHPGGC style).
Detects a threat raised by the Cisco wireless LAN controller — rogue access points,
containment events and wireless intrusion signatures. Wireless is a physical-access
attack surface that endpoint and network monitoring never observes, and the
controller is the only thing that sees it.
A rogue access point broadcasting the corporate SSID collects credentials from
devices that connect automatically.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='CISCO-AIR-CT5508-K9' and action='THREAT_DETECTED'
| groupby srcip, dstip, threat, user
containment events and wireless intrusion signatures. Wireless is a physical-access
attack surface that endpoint and network monitoring never observes, and the
controller is the only thing that sees it.
A rogue access point broadcasting the corporate SSID collects credentials from
devices that connect automatically.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='CISCO-AIR-CT5508-K9' and action='THREAT_DETECTED'
| groupby srcip, dstip, threat, user
Detects a threat identified by Cisco Meraki. Meraki is the security stack for branch
offices, retail sites and small locations that have no local IT presence — the parts
of an estate least likely to be monitored and most likely to be the way in.
Onboarding: CISCO-MERAKI is ingested via Syslog (Bloo extractor 300).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='CISCO-MERAKI' and action='THREAT_DETECTED'
| groupby srcip, dstip, threat, user
offices, retail sites and small locations that have no local IT presence — the parts
of an estate least likely to be monitored and most likely to be the way in.
Onboarding: CISCO-MERAKI is ingested via Syslog (Bloo extractor 300).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='CISCO-MERAKI' and action='THREAT_DETECTED'
| groupby srcip, dstip, threat, user
Detects an attack identified by the FortiWeb web application firewall. WAF telemetry
is widely collected and almost never turned into detection content — it is usually
left as a vendor dashboard, so repeated targeting of one application by one source
goes unexamined.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='FORTIWEB' and action='THREAT_DETECTED'
| duration 1h
| groupby srcip, dstip, threat
| select srcip, dstip, threat, count(*) as cnt
| having cnt > 10
is widely collected and almost never turned into detection content — it is usually
left as a vendor dashboard, so repeated targeting of one application by one source
goes unexamined.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='FORTIWEB' and action='THREAT_DETECTED'
| duration 1h
| groupby srcip, dstip, threat
| select srcip, dstip, threat, count(*) as cnt
| having cnt > 10
Detects a decoy asset initiating an outbound connection. A decoy should only ever
receive traffic. Outbound activity means the asset has been compromised and is being
used as a launch point, or that attacker tooling on it is calling home.
The destination is live command-and-control infrastructure and should be blocked
estate-wide immediately rather than only on the decoy.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED'
and dstip != ''
| groupby dstip, url, process, srcip
receive traffic. Outbound activity means the asset has been compromised and is being
used as a launch point, or that attacker tooling on it is calling home.
The destination is live command-and-control infrastructure and should be blocked
estate-wide immediately rather than only on the decoy.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED'
and dstip != ''
| groupby dstip, url, process, srcip
Detects HTTP requests targeting Microsoft Exchange servers that combine the autodiscover.json URI with PowerShell endpoint parameters, indicative of ProxyNotShell vulnerabilities exploitation (CVE-2022-41040 and CVE-2022-41082).
Detects the Mir0Auth phishing kit sequence within a single HTTP flow: POST /task_queue.cs beacon followed by POST /context.go device-code request, both with application/octet-stream bodies. Requires both requests (flowbits) and exact path endings to limit false positives. SIDs made unique.
Detects connections from internal hosts to the ARTEX-linked actor host 38.244.50.120, including requests for the exposed .claude/CLAUDE.md file and its open-directory port 18899.
Detects repeated octet-stream POST polling of /window.rs (5+ in 20s, alerting once per window), matching the ~3s Mir0Auth session polling while the victim completes device login. SID de-duplicated from another rule.
Detects bursts (3+ in 60s) of octet-stream POSTs to URI paths ending in .cs/.go/.rs, matching Mir0Auth XOR-obfuscated C2. Path must be a single short segment and the threshold is raised to cut noise from dev/API traffic.
Detects bursts (3+ in 60s) of octet-stream POSTs to URI paths ending in .cs/.go/.rs, matching Mir0Auth XOR-obfuscated C2. Path must be a single short segment and the threshold is raised to cut noise from dev/API traffic.
Detects bursts (3+ in 60s) of octet-stream POSTs to URI paths ending in .cs/.go/.rs, matching Mir0Auth XOR-obfuscated C2. Path must be a single short segment and the threshold is raised to cut noise from dev/API traffic.
Detects connections from internal hosts to the ARTEX-linked actor host 38.244.50.120, including requests for the exposed .claude/CLAUDE.md file and its open-directory port 18899.
Page 1 of 110