Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,133 detections
Filters
Last updated
All Time
Detection languages
762
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
370
241
Platforms
934
682
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
2,133
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
Detects HTTP POST requests containing multipart/form-data with PHP_SESSION_UPLOAD_PROGRESS, which is associated with CVE-2026-109618 and CVE-2026-109619 exploitation attempts, tracked via a detection filter.
Detects multipart POST requests abusing PHP session.upload_progress features, often associated with PHP2Shell exploitation techniques, followed by server errors, crash indicators, or memory corruption terms.
Detects multipart POST requests abusing PHP session.upload_progress features, often associated with PHP2Shell exploitation techniques, followed by server errors, crash indicators, or memory corruption terms.
This analytic detects Suricata multipart POST events with an uploaded filename containing a PHP opening tag.
Suricata EVE HTTP events do not expose multipart form field names, so this variant cannot confirm the PHPSESSID or PHP_SESSION_UPLOAD_PROGRESS fields without additional request-body inspection. The filename pattern may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.
Suricata EVE HTTP events do not expose multipart form field names, so this variant cannot confirm the PHPSESSID or PHP_SESSION_UPLOAD_PROGRESS fields without additional request-body inspection. The filename pattern may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.
Detects exploitation attempts against CVE-2024-4577, a PHP-CGI argument injection vulnerability, by identifying soft-hyphen encoding (%AD) injected alongside PHP configuration options such as allow_url_include and auto_prepend_file=php://input in request URLs.
Correlates devices touched by known IoC IP scan waves with PHP software inventory, vulnerability management data for PHP CVEs, and active PHP process execution telemetry to identify vulnerable exposed web servers.
Detects PHP error log entries indicating a session object decode failure, which may indicate exploitation attempts of CVE-2026-109618 and CVE-2026-109619. Note - the logsource product php / service error is not defined by SigmaHQ. Map it with a processing pipeline to wherever PHP error lines land in your stack (PHP error_log file, nginx or Apache error log, PHP-FPM log, or syslog/journal).
Detects PHP fatal out-of-memory errors reported in Unknown on line 0, indicating a memory exhaustion bailout before request initialization (pre-RINIT), associated with CVE-2026-109618 and CVE-2026-109619 exploitation attempts. Note - the logsource product php / service error is not defined by SigmaHQ. Map it with a processing pipeline to wherever PHP error lines land in your stack (PHP error_log file, nginx or Apache error log, PHP-FPM log, or syslog/journal). If log_errors is Off, or FPM runs with fastcgi.logging Off and catch_workers_output no, the line is never written.
Detects a PHP-FPM child process crashing with signal 11 (SIGSEGV) as logged by the FPM master, which may indicate exploitation attempts following an arm-shaped request. Correlate with the arm fatal error by timestamp and source. Note - the logsource product linux / service php-fpm is not defined by SigmaHQ. Map it with a processing pipeline to the PHP-FPM master log (for example /var/log/php8.x-fpm.log on Debian/Ubuntu, /var/log/php-fpm/error.log on RHEL-family, container stderr for official php-fpm images, or the php-fpm systemd journal unit).
Detects Check Point SmartDefense logs for network detections associated with PHP2Shell, specifically CVE-2026-109618 and CVE-2026-109619
Detects web requests originating from the RedTail botnet user-agent 'libredtail-http' attempting to exploit two or more distinct vulnerability families (such as Apache path traversal, PHP-CGI argument injection, PHPUnit eval-stdin, and ThinkPHP pearcmd) from a single source IP.
Detects HTTP POST requests with multipart form data containing PHP session identifiers and PHP session upload progress parameters, indicative of an exploit attempt against a PHP application vulnerability (CVE-2026-109619).
Detects Akamai SIEM logs for PHP2Shell exploitation attempts associated with CVE-2026-109618 and CVE-2026-109619
This analytic detects suspicious PHP web application requests using Cisco Secure Firewall Threat Defense Intrusion Events.
The matching network signature identifies a serialized input pattern associated with attempts to exploit PHP request handling.
Investigate the source, targeted application, and related web server activity to determine whether the request was part of PHP2Shell exploitation.
The matching network signature identifies a serialized input pattern associated with attempts to exploit PHP request handling.
Investigate the source, targeted application, and related web server activity to determine whether the request was part of PHP2Shell exploitation.
This analytic detects suspicious PHP web application upload activity using Cisco Secure Firewall Threat Defense Intrusion Events.
The matching network signature identifies a request pattern associated with attempts to exhaust server resources through PHP session handling.
Investigate the source, targeted application, and related web server activity to determine whether the request was part of PHP2Shell exploitation.
The matching network signature identifies a request pattern associated with attempts to exhaust server resources through PHP session handling.
Investigate the source, targeted application, and related web server activity to determine whether the request was part of PHP2Shell exploitation.
This analytic detects HTTP POST requests with a declared body size of at least one megabyte that receive an HTTP 500 response or have no response status recorded.
Large failed or unanswered uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.
Large failed or unanswered uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.
This rule aggregates software inventory, vulnerability assessments, network connection events, and exposure graph data to prioritize patching and identify internet-facing devices running PHP with known vulnerabilities or active web listeners.
This analytic detects multipart POST traffic with a serialized PHP structure in an uploaded filename, which may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity.
Suricata EVE's standard HTTP events do not expose multipart form field names, so this Suricata variant cannot confirm the PHP_SESSION_UPLOAD_PROGRESS field without additional request-body inspection.
Suricata EVE's standard HTTP events do not expose multipart form field names, so this Suricata variant cannot confirm the PHP_SESSION_UPLOAD_PROGRESS field without additional request-body inspection.
Detects instances where web server processes or PHP interpreters (apache2, httpd, php-fpm, php) spawn a shell process (sh, bash, dash). This behavior is often indicative of post-exploitation activity such as remote code execution (RCE) via PHP session upload progress or web shell activity.
Detects instances where the Apache web server spawns a shell process (sh, dash, bash) which subsequently executes common discovery or callback utilities (such as id, curl, wget, php, hostname, or uname), typically indicative of web application exploitation or remote code execution.
Detects potential SQL injection probing followed by a successful authentication response (HTTP 302) from the same external client IP within a short timeframe on IIS web servers.
Page 2 of 102