Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
553 detections
Filters
Last updated
All Time
Detection languages
243
124
45
35
32
Contributors
124
91
63
58
25
Categories
233
201
170
131
113
Platforms
364
242
56
8
7
Products / Services
255
130
110
98
60
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
15
14
14
9
8
IDS Classtypes
30
5
IDS Protocols
35
Detects web or FTP server parent processes (such as apache2, httpd, nginx, php-fpm, or proftpd) spawning shell or utility processes (such as bash, sh, python, nc, curl, wget), which is consistent with webshell execution or post-exploitation activities.
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Detects anomalous activities associated with potential PHP2Shell exploitation or webshell deployment where a web server worker (such as Apache, HTTPD, or PHP) spawns a Unix shell containing suspicious utility tokens, drops a PHP file outside excluded directories, or creates a PHP session-derived file.
Detects a sequence where an UpdraftCentral management request is made to a WordPress site followed by plugin installation or user creation requests from the same source within a 30-minute window, potentially indicating unauthorized plugin installation or webshell deployment via compromised management endpoints.
Detects indicators of ToolShell web shell creation (spinstall0.aspx) and ASP.NET machine key harvesting activities (reading web.config or accessing validationkey/decryptionkey materials via w3wp child processes or file access audits) on SharePoint servers.
Detects script files (PHP, JSP, etc.) created or renamed within web root directories by the ProFTPD process, indicating potential exploitation of the mod_copy module (CVE-2015-3306) to upload web shells.
This detection flags a parent and child process pair on internet-facing Windows servers, where the parent is a web server process and the child is the process it launched. The web server processes covered are w3wp, httpd, nginx and Tomcat, including versioned Tomcat service executables such as tomcat9.exe and Tomcat running under java.exe, which is identified by the Catalina bootstrap class in its command line. A server is treated as internet-facing based on the most recent status recorded for it.
Instead of matching known web shell names, the query builds a baseline from the previous 30 days of process activity on each device and alerts when a pair appears in the latest window that has never been seen on that device before, so it can catch web shell activity it has never seen before. Because the baseline is held per device, a pair that is normal on one server does not hide the same pair appearing on another.
The rule runs every 24 hours, as this is the only Defender custom detection frequency with a 30-day lookback, and the alert window covers the last 25 hours so that a slightly delayed run does not leave a gap.
The baseline and alert windows are separated by ingestion time rather than event time, so events that arrive late are still evaluated.
Instead of matching known web shell names, the query builds a baseline from the previous 30 days of process activity on each device and alerts when a pair appears in the latest window that has never been seen on that device before, so it can catch web shell activity it has never seen before. Because the baseline is held per device, a pair that is normal on one server does not hide the same pair appearing on another.
The rule runs every 24 hours, as this is the only Defender custom detection frequency with a 30-day lookback, and the alert window covers the last 25 hours so that a slightly delayed run does not leave a gap.
The baseline and alert windows are separated by ingestion time rather than event time, so events that arrive late are still evaluated.
Detects a PHP file being written into a WordPress content directory
that has no legitimate reason to hold executable code. The wp2shell chain against
CVE-2026-63030 and CVE-2026-60137 stages its payload through wp-content/uploads/
and wp-content/upgrade/ before it lands as a plugin under
wp-content/plugins/wp2shell_/, so both the staging directories and the
campaign's plugin directory shape are matched. uploads/ is the durable half:
WordPress serves user media from it and nothing there should ever be a .php file,
which makes a PHP write there a strong webshell indicator independent of this
campaign.
that has no legitimate reason to hold executable code. The wp2shell chain against
CVE-2026-63030 and CVE-2026-60137 stages its payload through wp-content/uploads/
and wp-content/upgrade/ before it lands as a plugin under
wp-content/plugins/wp2shell_/, so both the staging directories and the
campaign's plugin directory shape are matched. uploads/ is the durable half:
WordPress serves user media from it and nothing there should ever be a .php file,
which makes a PHP write there a strong webshell indicator independent of this
campaign.
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Detects the creation or modification of web script files (.aspx, .jsp) within common web application directories by unusual processes (such as command shells or download utilities) or by non-standard user accounts, indicating potential web shell deployment.
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Detects modification or creation of .htaccess files within WordPress directory structures followed within 24 hours by the creation or modification of .cache files in the same directory. This behavioral pattern is often indicative of web shell deployment or persistence installation via compromised web applications.
Detects post-exploitation activity against Ivanti ICS / Connect Secure
appliances on Windows hosts, where a script host (cmd.exe, powershell.exe, w3wp.exe)
drops a web shell (.aspx/.ashx/.asmx) into the appliance WebRoot or reaches into the
CredentialStore / system binaries. These behaviors are the hallmark of attackers
converting an authenticated file-write or SSRF into persistent remote code execution
and credential theft on edge devices.
appliances on Windows hosts, where a script host (cmd.exe, powershell.exe, w3wp.exe)
drops a web shell (.aspx/.ashx/.asmx) into the appliance WebRoot or reaches into the
CredentialStore / system binaries. These behaviors are the hallmark of attackers
converting an authenticated file-write or SSRF into persistent remote code execution
and credential theft on edge devices.
Detects creation of a JSP/JSPX/WAR server-side script inside
an AhsayCBS installation or web application directory. In this campaign the
actors exploited critical AhsayCBS vulnerabilities and dropped webshells into
the application web directories to maintain persistent remote access. Legitimate
deployment writes scripts from the AhsayCBS updater, not ad-hoc into web roots.
an AhsayCBS installation or web application directory. In this campaign the
actors exploited critical AhsayCBS vulnerabilities and dropped webshells into
the application web directories to maintain persistent remote access. Legitimate
deployment writes scripts from the AhsayCBS updater, not ad-hoc into web roots.
Detects creation of a JSP/JSPX/WAR server-side script inside
an AhsayCBS installation or web application directory. In this campaign the
actors exploited critical AhsayCBS vulnerabilities and dropped webshells into
the application web directories to maintain persistent remote access. Legitimate
deployment writes scripts from the AhsayCBS updater, not ad-hoc into web roots.
an AhsayCBS installation or web application directory. In this campaign the
actors exploited critical AhsayCBS vulnerabilities and dropped webshells into
the application web directories to maintain persistent remote access. Legitimate
deployment writes scripts from the AhsayCBS updater, not ad-hoc into web roots.
This detection flags a parent and child process pair on internet-facing Windows servers, where the parent is a web server process and the child is the process it launched. The web server processes covered are w3wp, httpd, nginx and Tomcat, including versioned Tomcat service executables such as tomcat9.exe and Tomcat running under java.exe, which is identified by the Catalina bootstrap class in its command line. A server is treated as internet-facing based on the most recent status recorded for it.
Instead of matching known web shell names, the query builds a baseline from the previous 30 days of process activity on each device and alerts when a pair appears in the latest window that has never been seen on that device before, so it can catch web shell activity it has never seen before. Because the baseline is held per device, a pair that is normal on one server does not hide the same pair appearing on another.
The rule runs every 24 hours, as this is the only Defender custom detection frequency with a 30-day lookback, and the alert window covers the last 25 hours so that a slightly delayed run does not leave a gap.
The baseline and alert windows are separated by ingestion time rather than event time, so events that arrive late are still evaluated.
Instead of matching known web shell names, the query builds a baseline from the previous 30 days of process activity on each device and alerts when a pair appears in the latest window that has never been seen on that device before, so it can catch web shell activity it has never seen before. Because the baseline is held per device, a pair that is normal on one server does not hide the same pair appearing on another.
The rule runs every 24 hours, as this is the only Defender custom detection frequency with a 30-day lookback, and the alert window covers the last 25 hours so that a slightly delayed run does not leave a gap.
The baseline and alert windows are separated by ingestion time rather than event time, so events that arrive late are still evaluated.
This detection flags a parent and child process pair on internet-facing Windows servers, where the parent is a web server process and the child is the process it launched. The web server processes covered are w3wp, httpd, nginx and Tomcat, including versioned Tomcat service executables such as tomcat9.exe and Tomcat running under java.exe, which is identified by the Catalina bootstrap class in its command line. A server is treated as internet-facing based on the most recent status recorded for it.
Instead of matching known web shell names, the query builds a baseline from the previous 30 days of process activity on each device and alerts when a pair appears in the latest window that has never been seen on that device before, so it can catch web shell activity it has never seen before. Because the baseline is held per device, a pair that is normal on one server does not hide the same pair appearing on another.
The rule runs every 24 hours, as this is the only Defender custom detection frequency with a 30-day lookback, and the alert window covers the last 25 hours so that a slightly delayed run does not leave a gap.
The baseline and alert windows are separated by ingestion time rather than event time, so events that arrive late are still evaluated.
Instead of matching known web shell names, the query builds a baseline from the previous 30 days of process activity on each device and alerts when a pair appears in the latest window that has never been seen on that device before, so it can catch web shell activity it has never seen before. Because the baseline is held per device, a pair that is normal on one server does not hide the same pair appearing on another.
The rule runs every 24 hours, as this is the only Defender custom detection frequency with a 30-day lookback, and the alert window covers the last 25 hours so that a slightly delayed run does not leave a gap.
The baseline and alert windows are separated by ingestion time rather than event time, so events that arrive late are still evaluated.
This rule monitors NetScaler ADC logs for indicators associated with the PitScaler campaign, specifically targeting exploitation of CVE-2026-88771 and CVE-2026-88772. It detects exploitation artifacts (DTLS handshake errors, NSPPE crashes), deployment of WHIPSHOT/SLAPSHOT malware, web shell installation, httpd.conf configuration tampering, persistence mechanisms involving privilege escalation (chmod), and connections to known malicious infrastructure.
This rule monitors NetScaler Syslog events for file creation or modification actions targeting web-accessible directories (/netscaler/, /var/vpn/, /var/netscaler/logon/) involving common web shell scripting extensions (.php, .pl, .sh, .py). It is designed to detect post-exploitation activity such as the manual deployment of backdoors following a vulnerability compromise.
Page 2 of 27