Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,208 detections
Filters
Last updated
All Time
Detection languages
708
203
154
38
26
Contributors
191
190
181
159
113
Categories
416
392
385
331
166
Platforms
829
343
197
84
56
Products / Services
10,670
9,758
6,693
4,421
3,749
1,208
MITRE Techniques
421
359
350
273
255
CVEs
16
12
11
10
8
IDS Classtypes
18
2
2
1
1
IDS Protocols
25
Detects anomalous child process execution (e.g., cmd.exe, powershell.exe, whoami) by PaperCut application processes (java.exe, pc-app.exe, PCClient.exe), which is indicative of post-exploitation activity following an authentication bypass and remote code execution chain against PaperCut NG/MF.
This rule detects activity associated with the exploitation of PaperCut vulnerabilities. It looks for connections to known malicious IP addresses, the presence of specific credential harvesting tools, reconnaissance commands (whoami, tasklist) executed by the PaperCut application (pc-app.exe), suspicious PowerShell downloads of AnyDesk, and unauthorized access to PaperCut configuration files or log files containing known exploit strings.
Detects high-frequency, automated web scraping behavior targeting product catalog pages, indicative of content harvesting for site replication. The rule monitors IIS logs for non-browser user agents (e.g., Python, curl, Scrapy) performing rapid, multi-page requests within a short duration.
Detects potential web reconnaissance or scanning activity against Microsoft IIS servers. The rule identifies suspicious behavior by monitoring for high frequencies of distinct URI requests, excessive 404 Not Found status codes indicative of path brute-forcing, and the presence of known security scanning user-agents.
Detects the creation of a WordPress administrator account within one hour of a recorded web request to a known web shell path (Mushr00w) or suspect plugin upload directory. This correlation is a high-fidelity indicator of post-exploitation persistence and administrative account hijacking.
Detects potential remote code execution (RCE) attempts targeting vulnerable Sub-Store instances (versions < 2.38.2). The detection identifies web browsers making network connections to local ports (38324) associated with Sub-Store, followed by the spawning of shell processes (cmd, powershell, bash, sh) by the Node.js process hosting the application.
This rule detects anomalous access patterns on a specific IIS host (agent.3bb.co.th) by comparing recent traffic against a 30-day historical baseline. It identifies requests from accounts or source IPs not seen in the baseline, activity occurring during off-hours, or traffic from external sources. The rule further filters for high-volume or high-path diversity requests, which are indicative of automated reconnaissance or potential brute-force activity against the web application.
This rule detects anomalous access patterns on a specific IIS host (agent.3bb.co.th) by comparing recent traffic against a 30-day historical baseline. It identifies requests from accounts or source IPs not seen in the baseline, activity occurring during off-hours, or traffic from external sources. The rule further filters for high-volume or high-path diversity requests, which are indicative of automated reconnaissance or potential brute-force activity against the web application.
This rule detects anomalous access patterns on a specific IIS host (agent.3bb.co.th) by comparing recent traffic against a 30-day historical baseline. It identifies requests from accounts or source IPs not seen in the baseline, activity occurring during off-hours, or traffic from external sources. The rule further filters for high-volume or high-path diversity requests, which are indicative of automated reconnaissance or potential brute-force activity against the web application.
This rule detects anomalous access patterns on a specific IIS host (agent.3bb.co.th) by comparing recent traffic against a 30-day historical baseline. It identifies requests from accounts or source IPs not seen in the baseline, activity occurring during off-hours, or traffic from external sources. The rule further filters for high-volume or high-path diversity requests, which are indicative of automated reconnaissance or potential brute-force activity against the web application.
Detects web server processes (e.g., w3wp.exe, nginx.exe, tomcat.exe) spawning command-line interpreters or utilities that could indicate remote code execution, web shell activity, or post-exploitation discovery/download attempts.
Detects web server processes (e.g., w3wp.exe, nginx.exe, tomcat.exe) spawning command-line interpreters or utilities that could indicate remote code execution, web shell activity, or post-exploitation discovery/download attempts.
Detects automated reconnaissance and enumeration of sensitive web application paths (admin, config, environment files, etc.) from a single source IP. The rule identifies high-frequency request patterns that target specific non-public surface areas while excluding known search engine crawlers and monitoring bots.
Detects exploitation attempts against the WordPress LiteSpeed Cache plugin (CVE-2024-28000), including suspicious web requests involving ESI/crawler cookie hash manipulation, execution of known exploit binaries (wp28000, wp28000_cp), and subsequent unauthorized creation of administrator accounts via the WordPress REST API.
Detects instances where base64-encoded PHP code, obfuscated behind a 'data:image/gif;base64' MIME type prefix, is written to the disk as a .php file or initiated by web server processes. This pattern is commonly used in file upload bypass attacks to execute arbitrary code.
Detects anomalous child process execution (e.g., cmd.exe, powershell.exe, whoami) by PaperCut application processes (java.exe, pc-app.exe, PCClient.exe), which is indicative of post-exploitation activity following an authentication bypass and remote code execution chain against PaperCut NG/MF.
Detects high-frequency, automated web scraping behavior targeting product catalog pages, indicative of content harvesting for site replication. The rule monitors IIS logs for non-browser user agents (e.g., Python, curl, Scrapy) performing rapid, multi-page requests within a short duration.
Detects high-frequency, automated web scraping behavior targeting product catalog pages, indicative of content harvesting for site replication. The rule monitors IIS logs for non-browser user agents (e.g., Python, curl, Scrapy) performing rapid, multi-page requests within a short duration.
This rule monitors for web server exploit attempts (indicated by patterns like JNDI lookups or SQL injection sequences in URI/cookie data) that correlate with a surge in server-side errors (400+ status codes) and subsequent anomalous process creation or outbound network connections from the web server process.
Detects unauthenticated requests to the WordPress admin-ajax.php endpoint utilizing the 'super_create_nonce' action. This action allows an unauthenticated user to generate a valid session nonce, which is a critical bypass mechanism often required for the exploitation of vulnerabilities within the Super Forms plugin, such as CVE-2026-14894.
Detects anomalous, high-volume unauthenticated POST requests to the Elementor Pro 'admin-ajax.php' endpoint with the 'elementor_pro_forms_send_form' action. This behavior is indicative of potential exploitation attempts or reconnaissance associated with the Elementor Pro file upload vulnerability (CVE-2026-32475).
Page 15 of 58