Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,265 detections
Filters
Last updated
All Time
Detection languages
3,338
1,086
505
478
471
Contributors
1,824
1,622
874
505
300
Categories
3,027
2,538
1,075
1,048
927
Platforms
39,934
7,265
6,535
3,865
3,645
Products / Services
1,331
1,107
991
658
494
MITRE Techniques
2,270
1,334
1,318
901
883
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Correlates PHP memory exhaustion or heap corruption error messages with subsequent Apache worker crashes (segfaults, aborts, bus errors) on the same host within a 5-minute window to detect potential exploitation attempts.
Detects Node.js builds, Express, and body-parser libraries vulnerable to CVE-2026-111497 (Node2Shell) via Microsoft Defender vulnerability inventory, process telemetry, and software inventory.
Detects abnormal PHP execution volume storms, process crashes handled by crash reporters (such as werfault.exe, apport, systemd-coredump), or application error events related to PHP, which may indicate denial of service attacks, exploitation attempts, or severe application instability.
Identifies Node.js processes that spawn potentially suspicious child processes, including operating system shells, command interpreters, scripting runtimes, and download utilities. This behaviour may indicate exploitation of a Node.js application resulting in arbitrary command execution, followed by payload retrieval or additional post-exploitation activity.
Detects HTTP POST requests containing multipart/form-data with PHP_SESSION_UPLOAD_PROGRESS, which is associated with CVE-2026-109618 and CVE-2026-109619 exploitation attempts, tracked via a detection filter.
Detects multipart POST requests abusing PHP session.upload_progress features, often associated with PHP2Shell exploitation techniques, followed by server errors, crash indicators, or memory corruption terms.
Detects suspicious post-exploitation activities, reconnaissance, and command execution originating from web server and PHP lineage processes, indicating potential webshell activity or compromised web applications.
Detects multipart POST requests abusing PHP session.upload_progress features, often associated with PHP2Shell exploitation techniques, followed by server errors, crash indicators, or memory corruption terms.
This analytic detects Suricata multipart POST events with an uploaded filename containing a PHP opening tag.
Suricata EVE HTTP events do not expose multipart form field names, so this variant cannot confirm the PHPSESSID or PHP_SESSION_UPLOAD_PROGRESS fields without additional request-body inspection. The filename pattern may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.
Suricata EVE HTTP events do not expose multipart form field names, so this variant cannot confirm the PHPSESSID or PHP_SESSION_UPLOAD_PROGRESS fields without additional request-body inspection. The filename pattern may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.
Detects exploitation of the PHP2Shell RCE vulnerabilities in core PHP
(CVE-2026-109618 out-of-memory corruption and CVE-2026-109619 stale global state),
which allow unauthenticated remote code execution delivered through malicious
multipart uploads. Successful exploitation causes the PHP-FPM/Apache/httpd/lsphp
worker, typically running as www-data, to spawn a system shell (sh, bash, cmd,
powershell) or a download utility (curl, wget) to retrieve a second-stage payload.
A web server process spawning an interactive shell is a high-fidelity indicator of
web application compromise and should be investigated immediately.
(CVE-2026-109618 out-of-memory corruption and CVE-2026-109619 stale global state),
which allow unauthenticated remote code execution delivered through malicious
multipart uploads. Successful exploitation causes the PHP-FPM/Apache/httpd/lsphp
worker, typically running as www-data, to spawn a system shell (sh, bash, cmd,
powershell) or a download utility (curl, wget) to retrieve a second-stage payload.
A web server process spawning an interactive shell is a high-fidelity indicator of
web application compromise and should be investigated immediately.
Detects the presence of the compromised anthropic.claude-code VS Code extension version 2.1.313 or its associated bad hash on disk, reverse SSH tunneling spawned by code editors or extension hosts, and network connections to known malicious C2 IP address 134.209.82.225.
Detects exploitation attempts against CVE-2024-4577, a PHP-CGI argument injection vulnerability, by identifying soft-hyphen encoding (%AD) injected alongside PHP configuration options such as allow_url_include and auto_prepend_file=php://input in request URLs.
Correlates devices touched by known IoC IP scan waves with PHP software inventory, vulnerability management data for PHP CVEs, and active PHP process execution telemetry to identify vulnerable exposed web servers.
Detects malicious file hashes, suspicious process executions involving Node.js/Bun running setup scripts, schtasks/powershell persistence monitoring tasks, and connections to known domains/RPC endpoints associated with threat activity. The query ran without errors in a live tenant.
Detects abnormal PHP execution volume storms, process crashes handled by crash reporters (such as werfault.exe, apport, systemd-coredump), or application error events related to PHP, which may indicate denial of service attacks, exploitation attempts, or severe application instability.
Detects web server worker processes or PHP interpreters spawning suspicious child processes associated with reverse shells, network sockets, or reconnaissance commands.
Detects execution of various PHP interpreter binaries and evaluates their version regarding the new (CVE-2026-109618 / CVE-2026-109619) if upgraded or fix is needed.
Detects PHP error log entries indicating a session object decode failure, which may indicate exploitation attempts of CVE-2026-109618 and CVE-2026-109619. Note - the logsource product php / service error is not defined by SigmaHQ. Map it with a processing pipeline to wherever PHP error lines land in your stack (PHP error_log file, nginx or Apache error log, PHP-FPM log, or syslog/journal).
Detects PHP fatal out-of-memory errors reported in Unknown on line 0, indicating a memory exhaustion bailout before request initialization (pre-RINIT), associated with CVE-2026-109618 and CVE-2026-109619 exploitation attempts. Note - the logsource product php / service error is not defined by SigmaHQ. Map it with a processing pipeline to wherever PHP error lines land in your stack (PHP error_log file, nginx or Apache error log, PHP-FPM log, or syslog/journal). If log_errors is Off, or FPM runs with fastcgi.logging Off and catch_workers_output no, the line is never written.
Detects process command lines containing C2 operator start flags or strings alongside reconnaissance tools or platforms like fofa or skynet.
Detects suspicious post-exploitation activities, reconnaissance, and command execution originating from web server and PHP lineage processes, indicating potential webshell activity or compromised web applications.
Page 2 of 346