Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
99 detections
Filters
Last updated
All Time
Detection languages
41
23
11
10
5
Contributors
39
22
15
7
5
Categories
43
41
21
12
12
Platforms
55
48
10
4
4
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
25
23
21
18
15
CVEs
6
6
1
1
1
IDS Classtypes
3
1
IDS Protocols
4
Detects unauthorized database activity targeting Nacos configuration tables, characterized by the use of MySQL's AES_ENCRYPT function to encrypt records, followed by the deletion of original table data or the issuance of a ransom demand. This behavior is indicative of extortion attempts or agentic ransomware targeting web application backends.
Detects unauthorized modification of the Nacos database users table, specifically identifying direct INSERT or UPDATE statements used to plant a backdoor administrative account. The rule correlates database modifications with abnormal authentication patterns, such as a password hash update occurring after a failed login attempt to the Nacos application.
Detects potential database-native ransomware activity by identifying the use of MySQL encryption functions (AES_ENCRYPT) to encrypt records followed by the execution of DROP TABLE commands. This pattern is consistent with extortion techniques where attackers encrypt internal database data and remove original tables.
Detects the execution of common system administration tools (cmd, powershell, net, nltest, etc.) used to perform environment discovery or credential enumeration, specifically when targeting Domain Controllers, Active Directory objects, database credentials, or sensitive configuration files.
Detects the execution of common system administration tools (cmd, powershell, net, nltest, etc.) used to perform environment discovery or credential enumeration, specifically when targeting Domain Controllers, Active Directory objects, database credentials, or sensitive configuration files.
Detects the execution of common system administration tools (cmd, powershell, net, nltest, etc.) used to perform environment discovery or credential enumeration, specifically when targeting Domain Controllers, Active Directory objects, database credentials, or sensitive configuration files.
Detects the execution of common system administration tools (cmd, powershell, net, nltest, etc.) used to perform environment discovery or credential enumeration, specifically when targeting Domain Controllers, Active Directory objects, database credentials, or sensitive configuration files.
Detects the wp2shell unauthenticated SQL injection chain (CVE-2026-63030 / CVE-2026-60137) abusing the REST API batch-route confusion via author_exclude/author__not_in parameters against wp-json/wp/v2/posts or wp-json/batch/v1, where the extraction result reflects the WordPress 6.9 $wp$2y$ bcrypt-over-HMAC-SHA384 hash marker in the request query or response body. Requires both the specific unauthenticated REST SQLi vector AND the hash-format marker to fire, excluding legitimate authenticated admin export/reporting tools that reference wp_users through normal means.
Detects the wp2shell unauthenticated SQL injection chain (CVE-2026-63030 / CVE-2026-60137) abusing the REST API batch-route confusion via author_exclude/author__not_in parameters against wp-json/wp/v2/posts or wp-json/batch/v1, where the extraction result reflects the WordPress 6.9 $wp$2y$ bcrypt-over-HMAC-SHA384 hash marker in the request query or response body. Requires both the specific unauthenticated REST SQLi vector AND the hash-format marker to fire, excluding legitimate authenticated admin export/reporting tools that reference wp_users through normal means.
Detects attempts to perform error-based SQL injection against WordPress instances associated with the wp2shell exploit chain. The rule monitors for the use of MySQL functions EXTRACTVALUE or UPDATEXML within query parameters that are typically targeted by the exploit (author_exclude, author__not_in) or when interacting with the batch REST endpoint.
Detects attempts to perform error-based SQL injection against WordPress instances associated with the wp2shell exploit chain. The rule monitors for the use of MySQL functions EXTRACTVALUE or UPDATEXML within query parameters that are typically targeted by the exploit (author_exclude, author__not_in) or when interacting with the batch REST endpoint.
Detects the wp2shell unauthenticated SQL injection chain (CVE-2026-63030 / CVE-2026-60137) abusing the REST API batch-route confusion via author_exclude/author__not_in parameters against wp-json/wp/v2/posts or wp-json/batch/v1, where the extraction result reflects the WordPress 6.9 $wp$2y$ bcrypt-over-HMAC-SHA384 hash marker in the request query or response body. Requires both the specific unauthenticated REST SQLi vector AND the hash-format marker to fire, excluding legitimate authenticated admin export/reporting tools that reference wp_users through normal means.
Detects attempts to perform error-based SQL injection against WordPress instances associated with the wp2shell exploit chain. The rule monitors for the use of MySQL functions EXTRACTVALUE or UPDATEXML within query parameters that are typically targeted by the exploit (author_exclude, author__not_in) or when interacting with the batch REST endpoint.
This rule detects the use of database-related processes (mysql) or scripts (python) interacting with MySQL User-Defined Function (UDF) mechanisms. Attackers often abuse UDFs to execute arbitrary commands, load external libraries, or facilitate lateral movement/privilege escalation within a database environment.
This rule detects potentially malicious database manipulation by monitoring process execution command lines for commands that drop critical databases or toggle foreign key checks. It flags instances where multiple drop database commands occur or foreign key constraint toggling is detected, which is often indicative of automated data destruction or ransomware activity within database environments.
This rule detects potentially unauthorized access or activity related to MySQL databases. It monitors for external network connections to the MySQL default port (3306) that originate from non-private IP addresses, and identifies suspicious process command lines using Python's PyMySQL library that attempt to authenticate as the 'root' user.
This rule detects the execution of Python or MySQL command-line utilities where the command line contains strings indicative of 'mysql.func'. This pattern is often associated with the loading of malicious UDFs (User Defined Functions) or other exploitation techniques targeting database environments through script interpreters.
Detects command-line execution of database drop operations combined with the disabling of foreign key constraints, which is indicative of malicious database manipulation or automated data destruction attempts.
This rule detects potentially malicious MySQL database operations involving sensitive file access or suspicious data exportation. It monitors for the use of 'INTO OUTFILE' commands pointing to sensitive paths (like /var/lib/mysql-files/) or the use of 'LOAD_FILE' commands to access system files such as /var/run/docker.sock, /proc/1/cgroup, or /proc/1/mountinfo, which are indicative of attempts to exfiltrate database content or escape a container environment.
Detects potentially malicious activity involving MySQL processes, specifically focusing on the creation of files within the /var/lib/mysql-files/ directory, use of SQL 'INTO OUTFILE' for file output, or the use of 'LOAD_FILE()' to read sensitive system files like /etc/hostname or /proc/1/mountinfo, often indicative of SQL injection exploitation or unauthorized data access.
Detects an unusually large data transfer (greater than 5MB) from an internal MySQL server to an external network, which may indicate unauthorized database record exfiltration or data dumping.
Page 2 of 5