Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,265 detections
Filters
Last updated
All Time
Detection languages
3,338
1,086
505
478
471
Contributors
1,824
1,622
874
505
300
Categories
3,027
2,538
1,075
1,048
927
Platforms
39,934
7,265
6,535
3,865
3,645
Products / Services
1,331
1,107
991
658
494
MITRE Techniques
2,270
1,334
1,318
901
883
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects a PHP-FPM child process crashing with signal 11 (SIGSEGV) as logged by the FPM master, which may indicate exploitation attempts following an arm-shaped request. Correlate with the arm fatal error by timestamp and source. Note - the logsource product linux / service php-fpm is not defined by SigmaHQ. Map it with a processing pipeline to the PHP-FPM master log (for example /var/log/php8.x-fpm.log on Debian/Ubuntu, /var/log/php-fpm/error.log on RHEL-family, container stderr for official php-fpm images, or the php-fpm systemd journal unit).
Detects processes reconnecting to a public IPv4 or IPv6 address after at least 7 days of inactivity on ports other than DNS (53), HTTP (80), HTTPS (443), 8000.
Command-and-control implants often sit idle and then call back to infrastructure they have contacted before. Private, loopback, link-local, multicast and documentation ranges are excluded, and connections are grouped by endpoint, process, remote IP and port, then split into the last 24 hours and the prior history. Backup agents, license checks, update services and scheduled jobs also reconnect on a long cycle, so triage by process, destination reputation and how rare the destination is.
Run this over a search window of 30 days or more.
Command-and-control implants often sit idle and then call back to infrastructure they have contacted before. Private, loopback, link-local, multicast and documentation ranges are excluded, and connections are grouped by endpoint, process, remote IP and port, then split into the last 24 hours and the prior history. Backup agents, license checks, update services and scheduled jobs also reconnect on a long cycle, so triage by process, destination reputation and how rare the destination is.
Run this over a search window of 30 days or more.
Detects web requests originating from the RedTail botnet user-agent 'libredtail-http' attempting to exploit two or more distinct vulnerability families (such as Apache path traversal, PHP-CGI argument injection, PHPUnit eval-stdin, and ThinkPHP pearcmd) from a single source IP.
Detects repeated PHP memory exhaustion (OOM) errors combined with segmentation faults or session warnings within a short timeframe, which may indicate application instability, resource exhaustion attacks, or exploitation attempts.
Detects a sequence where an Apache HTTP server spawns a shell (sh, bash, dash) followed within a 6-hour window by network connections to internal ports (LDAP, SMB, Kerberos) from the same device, indicative of web shell activity and potential internal reconnaissance or relay attempts.
Detects when typical discovery commands (whoami, id, uname, ipconfig) are executed under a web server or PHP process parent, potentially indicating post-exploitation activity following a web application compromise. The rule aggregates distinct commands within a 15-minute window to reduce false positives.
Detects post-exploitation activity targeting PaperCut servers, including shells spawned by the PaperCut Java process or the creation of malicious files (such as .class files in lib/ or .txt webshells in custom/web/) by the Java application.
Detects attempts to download the cache_base file using various command-line utilities (wget, curl, node fetch) on a single device, correlating multiple download methods within a 10-minute window or matching known malicious mirror IOCs.
Detects modifications to Certificate Authority (CA) trust stores, configuration files, or blocklists on Linux and macOS endpoints, followed by trust store update commands within a 30-minute window.
Detects a sequence of events on Linux hosts involving a remote interactive or network logon from an external IP, followed within 5 minutes by root-level process execution, and subsequently within 2 hours by an outbound SSH connection to a private or known attacker IP. Also includes a separate branch for direct logons from known malicious IPs.
Detects process command lines containing Magento database audit strings (cms_block, cms_page) alongside specific loader domains, or network events communicating with these known loader domains.
Detects inbound network connections from known IP addresses associated with PHP2Shell exploitation attempts and malicious tooling infrastructure.
This rule aggregates software inventory, vulnerability assessments, network connection events, and exposure graph data to prioritize patching and identify internet-facing devices running PHP with known vulnerabilities or active web listeners.
Detects PHP SAPI processes accessing /proc/self/mem (or equivalent memory mapping) and subsequently spawning a Unix shell, which is characteristic of web shell activity or exploitation of PHP memory corruption/injection vulnerabilities like zif_system.
Detects files written under Magento pub/media/custom_options/quote by a web server or PHP process, and flags when a subsequent process command line references the uploaded file, indicating potential web shell activity.
Detects an SSH process establishing local port forwarding to a Unix socket (such as docker.sock) or a path containing a socket, followed shortly after (within 15 minutes) by non-administrative tool access to sensitive files like /etc/shadow or Docker sockets on the same device.
Detects a sequence where a process is launched from or references the hidden /tmp/.x directory (indicative of cryptominer deployment), followed within 30 minutes on the same device by a process-check command (such as ps, top, or htop) referencing XMRig or /tmp/.x.
Detects node or agent-initiated npm installation commands (such as npm install or npm i) executed within 24 hours of creating or modifying a developer assistant instruction file (such as AGENTS.md, CLAUDE.md, .cursorrules) in common user directories like Downloads, Desktop, or Temp.
Detects instances where web server processes or PHP interpreters (apache2, httpd, php-fpm, php) spawn a shell process (sh, bash, dash). This behavior is often indicative of post-exploitation activity such as remote code execution (RCE) via PHP session upload progress or web shell activity.
Detects the execution of the Chisel tunneling tool configured as a client building a reverse SOCKS tunnel with flags such as TLS verification disabled, keepalive, or authentication, or communicating with a known C2 endpoint.
Detects the execution of tooling routed through a reverse SOCKS5 pivot via wrappers such as via_socks.sh, proxychains4 with a SOCKS5 configuration, or LD_PRELOAD injection of libproxychains.so.
Page 3 of 346