Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,208 detections
Filters
Last updated
All Time
Detection languages
708
203
154
38
26
Contributors
191
190
181
159
113
Categories
416
392
385
331
166
Platforms
829
343
197
84
56
Products / Services
10,670
9,758
6,693
4,421
3,749
1,208
MITRE Techniques
421
359
350
273
255
CVEs
16
12
11
10
8
IDS Classtypes
18
2
2
1
1
IDS Protocols
25
Detects an IIS worker process (w3wp.exe) spawning cmd.exe with a specific chain of reconnaissance commands (whoami, hostname, ipconfig). This behavior matches the default execution pattern of the 'hc2.aspx' and 'health_check_t.aspx' webshells observed in an Iranian-Nexus operation against Oman's government.
Identifies the creation of specific web shell filenames associated with SHADOW-EARTH-053 within targeted IIS and Exchange Web application directories. This rule detects the creation of known web shell files in critical web server paths, indicating an adversary's attempt to establish persistent access and remote control over the compromised server.
Suspicious IIS Worker Child Process
Cortex XDR
Detects the IIS worker process (w3wp.exe) spawning anomalous or administrative child processes (e.g., rundll32.exe, csvde.exe, nltest.exe), indicative of post-exploitation web shell activity associated with SHADOW-EARTH-053.
Detects process executions containing SSH tunneling or port forwarding parameters correlated with outbound network connections to external public IPs. This may indicate protocol tunneling for evasion or data exfiltration.
Detects SSTI attempts sent via GET requests in access logs
Detects the addition of a new module to an IIS server.
Detects the removal of a previously installed IIS module.
Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union)
Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.
Detects changes to of the IIS server configuration in order to disable HTTP logging for successful requests.
Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence
Detects usage of "appcmd" to create new global URL rewrite rules. This behaviour has been observed being used by threat actors to add new rules so they can access their webshells.
Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common defense evasion technique used by attackers to cover their tracks.
Threat actors often abuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection.
Threat actors often abuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection.
This rule detects attempts to exploit a vulnerability in ShareFile (CVE-2026-2699/CVE-2026-2701) by monitoring for HTTP GET requests to the `/ConfigService/api/StroageZoneConfig` URI path with a `h=` query parameter. This pattern is indicative of an attacker trying to leak API secrets.
Detects the creation of specific webshell files (GW.class, payload.bin, or dpr_<8-hex-digits>.jsp) associated with CVE-2026-4681 weaponization on PTC Windchill and FlexPLM servers, or suspicious web requests containing patterns which could indicate exploitation attempts.
Detects potential NetScaler administrative session hijacking by monitoring for the usage of SESSID or NITRO_SK administrative cookies from multiple source IPs. Attackers leverage CVE-2026-3055 to steal these specific session cookies to gain unauthorized administrative access.
Detects HTTP GET requests to the vulnerable Citrix NetScaler /wsfed/passive?wctx endpoint, specifically looking for the malformed query string used in CVE-2026-3055 exploitation where 'wctx' is present without an associated value or '=' symbol. This rule combines common network appliance and web server logs to identify potential exploit attempts.
Detects exploitation attempts against Oracle WebLogic via suspicious HTTP requests and command execution patterns. The rule identifies WebLogic-specific endpoints combined with RCE payload indicators such as cmd, bash, powershell, wget, curl, or encoded payloads within the URI query.
This rule detects network connections and DNS resolution requests to known typosquatted domains used by the TeamPCP threat actor for command and control (C2) and data exfiltration. These domains are associated with a compromised Trivy scanner. Detection indicates successful execution of the compromised scanner and attempted exfiltration.
Detects web requests to Cloudflare workers.dev subdomains containing specific keywords commonly used in the EvilTokens device code phishing campaign. The rule specifically looks for a pattern like '[lure-type]-[3char-id].[username]-[domain]...workers.dev' to identify malicious URLs.
Detects instances of the openssl command-line tool being used to encrypt data with AES-256-CBC and RSA OAEP padding. This specific sequence matches the credential encryption pattern observed in the Linux/macOS payload of the malicious telnyx PyPI package attributed to TeamPCP.
Page 35 of 58