Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,208 detections
Filters
Last updated
All Time
Detection languages
708
203
154
38
26
Contributors
191
190
181
159
113
Categories
416
392
385
331
166
Platforms
829
343
197
84
56
Products / Services
10,670
9,758
6,693
4,421
3,749
1,208
MITRE Techniques
421
359
350
273
255
CVEs
16
12
11
10
8
IDS Classtypes
18
2
2
1
1
IDS Protocols
25
Detects execution and network activity related to the PamStealer / Wavel malware campaign, including the JXA dropper and associated C2 infrastructure. The rule monitors for known malicious file hashes (e.g., JXA dropper, pkgunpack utility) and network connections to identified lure, distribution, and C2 domains and URLs used by the campaign.
Detects web application server processes (such as IIS, Apache, Tomcat, Java, Nginx, or Node.js) spawning command-line interpreters or system utilities. This behavior is frequently associated with webshell execution or post-exploitation activities following the exploitation of a public-facing application, often seen in VPN or enterprise software compromises.
This rule detects potential post-exploitation activity following a SharePoint XamlServices.Parse() deserialization attack. It monitors the w3wp.exe (IIS worker process) for the loading of suspicious .NET deserialization-related assemblies (e.g., System.Xaml.dll) followed by the execution of a shell process (cmd.exe, powershell.exe, etc.) within a short window, which is indicative of fileless web shell activity.
Detects Neo-reGeorg tunnel.jsp/tunnel.jspx servlets used by UNC6240 to establish SOCKS5-over-HTTP(S) tunneling from compromised PeopleSoft PSEMHUB.war hosts
Detects activity associated with the SharePoint ToolShell exploitation chain, specifically monitoring the w3wp.exe process for spawning suspicious child processes like cmd.exe or powershell.exe, and the creation of unexpected .aspx files within the SharePoint LAYOUTS directory.
Detects the creation or renaming of files to a .aspx extension within specific web application directories (member file-upload). The rule specifically filters for file operations initiated by the IIS worker process (w3wp.exe) and requires a non-zero file size, identifying potential web shell deployment attempts.
Detects the GitHub Actions runner executing the Bun runtime to run a hidden index.js payload, specifically associated with the compromised 'actions-cool/issues-helper' or 'actions-cool/maintain-one-comment' actions. The rule filters for process execution context tied to GitHub runner internals and validates that the Bun execution follows the pattern observed in these supply chain attacks.
This rule detects unauthorized process creation from the SharePoint worker process (w3wp.exe). It specifically monitors for the spawning of command-line shells or scripting engines, which is indicative of exploitation activity such as remote code execution (RCE) attempts against SharePoint services, including deserialization attacks.
This rule detects unauthorized process creation from the SharePoint worker process (w3wp.exe). It specifically monitors for the spawning of command-line shells or scripting engines, which is indicative of exploitation activity such as remote code execution (RCE) attempts against SharePoint services, including deserialization attacks.
Detects the LEMURLOOT ASP.NET web shell deployed by Cl0p following exploitation of CVE-2023-34362 in MOVEit Transfer
Detects anomalous child process execution (e.g., cmd.exe, powershell.exe) by the Microsoft Exchange IIS worker process (w3wp.exe) or the creation of .aspx files in Exchange web directories. This behavior is highly indicative of post-exploitation activity, such as web shell deployment, frequently observed in attacks targeting vulnerabilities like ProxyShell and ProxyLogon.
Detects web requests targeting common LLM/AI inference API endpoints containing strings indicative of prompt injection attempts, such as attempts to bypass filters, exfiltrate system instructions, or force model behavior changes (e.g., DAN mode).
Detects web requests targeting sensitive Jenkins/CI-CD administrative and build-triggering endpoints, such as /script, /manage, and /job/*/build. These paths are high-value targets for reconnaissance and automated exploitation efforts. This rule identifies potentially malicious activity by monitoring for access to these specific paths, which should be correlated with frequency and source data to differentiate automated scanning from authorized administrative or system activities.
Detects a suspicious sequence of events where a known web server process (e.g., IIS, Nginx, Apache) spawns a command shell process, followed shortly by the creation of a file with a web shell-like extension (.aspx, .jsp, .php) in the same environment. This pattern is indicative of an adversary exploiting a public-facing application to upload and potentially access a web shell.
Detects exploitation attempts against CVE-2026-55040 on Microsoft SharePoint Server. This vulnerability allows an attacker to bypass authentication by sending a malformed JSON Web Token (JWT) with an 'alg: none' header or an empty signature. The SharePoint server incorrectly trusts the provided token, enabling unauthorized access to sensitive API and SOAP endpoints.
Detects the creation of .aspx, .ashx, or .asp files within Exchange OWA/ECP or IIS wwwroot directories by web server processes (w3wp.exe or UMWorkerProcess.exe). This pattern is consistent with web shell deployment following the exploitation of public-facing web applications, a technique often used by threat actors like APT40.
Detects a suspicious sequence of events where a common internet-facing server process (e.g., w3wp.exe, nginx.exe) spawns a potentially malicious child process (e.g., cmd.exe, powershell.exe), followed shortly thereafter by mass file modifications on the same host, which is characteristic of ransomware behavior following initial exploitation.
Detects a suspicious sequence of events where a common internet-facing server process (e.g., w3wp.exe, nginx.exe) spawns a potentially malicious child process (e.g., cmd.exe, powershell.exe), followed shortly thereafter by mass file modifications on the same host, which is characteristic of ransomware behavior following initial exploitation.
Detects a suspicious sequence of events where a common internet-facing server process (e.g., w3wp.exe, nginx.exe) spawns a potentially malicious child process (e.g., cmd.exe, powershell.exe), followed shortly thereafter by mass file modifications on the same host, which is characteristic of ransomware behavior following initial exploitation.
Detects SQL injection exploitation attempts against MOVEit Transfer targeting the CVE-2023-34362 vulnerability, followed by the deployment and subsequent interaction with the 'human2.aspx' webshell associated with Cl0p ransomware mass-exploitation campaigns.
Detects UNC6240 PSEMHUB.war web shell/tunnel/trojanized installer artifacts by distinctive content markers (x.jsp, u.jsp, tunnel.jsp/jspx, Ple64.exe)
Page 4 of 58