Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,208 detections
Filters
Last updated
All Time
Detection languages
708
203
154
38
26
Contributors
191
190
181
159
113
Categories
416
392
385
331
166
Platforms
829
343
197
84
56
Products / Services
10,670
9,758
6,693
4,421
3,749
1,208
MITRE Techniques
421
359
350
273
255
CVEs
16
12
11
10
8
IDS Classtypes
18
2
2
1
1
IDS Protocols
25
This rule detects process executions that exhibit patterns commonly associated with China Chopper-like tiny webshells, specifically when they are spawned by the w3wp.exe process (IIS worker process). The detection logic looks for specific command-line arguments that include common discovery and system information commands such as 'ipconfig', 'quser', 'whoami', 'c:', 'cd', 'dir', and echo commands, often used by webshells to interact with the compromised system.
This rule detects suspicious command-line activity originating from common web server processes, indicative of web shell usage for reconnaissance and system interaction. It looks for specific utilities and command-line arguments often used by attackers to discover system information, user accounts, network configurations, and execute arbitrary commands through a compromised web server.
Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells
Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system
Detects potential exploitation of CVE-2024-1212, an unauthenticated command injection vulnerability in Progress Kemp LoadMaster. The rule specifically looks for GET requests to the '/access/set' API with the parameters 'param=enableapi' and 'value=1', combined with an "Authorization" header containing a base64 encoded value with uncommon characters, indicative of an attempted exploit.
Detects potential exploitation attempts of CVE-2023-4966, a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability. The rule specifically looks for GET requests to '/oauth/idp/.well-known/openid-configuration' that result in a 200 HTTP status code, indicating a successful attempt to access this specific endpoint which is part of the vulnerability exploitation chain.
Detects exploitation attempts of CVE-2023-4966, a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability. The rule specifically looks for GET requests to '/oauth/idp/.well-known/openid-configuration' with an unusually long 'cs-host' header string, which is characteristic of the exploit.
Detects exploitation attempts of CVE-2023-46214, a remote code execution (RCE) vulnerability in Splunk Enterprise. The rule specifically looks for patterns associated with known public proof-of-concept (POC) code that leverages insecure XML parsing. It identifies POST requests to specific Splunk API endpoints (`/splunkd/__upload/indexing/preview` or `/api/search/jobs/results`) with particular URI query parameters (`NO_BINARY_CHECK=1`, `input.path=shell.xsl`, `/opt/splunk/var/run/splunk/dispatch/`, `/shell.xsl`) that indicate an attempt to upload and execute a malicious XSL stylesheet.
Detects exploitation attempts of CVE-2023-22518, an improper authorization vulnerability in Confluence Data Center and Server. Attackers can exploit vulnerable endpoints to create admin accounts or execute arbitrary commands. The rule specifically looks for POST requests to known vulnerable URIs associated with setup and restore functionalities.
Detects GET requests to specific files ('/human2.aspx' or '/_human2.aspx') that are known indicators of exploitation attempts targeting the MOVEit Transfer vulnerability CVE-2023-34362. These requests are typically associated with web shell deployment or interaction after initial compromise.
This rule detects command-line activity that attempts to access sensitive Microsoft Teams files, specifically the Cookies or Local Storage\leveldb directories. These locations can contain authentication tokens and other sensitive information. The rule specifically looks for processes other than the legitimate Teams.exe accessing these paths, indicating potential credential theft or unauthorized access.
Detects potential exploitation of CVE-2023-46214, a remote code execution (RCE) vulnerability in Splunk Enterprise. The rule looks for specific HTTP POST requests containing 'NO_BINARY_CHECK=1' and 'input.path' in the URI query, ending with '.xsl', and resulting in a 200 or 302 HTTP status code. These patterns are indicative of an attempt to leverage the insecure XML parsing vulnerability.
Detects the execution of "csc.exe" by the "w3wp.exe" process, specifically looking for patterns indicative of the MOVEit Transfer CVE-2023-34362 exploitation. This activity is associated with dynamic compilation of malicious DLL files within the .NET framework temporary ASP.NET files directory.
Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed in Microsoft Excel. Threat actors could leverage this to run malicious Python code within Excel without user notification.
This rule detects attempts to exploit the ProxyLogon vulnerability (CVE-2021-26858) against Microsoft Exchange Server. Specifically, it looks for POST requests to '/ecp/DDI/DDIService.svc/SetObject' with query parameters indicating a 'schema=Reset' and 'VirtualDirectory' operation, combined with a username ending in '$', which is characteristic of the Server-Side Request Forgery (SSRF) phase of the attack used to manipulate virtual directories.
Detects exploitation attempts targeting the VMware vCenter Server using the file upload vulnerability CVE-2021-22005. The rule specifically looks for POST requests to the '/analytics/telemetry/ph/api/hyper/send?' URI, which is indicative of an attempt to leverage this vulnerability for file upload.
This rule detects exploitation attempts against the Log4j RCE vulnerability, also known as Log4Shell (CVE-2021-44228). It looks for various JNDI (Java Naming and Directory Interface) lookup patterns, including LDAP, RMI, LDAPS, DNS, NIS, NDS, CORBA, and IIOP, as well as obfuscated forms of these patterns, which are commonly used to trigger the vulnerability. The rule specifically filters out known vulnerability scanning traffic from Nessus to reduce false positives.
This rule detects potential SQL injection attempts by looking for common SQL injection strings and keywords within the URI of GET requests in web server access logs. It specifically targets patterns often used to extract database information, bypass authentication, or execute arbitrary SQL commands.
This rule detects attempts to execute common Windows operating system commands via HTTP GET requests, which is a common characteristic of web shell activity. The rule specifically looks for URL-encoded versions of commands like 'whoami', 'net user', 'cmd /c', 'powershell', 'tasklist', 'wmic', 'ssh', 'python', 'ipconfig', 'wget', 'curl', 'certutil', 'copy \\', 'dsquery', and 'nltest'. These commands are often used by attackers to gain information about the compromised system, escalate privileges, or establish further persistence after deploying a web shell.
Detects exploitation attempts against the Log4j RCE vulnerability (CVE-2021-44228), commonly known as Log4Shell. The rule specifically looks for various JNDI injection patterns within web server log fields such as User-Agent, URI query, and Referer headers, which are common vectors for this vulnerability.
Detects attempts to exploit Java-based web applications by identifying common payload strings often used in vulnerabilities like those affecting Confluence (CVE-2022-26134, CVE-2021-26084) and other Java deserialization or expression language injection flaws. The rule looks for specific patterns in web access logs that indicate the presence of Java code execution attempts, such as references to Java classes, runtime execution commands, and encoded characters often used in exploit payloads.
Page 55 of 58