Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,208 detections
Filters
Last updated
All Time
Detection languages
708
203
154
38
26
Contributors
191
190
181
159
113
Categories
416
392
385
331
166
Platforms
829
343
197
84
56
Products / Services
10,670
9,758
6,693
4,421
3,749
1,208
MITRE Techniques
421
359
350
273
255
CVEs
16
12
11
10
8
IDS Classtypes
18
2
2
1
1
IDS Protocols
25
Detects potential SQL injection attempts via GET requests in access logs.
Detects suspicious Windows strings in URI which could indicate possible exfiltration or webshell communication
Detects suspicious file type dropped by an Exchange component in IIS
Detects the creation of files with certain extensions on a static web site. This can be indicative of potential uploads of a web shell.
Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.
Detects a suspicious IIS module registration as described in Microsoft threat report on IIS backdoors
When IIS uses an old .Net Framework it's possible to enumerate folders with the symbol "~"
JNDIExploit Pattern
Sigma
Detects exploitation attempt using the JNDI-Exploit-Kit
Detects suspicious file type dropped by an Exchange component in IIS into a suspicious folder
Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords
Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands
Page 58 of 58