Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,208 detections
Filters
Last updated
All Time
Detection languages
708
203
154
38
26
Contributors
191
190
181
159
113
Categories
416
392
385
331
166
Platforms
829
343
197
84
56
Products / Services
10,670
9,758
6,693
4,421
3,749
1,208
MITRE Techniques
421
359
350
273
255
CVEs
16
12
11
10
8
IDS Classtypes
18
2
2
1
1
IDS Protocols
25
Detects malicious shell commands attempting to perform supply-chain persistence via environment variable manipulation in CI/CD environments. The rule identifies processes injecting BASH_ENV into GITHUB_ENV, a known technique used by the SCKIT supply-chain worm to perform credential harvesting during CI pipeline execution.
Detects malicious shell commands attempting to perform supply-chain persistence via environment variable manipulation in CI/CD environments. The rule identifies processes injecting BASH_ENV into GITHUB_ENV, a known technique used by the SCKIT supply-chain worm to perform credential harvesting during CI pipeline execution.
This rule detects potential post-exploitation activity following a SharePoint XamlServices.Parse() deserialization attack. It monitors the w3wp.exe (IIS worker process) for the loading of suspicious .NET deserialization-related assemblies (e.g., System.Xaml.dll) followed by the execution of a shell process (cmd.exe, powershell.exe, etc.) within a short window, which is indicative of fileless web shell activity.
Detects suspicious activities associated with ysoserial.net gadget chain exploitation targeting SharePoint's w3wp.exe process. The rule correlates the loading of specific .NET assemblies (PresentationFramework, System.Xaml, System.Data.Services) with the subsequent execution of command shells (cmd, powershell) or the presence of common ysoserial.net-related strings (ActivitySurrogateSelector, LosFormatter) within command lines originating from the w3wp.exe process, indicating a potential web shell.
This rule detects malicious shell execution patterns associated with ClickFix-based social engineering campaigns, such as the Macfinger AMOS campaign. It monitors for the execution of common shell utilities (curl, wget, bash, sh) with suspicious command-line parameters ('force=1') interacting with known malicious IP addresses (45.150.33.128), as well as the execution of specific malicious files or network callbacks identified in these campaigns.
Detects evidence of the CARBONATO post-exploitation pattern, specifically identifying the installation of a Hermes Agent by monitoring the creation of a 'SOUL.md' persona file within a '.hermes' folder, followed by correlated outbound network traffic to a specific LLM gateway or known Vercel proxy infrastructure used for command relay.
Detects potential web shell installation via WordPress administrative panels. The rule identifies a WordPress administrator session executing a theme installation request triggered by an external (off-site) referer, followed shortly thereafter by the creation of new PHP files within the WordPress themes directory. This pattern is often indicative of an attacker leveraging a compromised admin session to upload a backdoor.
Detects anomalous patterns associated with potential WordPress comment moderation bypass. The rule identifies suspicious rapid sequences of comment submissions, use of unapproved comment preview endpoints with moderation hashes, or reuse of approved-commenter cookies. These behaviors can be indicative of an attacker attempting to preview or force-render stored XSS payloads to administrators or visitors before the comment has been officially approved.
Detects potential zero-click administrator session hijacking by correlating a logged-in administrator accessing a page containing user-generated content (e.g., comments) followed immediately by a sensitive administrative action (e.g., plugin installation, user creation) within a 5-second window, suggesting automated script execution via an autofocus/onfocus handler triggered by the admin's browser.
Detects web reconnaissance activity characterized by the use of User-Agent strings associated with automated AI agent frameworks and headless browser libraries (e.g., LangChain, AutoGPT, Playwright, Selenium, python-requests). These tools are frequently utilized in autonomous exploitation scenarios to scan multiple URI paths on a web server in a short timeframe.
Detects a multi-stage attack chain involving the download, extraction, permission modification, and execution of the XMRig cryptocurrency miner on Linux systems. The rule specifically monitors for common staging patterns in /tmp and the use of known mining-related CLI arguments.
Detects credential-spraying activity against WordPress sites where an actor performs a sequence of POST requests targeting both xmlrpc.php (typically the 'wp.getUsersBlogs' method) and wp-login.php. The rule specifically identifies attackers that attempt to evade detection or increase success rates by falling back to wp-login.php after initially using XML-RPC within a short duration.
Detects web or application server processes (Apache, Nginx, IIS, Tomcat, PHP) spawning command interpreters or scripting engines. This behavior is indicative of a post-exploitation activity where an attacker executes commands following a remote code execution exploit against the web application.
Detects the GitHub Actions runner executing the Bun runtime to run a hidden index.js payload, specifically associated with the compromised 'actions-cool/issues-helper' or 'actions-cool/maintain-one-comment' actions. The rule filters for process execution context tied to GitHub runner internals and validates that the Bun execution follows the pattern observed in these supply chain attacks.
Detects the GitHub Actions runner executing the Bun runtime to run a hidden index.js payload, specifically associated with the compromised 'actions-cool/issues-helper' or 'actions-cool/maintain-one-comment' actions. The rule filters for process execution context tied to GitHub runner internals and validates that the Bun execution follows the pattern observed in these supply chain attacks.
Detects the GitHub Actions runner executing the Bun runtime to run a hidden index.js payload, specifically associated with the compromised 'actions-cool/issues-helper' or 'actions-cool/maintain-one-comment' actions. The rule filters for process execution context tied to GitHub runner internals and validates that the Bun execution follows the pattern observed in these supply chain attacks.
Detects incoming HTTP requests to FortiSandbox administrative or management endpoints that contain suspicious shell metacharacters and command-injection patterns. These patterns are indicative of attempts to exploit CVE-2026-25089, an unauthenticated remote command injection vulnerability in the FortiSandbox Web UI.
Detects the presence of specific .NET deserialization gadget chain components (ExpandedWrapper, XamlServices, ObjectDataProvider, LosFormatter) within application traffic or logs, which are indicative of exploitation attempts targeting SharePoint pre-authentication remote code execution vulnerabilities like CVE-2026-65660.
Detects the establishment of a memory-resident webshell following the exploitation of SharePoint (e.g., ToolPane/EditingPageParser SafeControls bypass or XamlServices/LosFormatter deserialization). The rule identifies instances where w3wp.exe loads specific XAML/WPF assemblies used in known gadget chains and subsequently spawns child processes without any corresponding file creation activity on disk.
Detects HTTP POST requests to SharePoint ToolPane or WebPartPage endpoints containing serialized gadget chains (e.g., ysoserial ExpandedWrapper/ObjectDataProvider or XamlServices) indicative of deserialization exploitation attempts, specifically targeting CVE-2026-65660.
Detects malicious exploitation attempts against the SharePoint WebPartPages.asmx SOAP endpoint. Attackers use this endpoint to bypass security patches by invoking template-parsing functions like GetWebPartPageConnectionInfo, which facilitates Register-directive injection and XamlServices deserialization chains for remote code execution.
Page 7 of 58