Coverage › CVE-2023-26360
CVE-2023-26360 Mapped Sigma
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
- Vendor / product
- Adobe — ColdFusion
- Description (CISA)
- Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution.
- Added to KEV
- 2023-03-15
- Due date
- 2023-04-05
- Required action
- Apply updates per vendor instructions.
- Known ransomware use
- Unknown
- CWE
- CWE-284
- CISA notes
- https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html
https://nvd.nist.gov/vuln/detail/CVE-2023-26360 - Elsewhere
- cve.org · NVD · CISA KEV · JSON
ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28
9 mapping objects across 9 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.
| Technique | Mapping type | CTID comment | Status in v19.2 |
|---|---|---|---|
| T1190 Exploit Public-Facing Application | exploitation technique | This vulnerability gives an adversary access through exploitation of a public-facing server. ref 1 |
live |
| T1003.001 LSASS Memory | secondary impact | This vulnerability gives an adversary access through exploitation of a public-facing server. ref 1 |
live |
| T1036.005 Match Legitimate Resource Name or Location | secondary impact | This vulnerability gives an adversary access through exploitation of a public-facing server. ref 1 |
live renamed from “Match Legitimate Name or Location” |
| T1046 Network Service Discovery | secondary impact | This vulnerability gives an adversary access through exploitation of a public-facing server. ref 1 |
live |
| T1059.007 JavaScript | primary impact | This vulnerability gives an adversary access through exploitation of a public-facing server. ref 1 |
live |
| T1071.001 Web Protocols | secondary impact | This vulnerability gives an adversary access through exploitation of a public-facing server. ref 1 |
live |
| T1105 Ingress Tool Transfer | secondary impact | This vulnerability gives an adversary access through exploitation of a public-facing server. ref 1 |
live |
| T1484.001 Group Policy Modification | secondary impact | This vulnerability gives an adversary access through exploitation of a public-facing server. ref 1 |
live |
| T1505.003 Web Shell | secondary impact | This vulnerability gives an adversary access through exploitation of a public-facing server. ref 1 |
live |
Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources
T1003.001 LSASS Memory secondary impact
- DET0363 Detection of Credential Dumping from LSASS Memory via Access and Dump Sequence
AN1030 WindowsA non-privileged or abnormal process attempts to open a handle with full access (0x1F0FFF) to lsass.exe and subsequently invokes memory dump, file creation, or registry modification indicative of credential scraping. This behavior chain reflects staged credential theft activity.Tunable:
AccessMaskTimeWindowParentProcessNameDumpFilePathCommandLinePattern
Sigma rules tagged attack.t1003.001 (79)
Author: Florian Roth (Nextron Systems)
· 2019-02-21 (modified 2023-03-10) · logsource: product=windows category=process_creation · 03e2746e-2b31-42f1-ab7a-eb39365b2422
Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report
Author: The DFIR Report, IrishDeath
· 2025-05-19 · logsource: product=windows category=file_event · 03f4ca17-de95-428d-a75a-4ee78b047256
Detects file creation events with filename patterns used by Impacket.
Author: Florian Roth (Nextron Systems), David ANDRE (additional keywords)
· 2017-01-10 (modified 2022-01-05) · logsource: product=windows · 06d71506-7beb-4f22-8888-e2e5e2ca7fd8
This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)
Author: Ensar Şamil, @sblmsrsn, @oscd_initiative
· 2020-10-06 (modified 2022-10-09) · logsource: product=windows category=process_creation · 0b4ae027-2a2d-4b93-8c7e-962caaba5b2a
Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.
Author: Perez Diego (@darkquassar), oscd.community, Ecco
· 2019-10-27 (modified 2024-03-01) · logsource: product=windows category=image_load · 0e277796-5f23-4e49-a490-483131d4f6e1
Detects the load of dbghelp/dbgcore DLL by a potentially uncommon or potentially suspicious process.
The Dbghelp and Dbgcore DLLs export functions that allow for the dump of process memory. Tools like ProcessHacker, Task Manager and some attacker tradecraft use the MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll.
As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine.
Keep in mind that many legitimate Windows processes and services might load the aforementioned DLLs for debugging or other related purposes. Investigate the CommandLine and the Image location of the process loading the DLL.
Author: oscd.community, Natalia Shornikova
· 2020-10-06 (modified 2023-11-28) · logsource: product=windows category=process_access · 0f920ebe-7aea-4c54-b202-9aa0c609cfe5
Detects a PowerShell process requesting access to "lsass.exe", which can be indicative of potential credential dumping attempts
Author: Austin Songer @austinsonger, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2021-11-26 (modified 2024-06-21) · logsource: product=windows category=process_creation · 129966c9-de17-4334-a123-8b58172e664d
Detects when a user is potentially trying to bypass the Windows Defender AV by renaming a tool to dump64.exe and placing it in the Visual Studio folder.
Currently the rule is covering only usage of procdump but other utilities can be added in order to increase coverage.
Author: Florian Roth (Nextron Systems)
· 2022-09-20 (modified 2023-02-14) · logsource: product=windows category=process_creation · 1a1ed54a-2ba4-4221-94d5-01dee560d71e
Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory
Author: Jason (https://github.com/0xbcf)
· 2025-09-23 (modified 2025-11-23) · logsource: product=windows category=process_creation · 1f0b4cac-9c81-41f4-95d0-8475ff46b3e2
Detects potential abuse of WerFaultSecure.exe to dump Protected Process Light (PPL) processes like LSASS or to freeze security solutions (EDR/antivirus).
This technique is used by tools such as EDR-Freeze and WSASS to bypass PPL protections and access sensitive information or disable security software.
Distinct command line patterns help identify the specific tool:
- WSASS usage typically shows: "WSASS.exe WerFaultSecure.exe [PID]" in ParentCommandLine
- EDR-Freeze usage typically shows: "EDR-Freeze_[version].exe [PID] [timeout]" in ParentCommandLine
Legitimate debugging operations using WerFaultSecure are rare in production environments and should be investigated.
Author: Kirill Kiryanov, oscd.community
· 2020-10-08 (modified 2021-11-27) · logsource: product=windows category=process_creation · 23ceaf5c-b6f1-4a32-8559-f2ff734be516
Detects process dump via legitimate sqldumper.exe binary
Author: Florian Roth (Nextron Systems)
· 2020-02-04 (modified 2025-01-22) · logsource: product=windows category=process_creation · 2704ab9e-afe2-4854-a3b1-0c0706d03578
Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory
Author: Florian Roth (Nextron Systems)
· 2021-08-16 (modified 2026-06-29) · logsource: product=windows category=process_creation · 2e65275c-8288-4ab4-aeb7-6274f58b6b20
Detects usage of the SysInternals Procdump utility
Author: @neu5ron, Teymur Kheirkhabarov, oscd.community
· 2020-04-02 (modified 2021-11-27) · logsource: product=zeek service=smb_files · 2e69f167-47b5-4ae7-a390-47764529eff5
Transferring files with well-known filenames (sensitive files with credential data) using network shares
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-06-09 (modified 2023-06-23) · logsource: product=windows category=process_creation · 2f869d59-7f6a-4931-992c-cce556ff2d53
Detects execution of "AdPlus.exe", a binary that is part of the Windows SDK that can be used as a LOLBIN in order to dump process memory and execute arbitrary commands.
Author: @pbssubhash
· 2022-12-08 (modified 2023-08-17) · logsource: product=windows category=registry_set · 33efc23c-6ea2-4503-8cfe-bdf82ce8f719
Detects the setting of the "DumpType" registry value to "2" which stands for a "Full Dump". Technique such as LSASS Shtinkering requires this value to be "2" in order to dump LSASS.
All 79 rules on the technique page →
T1036.005 Match Legitimate Resource Name or Location secondary impact
- DET0347 Detection Strategy for Masquerading via Legitimate Resource Name or Location
AN0983 WindowsDetects processes or binaries executed from trusted directories (e.g., System32) or using trusted names (e.g., svchost.exe) where the metadata, hash, or parent process does not align with legitimate activity patterns.Tunable:
trusted_directory_listprocess_baseline_ageAN0984 LinuxDetects renamed binaries or scripts placed into trusted paths like /usr/bin or /lib with mismatched metadata or unexpected creation/modification times.Tunable:monitored_pathshash_validation_windowAN0985 macOSDetects binaries or launch daemons in /System/Library or /Applications with mismatched bundle names, unexpected metadata, or improper installation origin.Tunable:expected_bundle_namessigned_by_apple_checkAN0986 ContainersDetects malicious containers or pods using names, labels, or namespaces that mimic legitimate workloads; also checks for image layer mismatches and unauthorized resource deployments.Tunable:trusted_namespace_listimage_baseline_hashesAN0987 ESXiDetects VIBs, scripts, or binaries placed into directories like /bin or /etc/vmware with names mimicking standard ESXi components. Also monitors unauthorized creation of services.Tunable:esxi_baseline_file_listservice_creation_alert_threshold
Sigma rules tagged attack.t1036.005 (21)
Author: Florian Roth (Nextron Systems)
· 2017-08-15 (modified 2022-06-28) · logsource: product=windows category=process_creation · 01d2e2a1-5f09-44f7-9fc1-24faa7479b6d
Detects an uncommon svchost parent process
Author: Nasreddine Bencherchali (Nextron Systems)
· 2024-06-24 · logsource: product=windows category=file_event · 13c02350-4177-4e45-ac17-cf7ca628ff5e
Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected locations. (Outisde of "System32", "SysWOW64", etc.).
It is highly recommended to perform an initial baseline before using this rule in production.
Author: Swachchhanda Shrawan Poudel (Nextron Systems), @unresolvedhost
· 2026-04-17 · logsource: product=windows category=process_creation · 2ad78473-6978-40f5-b8f1-89c7e1c27a1a
Detects two stages of the RedSun post-exploitation process chain that deliver a SYSTEM-level shell to the attacker's interactive session.
Observed process chain
services.exe
→ TieringEngineService.exe
→ conhost.exe (SYSTEM, CommandLine: bare path, no arguments)
→ cmd.exe / shell (SYSTEM, TerminalSessionId = attacker's session)
Stage 1 — TieringEngineService.exe spawns argument-less conhost.exe:
After winning the oplock + Cloud Files mount point race, the malicious TieringEngineService.exe (RedSun.exe copied to System32, started via CoCreateInstance
/ services.exe) detects it is NT AUTHORITY\SYSTEM and calls LaunchConsoleInSessionId().
This opens \\.\pipe\REDSUN, reads the attacker's session ID, duplicates the SYSTEM token, re-stamps it with that session ID via SetTokenInformation(TokenSessionId), then
calls CreateProcessAsUser to spawn conhost.exe with no arguments.
Stage 2 — Shell spawned from rogue conhost.exe (EDR sources with GrandParentImage):
The rogue SYSTEM conhost.exe spawns a shell (cmd.exe, PowerShell, etc.) as SYSTEM in the attacker's interactive session.
On EDR sources that expose GrandParentImage, the full three-level chain (TieringEngineService.exe → conhost.exe → shell) can be matched directly.
The legitimate TieringEngineService.exe is a headless COM server that is unlikely to spawn conhost.exe under normal conditions.
Author: Florian Roth (Nextron Systems)
· 2020-05-20 (modified 2023-03-09) · logsource: product=windows category=process_creation · 3711eee4-a808-4849-8a14-faf733da3612
Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Symantec
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
· 2023-05-19 · logsource: product=windows category=file_event · 39466c42-c189-476a-989f-8cdb135c163a
Detects filename indicators that contain a specific typo seen used by the Small Sieve malware.
Author: Trent Liffick (@tliffick), Bartlomiej Czyz (@bczyz1)
· 2020-06-03 (modified 2023-03-10) · logsource: product=windows category=process_creation · 3f7f5b0b-5b16-476c-a85f-ab477f6dd24b
Detects binaries used by the Lazarus group which use system names but are executed and launched from non-default location
Author: Florian Roth (Nextron Systems)
· 2017-10-25 (modified 2022-08-08) · logsource: category=proxy · 4922a5dd-6743-4fc2-8e81-144374280997
Detects a flashplayer update from an unofficial location
Author: elhoim
· 2022-04-28 · logsource: product=windows category=file_event · 5f87308a-0a5b-4623-ae15-d8fa1809bc60
Detects the creation of copy of suspicious files (EXE/DLL) to the default GPO storage folder
Author: Florian Roth (Nextron Systems)
· 2018-02-22 (modified 2021-11-27) · logsource: product=windows category=process_creation · 7993792c-5ce2-4475-a3db-a3a5539827ef
Detects Winword starting uncommon sub process MicroScMgmt.exe as used in exploits for CVE-2015-1641
Author: frack113, Swachchhanda Shrawan Poudel (Nextron Systems)
· 2021-12-20 (modified 2025-04-12) · logsource: product=windows category=process_creation · 7cce6fc8-a07f-4d84-a53e-96e1879843c9
Detects binaries that use the same name as legitimate sysinternals tools to evade detection.
This rule looks for the execution of binaries that are named similarly to Sysinternals tools.
Adversary may rename their malicious tools as legitimate Sysinternals tools to evade detection.
Author: vburov
· 2019-02-23 (modified 2025-03-06) · logsource: product=windows category=process_creation · 96036718-71cc-4027-a538-d1587e0006a7
Detect suspicious parent processes of well-known Windows processes
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-02-05 · logsource: product=windows category=process_creation · 9f8573c9-22b4-40e3-89c1-72bc2b8d49ab
Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading as or abusing these processes to execute payloads or maintain persistence.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-17 · logsource: product=windows service=windefend · a7c3e5f2-8b1d-4e9a-b6c2-3d7f5e8a9b4c
Detects Windows Defender (EventID 1119 - Remediation Action Failed) flagging TieringEngineService.exe
dropped in a characteristic RS-{GUID} temporary directory, or the RedSun.exe process itself being present.
This covers the staging pattern used by RedSun, a Cloud Files API and opportunistic lock (oplock) based
AV bypass/privilege escalation tool.
RedSun works as follows:
1. Registers a Cloud Files sync root and creates a Cloud Files placeholder for TieringEngineService.exe under %TEMP%\RS-{GUID}\
2. The placeholder file carries EICAR test file content (Virus:DOS/EICAR_Test_File) to reliably trigger
a Defender scan and remediation attempt
3. Requests a batch oplock (FSCTL_REQUEST_BATCH_OPLOCK) on the placeholder file
4. When Defender attempts to scan/quarantine the file, the oplock triggers - holding the file open
5. During the oplock break window, RedSun swaps the mount point (junction) to redirect
\\?\C:\Windows\System32 to the attacker-controlled temp path
6. This races the AV/OS into executing the malicious TieringEngineService.exe with elevated privileges
Author: Leo Tsaousis (@laripping)
· 2024-03-26 · logsource: product=kubernetes category=application service=audit · a80d927d-ac6e-443f-a867-e8d6e3897318
Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods.
System pods, created by controllers such as Deployments or DaemonSets have random suffixes in their names.
Attackers can use this fact and name their backdoor pods as if they were created by these controllers to avoid detection.
Deployment of such a backdoor container e.g. named kube-proxy-bv61v, could be attempted in the kube-system namespace alongside the other administrative containers.
Author: Swachchhanda Shrawan Poudel
· 2024-08-07 · logsource: product=windows category=process_creation · be58d2e2-06c8-4f58-b666-b99f6dc3b6cd
Detects a suspicious process that is masquerading as the legitimate "svchost.exe" by naming its binary "svchost.exe" and executing from an uncommon location.
Adversaries often disguise their malicious binaries by naming them after legitimate system processes like "svchost.exe" to evade detection.
All 21 rules on the technique page →
T1046 Network Service Discovery secondary impact
- DET0376 Behavioral Detection Strategy for Network Service Discovery Across Platforms
AN1057 WindowsDetects processes performing network enumeration (e.g., port scans, service probing) by correlating process creation, socket connections, and sequential destination IP probing within a time window.Tunable:
ScanRateThresholdKnownScannerExeListTimeWindowAN1058 LinuxDetects use of network scanning utilities or scripts performing rapid connections to multiple services or hosts using auditd and netflow/pcap telemetry.Tunable:PortScanThresholdToolPatternRegexExpectedScanSourcesAN1059 macOSDetects Bonjour-based mDNS enumeration or use of system tools (e.g., dns-sd, nmap) to find active services via multicast probing or targeted scans.Tunable:MDNSServiceQueryPatternsUserContextScanToolListAN1060 ContainersDetects lateral discovery or container breakout attempts using netcat, curl, or custom binaries probing other services within the same namespace or VPC subnet.Tunable:ExecutablePathTimeWindowNetworkDestinationCount
Sigma rules tagged attack.t1046 (20)
Author: Alejandro Ortuno, oscd.community
· 2020-10-21 (modified 2023-09-26) · logsource: product=linux service=auditd · 3761e026-f259-44e6-8826-719ed8079408
Detects enumeration of local or remote network services.
Author: Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])
· 2020-10-21 (modified 2024-09-19) · logsource: product=linux category=process_creation · 3e102cd9-a70d-4a7a-9508-403963092f31
Detects execution of network scanning and reconnaisance tools. These tools can be used for the enumeration of local or remote network services for example.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-02-05 · logsource: product=windows category=process_creation · 4fd6b1c7-19b8-4488-97f6-00f0924991a3
Detects usage of NimScan, a portscanner utility.
In early 2025, adversaries were observed using this utility to scan for open ports on remote hosts in a compromised environment.
This rule identifies the execution of NimScan based on the process image name and specific hash values associated with different versions of the tool.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2021-12-18 (modified 2023-02-07) · logsource: product=windows category=process_creation · 54773c5f-f1cc-4703-9126-2f797d96a69d
Detects the use of Advanced Port Scanner.
Author: Marco Pedrinazzi (@pedrinazziM)
· 2026-01-06 · logsource: product=opencanary category=application · 68b8547b-107f-43f3-97fb-900a7d63c190
Detects instances where an OpenCanary node has been targeted by a NMAP NULL Scan
Author: Alejandro Ortuno, oscd.community
· 2020-10-21 (modified 2021-11-27) · logsource: product=macos category=process_creation · 84bae5d4-b518-4ae0-b331-6d4afd34d00f
Detects enumeration of local or remote network services.
Author: Swachchhanda Shrawan Poudel
· 2023-12-04 · logsource: product=windows category=ps_script · 851fd622-b675-4d26-b803-14bc7baa517a
Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Author: Marco Pedrinazzi (@pedrinazziM)
· 2026-01-06 · logsource: product=opencanary category=application · 974be8d2-283e-4033-ab08-7505b84204d0
Detects instances where an OpenCanary node has been targeted by a SYN port scan.
Author: David Burkett (@signalblur)
· 2024-04-16 · logsource: product=linux category=process_creation · 97de11cd-4b67-4abf-9a8b-1020e670aa9e
Detects command line patterns associated with the use of Pnscan for sending and receiving binary data across the network.
This behavior has been identified in a Linux malware campaign targeting Docker, Apache Hadoop, Redis, and Confluence and was previously used by the threat actor known as TeamTNT
Author: Georg Lauenstein (sure[secure])
· 2022-09-19 (modified 2023-03-23) · logsource: product=windows category=process_creation · 98b53e78-ebaf-46f8-be06-421aafd176d9
WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz
Author: yxinmiracle, Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-26 · logsource: product=windows category=process_creation · af688c76-4ce4-4309-bfdd-e896f01acf27
Detects execution of the Grixba reconnaissance tool based on suspicious command-line parameter combinations.
This tool is used by the Play ransomware group for network enumeration, data gathering, and event log clearing.
Author: frack113
· 2021-12-10 (modified 2025-03-05) · logsource: product=windows category=network_connection · bef0bc5a-b9ae-425d-85c6-7b2d705980c6
Detects a Python process initiating a network connection. While this often relates to package installation, it can also indicate a potential malicious script communicating with a C&C server.
Author: Nasreddine Bencherchali (Nextron Systems), @ROxPinTeddy
· 2020-05-12 (modified 2023-02-07) · logsource: product=windows category=process_creation · bef37fa2-f205-4a7b-b484-0759bfd5f86f
Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.
Author: @d4ns4n_ (Wuerth-Phoenix)
· 2024-04-25 · logsource: product=windows category=process_creation · ca387a8e-1c84-4da3-9993-028b45342d30
Detects usage of SoftPerfect's "netscan.exe". An application for scanning networks.
It is actively used in-the-wild by threat actors to inspect and understand the network architecture of a victim.
Author: Swachchhanda Shrawan Poudel
· 2023-12-04 · logsource: product=windows category=process_creation · d557dc06-62e8-4468-a8e8-7984124908ce
Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
All 20 rules on the technique page →
T1059.007 JavaScript primary impact
- DET0264 Cross-Platform Detection of JavaScript Execution Abuse
AN0733 WindowsDetects JavaScript execution through WSH (wscript.exe, cscript.exe) or HTA (mshta.exe), particularly when spawned from Office macros, web browsers, or abnormal user paths. Correlates script execution with outbound network activity or system modification.Tunable:
ParentProcessScriptPathTimeWindowUserContextEntropyScoreAN0734 macOSDetects JavaScript for Automation (JXA) via osascript or compiled scripts using OSAKit APIs. Flags execution involving system modification, inter-process scripting, or browser abuse.macos:unifiedloglog stream with predicate 'eventMessage CONTAINS "osascript"'→ DC0029 Script ExecutionTunable:ScriptLocationParentProcessAPIInvocationAN0735 LinuxDetects Node.js or JavaScript interpreter execution from web shells, cron jobs, or local users. Correlates execution with reverse shell behavior, file modifications, or abnormal outbound connections.Tunable:ScriptPathBinaryNameUserExecutionContextNetworkFollowUp
Sigma rules tagged attack.t1059.007 (29)
Author: Tim Shelton
· 2022-01-10 (modified 2026-02-17) · logsource: product=windows category=file_event · 002bdb95-0cf1-46a6-9e08-d38c128a6127
Detects a file ending in jse, vbe, js, vba, vbs, wsf, wsh written by cscript.exe or wscript.exe
Author: Timur Zinniatullin, oscd.community, Swachchhanda Shrawan Poudel
· 2019-10-21 (modified 2026-01-24) · logsource: product=windows category=process_creation · 05c36dd6-79d6-4a9a-97da-3db20298ab2d
Detects the execution of WMIC with the "format" flag to potentially load local XSL files.
Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.
Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.
Author: Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community
· 2017-11-10 (modified 2022-12-02) · logsource: product=windows category=file_event · 0bcfabcb-7929-47f4-93d6-b33fb67d34d1
Detects javaw.exe in AppData folder as used by Adwind / JRAT
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=windows category=process_creation · 0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
Author: Sohan G (D4rkCiph3r), Red Canary (idea)
· 2023-08-22 · logsource: product=macos category=process_creation · 13db8d2e-7723-4c2c-93c1-a4d36994f7ef
Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware
Author: Michael Haag
· 2019-01-16 (modified 2026-02-17) · logsource: product=windows category=process_creation · 1e33157c-53b1-41ad-bbcc-780b80b58288
Detects script file execution (.js, .jse, .vba, .vbe, .vbs, .wsf, .wsh) by Wscript/Cscript.
Author: Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community
· 2017-11-10 (modified 2022-10-09) · logsource: product=windows category=process_creation · 1fac1481-2dbc-48b2-9096-753c49b4ec71
Detects javaw.exe in AppData folder as used by Adwind / JRAT
Author: Leonardo Gasparini
· 2026-05-12 · logsource: product=linux category=file_event · 2b5e4d3f-7c9a-4fab-a8d1-3e6f5a7b8c9d
Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026.
Author: @SBousseaden (detection), Thomas Patzke (rule)
· 2019-02-01 (modified 2023-05-05) · logsource: product=windows category=create_remote_thread · 2e4e488a-6164-4811-9ea1-f960c7359c40
Detects remote thread creation from CACTUSTORCH as described in references.
Author: Leonardo Gasparini
· 2026-05-12 · logsource: product=linux category=process_creation · 3c6f5e4a-8d0b-6abc-d9e2-4f7a6b8c9d0e
Detects process execution indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026.
The preinstall hook runs setup.mjs, which downloads a platform-specific Bun runtime.
Author: Pushkarev Dmitry
· 2020-06-28 (modified 2025-12-03) · logsource: product=windows service=applocker · 401e5d00-b944-11ea-8f9a-00163ecd60ae
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.
Author: Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)
· 2020-04-01 (modified 2023-04-12) · logsource: product=windows category=process_creation · 52cad028-0ff0-4854-8f67-d25dfcbc78b4
Detects a suspicious child process of a Microsoft HTML Help (HH.exe)
Author: heyyanu
· 2026-03-26 · logsource: product=windows service=applocker · 557e3bd3-7f21-495d-8d50-7c8bdfb8041c
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.
Author: wagga, Jonhnathan Ribeiro, oscd.community
· 2020-01-12 (modified 2023-02-11) · logsource: product=windows category=process_creation · 5cddf373-ef00-4112-ad72-960ac29bac34
Detects command line parameters used by Koadic hack tool
Author: Josh Nickels, Michael Taggart
· 2025-05-22 · logsource: product=windows category=file_event · 6c0ce3b6-85e2-49d4-9c3f-6e008ce9796e
Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL.
This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.
All 29 rules on the technique page →
T1071.001 Web Protocols secondary impact
- DET0027 Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets
AN0075 WindowsDetects unexpected or high-volume HTTP/S/WebSocket communication from suspicious processes (e.g., PowerShell, rundll32) using uncommon user agents or mimicking browser traffic to unusual domains or IPs.Tunable:
ProcessNameExclusionsUserAgentAnomaliesOutboundByteRatioThresholdAN0076 LinuxDetects curl, wget, Python requests, or custom HTTP clients communicating over non-standard ports, with repetitive or beacon-like patterns or POST-heavy behavior to rare domains.Tunable:CommandLinePatternMatchBeaconIntervalWindowAN0077 macOSDetects applications such as Automator, AppleScript, or LaunchDaemons invoking HTTP/S traffic to non-standard domains or using suspicious headers (e.g., Base64 in URIs or cookie fields).Tunable:SuspiciousParentProcessURIEntropyThresholdAN0078 ESXiDetects HTTP or HTTPS communication initiated by shell-based scripts or management daemons, especially those reaching public IPs over ports 80/443 using embedded curl or wget.Tunable:ShellScriptMatchExternalConnectionFilterAN0079 Network DevicesDetects Web protocol misuse such as encoded HTTP headers, WebSocket upgrade requests with abnormal payloads, or TLS handshake anomalies suggesting embedded C2 channels.Tunable:HeaderEncodingPatternTLSFingerprintMismatch
Sigma rules tagged attack.t1071.001 (42)
Author: citron_ninja
· 2023-10-25 (modified 2023-11-20) · logsource: product=windows category=dns_query · 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b
Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Author: Florian Roth (Nextron Systems)
· 2017-07-08 (modified 2021-11-27) · logsource: category=proxy · 21e44d78-95e7-421b-a464-ffd8395659c4
Detects a potentially suspicious empty user agent strings in proxy log.
Could potentially indicate an uncommon request method.
Author: Florian Roth (Nextron Systems)
· 2020-04-15 (modified 2021-11-27) · logsource: category=proxy · 2b1ee7e4-89b6-4739-b7bb-b811b6607e5e
Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-09-28 (modified 2025-10-29) · logsource: product=windows category=process_creation · 2cf29f11-e356-4f61-98c0-1bdb9393d6da
Detects renamed Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel
Author: Florian Roth (Nextron Systems)
· 2021-06-09 (modified 2024-02-15) · logsource: category=proxy · 304810ed-8853-437f-9e36-c4975c3dfd7e
Detects Baby Shark C2 Framework default communication patterns
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-10-25 · logsource: product=windows category=process_creation · 30bf1789-379d-4fdc-900f-55cd0a90a801
Detects the installation of VsCode tunnel (code-tunnel) as a service.
Author: frack113
· 2022-01-23 (modified 2023-02-21) · logsource: product=windows category=process_creation · 3286d37a-00fd-41c2-a624-a672dcd34e60
Detects execution of curl.exe with custom useragent options
Author: CertainlyP
· 2024-04-26 · logsource: product=windows category=network_connection · 37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1
Detects outbound network connection initiated by Microsoft Dialer.
The Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer.
This is an outdated process in the current conext of it's usage and is a common target for info stealers for process injection, and is used to make C2 connections, common example is "Rhadamanthys"
Author: Mike Wade
· 2020-09-16 (modified 2022-03-24) · logsource: category=dns · 3eaf6218-3bed-4d8a-8707-274096f12a18
Detects wannacry killswitch domain dns queries
Author: Florian Roth (Nextron Systems)
· 2019-12-05 (modified 2023-01-19) · logsource: category=proxy · 5468045b-4fcc-4d1a-973c-c9c9578edacb
Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form
Author: Thomas Patzke
· 2019-11-12 (modified 2023-05-18) · logsource: category=proxy · 5ba715b6-71b7-44fd-8245-f66893e81b3d
Detects suspicious user agent string of APT40 Dropbox tool
Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2017-07-08 (modified 2024-04-14) · logsource: category=proxy · 5c84856b-55a5-45f1-826f-13f37250cf4e
Detects suspicious user agent strings used by malware in proxy logs
Author: Florian Roth (Nextron Systems), Markus Neis
· 2019-11-12 (modified 2024-02-15) · logsource: category=proxy · 6ec820f2-e963-4801-9127-d8b2dce4d31b
Detects suspicious user agent strings used in APT malware in proxy logs
Author: Florian Roth (Nextron Systems)
· 2017-07-08 (modified 2022-10-31) · logsource: category=proxy · 7195a772-4b3f-43a4-a210-6a003d65caa1
Detects suspicious malformed user agent strings in proxy logs
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-01 · logsource: category=dns · 73e5d24f-493f-4092-bd2f-c72cabda40ee
Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
This detection detects endpoints attempting to resolve the attacker's C2 domain (sfrclak.com) used for command and control communication.
All 42 rules on the technique page →
T1105 Ingress Tool Transfer secondary impact
- DET0060 Detect Ingress Tool Transfers via Behavioral Chain
AN0165 WindowsUnusual or uncommon processes initiate network connections to external destinations followed by file creation (tools downloaded).Tunable:
ParentProcessNameDestinationIPCategoryFilePathRegexAN0166 LinuxShell-based tools (curl, wget, scp) initiate connections to external domains followed by creation of executable files on disk.Tunable:ToolNameDownloadExtensionAN0167 macOSProcess execution of curl or wget followed by a network connection and a file created in temporary or user-specific directories.Tunable:DirectoryTargetedProcessPathAN0168 ESXiCommand line interface or vCLI triggers remote transfer using wget or curl, writing files into datastore paths or local tmp directories.Tunable:ToolNameDatastorePathAN0169 Network DevicesNetwork device logs show anomalous inbound file transfers or uncharacteristic flows with high payload volume to network devices with storage or automation hooks.Tunable:PayloadVolumeThresholdProtocolUsed
Sigma rules tagged attack.t1105 (87)
Author: Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update)
· 2022-09-15 (modified 2023-05-02) · logsource: product=linux category=process_creation · 00b90cc1-17ec-402c-96ad-3a8117d7a582
Detects a suspicious curl process start the adds a file to a web request
Author: Florian Roth (Nextron Systems), Cedric MAURUGEON (Update)
· 2020-07-03 (modified 2023-05-02) · logsource: product=windows category=process_creation · 00bca14a-df4e-4649-9054-3f2aa676bc04
Detects the execution of the "curl" process with "upload" flags. Which might indicate potential data exfiltration
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2021-12-27 (modified 2022-08-02) · logsource: product=windows category=process_creation · 00d49ed5-4491-4271-a8db-650a4ef6f8c1
Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents
Author: frack113
· 2022-12-25 · logsource: product=windows category=process_creation · 02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf
Detects usage of COM objects that can be abused to download files in PowerShell by CLSID
Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)
· 2020-10-05 (modified 2024-03-05) · logsource: product=windows category=process_creation · 04936b66-3915-43ad-a8e5-809eadfd1141
Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-06-13 · logsource: product=windows category=image_load · 04fc4b22-91a6-495a-879d-0144fec5ec03
Detects potential exploitation of remote code execution vulnerability CVE-2025-33053
by monitoring suspicious image loads from WebDAV paths. The exploit involves malicious executables from
attacker-controlled WebDAV servers loading the Windows system DLLs like gdi32.dll, netapi32.dll, etc.
Author: frack113
· 2022-08-28 (modified 2024-05-31) · logsource: product=windows category=network_connection · 08249dc0-a28d-4555-8ba5-9255a198e08c
Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-01 · logsource: product=linux category=process_creation · 0a23a62d-c5b3-468b-a072-25064a9a8c87
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.
Author: frack113, Florian Roth (Nextron Systems)
· 2022-09-02 (modified 2024-05-31) · logsource: product=windows category=network_connection · 0dba975d-a193-4ed1-a067-424df57570d1
Detects a network connection initiated by the certutil.exe utility.
Attackers can abuse the utility in order to download malware or additional payloads.
Author: Sreeman, Florian Roth (Nextron Systems)
· 2022-01-04 (modified 2025-10-07) · logsource: product=windows category=process_creation · 0e8cfe08-02c9-4815-a2f8-0d157b7ed33e
Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files
Author: Florian Roth (Nextron Systems), Hieu Tran
· 2023-03-13 (modified 2025-07-18) · logsource: product=windows category=process_creation · 0f0450f3-8b47-441e-a31b-15a91dc243e2
Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.
Author: Sohan G (D4rkCiph3r), Red Canary (idea)
· 2023-08-22 · logsource: product=macos category=process_creation · 13db8d2e-7723-4c2c-93c1-a4d36994f7ef
Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-02-15 (modified 2025-12-01) · logsource: product=windows category=process_creation · 13e6fe51-d478-4c7e-b0f2-6da9b400a829
Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.
Author: frack113
· 2021-11-26 (modified 2022-08-13) · logsource: product=windows category=process_creation · 185d7418-f250-42d0-b72e-0c8b70661e93
Download and compress a remote file and store it in a cab file on local machine.
Author: Florian Roth (Nextron Systems)
· 2017-11-08 (modified 2023-05-18) · logsource: category=proxy · 195c1119-ef07-4909-bb12-e66f5e07bf3c
Detects download of certain file types from hosts with dynamic DNS names (selected list)
All 87 rules on the technique page →
T1190 Exploit Public-Facing Application exploitation technique
- DET0080 Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)
AN0219 WindowsAdversary sends crafted HTTP/S (or other service) input to an Internet-facing app (IIS/ASP.NET, API, device portal). Chain: (1) abnormal request patterns to public endpoint → (2) elevated 4xx/5xx or unusual methods/paths → (3) server process (w3wp.exe/other service) spawns shell/LOLbins or loads non-standard modules → (4) optional outbound callback from the host/container.ApplicationLog:IIS
IIS W3C logs in C:\inetpub\logs\LogFiles\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns)→ DC0038 Application Log ContentTunable:PublicVIPsSuspiciousPatternsErrorRateThresholdTimeWindowAllowedChildListAN0220 LinuxAdversary exploits Apache/Nginx/app servers. Chain: (1) suspicious requests in access logs → (2) spike of 5xx or WAF blocks → (3) web server or interpreter (apache2/nginx/php-fpm/node/python) spawns /bin/sh, curl, wget, socat, or writes webshell → (4) outbound callback.ApplicationLog:WebServer/var/log/httpd/access_log, /var/log/apache2/access.log, /var/log/nginx/access.log with exploit indicators and burst errors→ DC0038 Application Log ContentNSM:FlowHTTP payloads with SQLi/LFI/JNDI/deserialization indicators→ DC0085 Network Traffic ContentTunable:WebProcListChildToolListBurstThresholdTimeWindowAN0221 macOSAdversary targets macOS-hosted public services (e.g., nginx, node). Chain: suspicious inbound request → service crash/5xx → service spawns shell or writes file → new outbound connection.macos:unifiedlogApp/web server logs ingested via unified logging or filebeat (nginx/apache/node).→ DC0038 Application Log ContentTunable:ServiceListTimeWindowAN0222 ContainersAdversary exploits containerized app via ingress or service. Chain: (1) suspicious request in ingress/app logs → (2) container process spawns a shell/exec/sidecar (kubectl exec/docker exec) → (3) egress to Internet or metadata service (169.254.169.254).ApplicationLog:IngressKubernetes NGINX/Envoy ingress controller logs with anomalous payloads and 5xx spikes→ DC0038 Application Log Contentdocker:eventsDocker/Kubernetes audit of exec/attach (kubectl exec) or unexpected child processes inside container→ DC0032 Process CreationNSM:FlowRequests towards cloud metadata or command & control from pod IPs→ DC0085 Network Traffic ContentTunable:IngressNamespacesMetadataEndpointsTimeWindowAN0223 IaaSAdversary targets cloud-hosted public endpoints. Chain: (1) ALB/ELB/Cloud LB logs show exploit-like inputs or error spikes → (2) workload spawns shell or reaches metadata API → (3) egress to new external hosts.ALB:HTTPLogsAWS ALB/ELB/GCP/Azure Application Gateway HTTP logs with unusual methods, long URIs, serialized payloads, 4xx/5xx bursts→ DC0085 Network Traffic ContentAWS:VPCFlowLogsVPC/NSG flow logs for pod/instance egress to Internet or metadata→ DC0078 Network Traffic FlowTunable:LBProjectsErrorBurstAN0224 ESXiAdversary exploits exposed OpenSLP on ESXi or vCenter public endpoints. Chain: inbound request pattern to mgmt service → hostd/vpxd error/crash/restart → unexpected process behavior or datastore access → outbound callback.esxi:hostd/var/log/hostd.log anomalies (faults, crashes, restarts) around inbound connections→ DC0038 Application Log ContentNSM:FlowConnections to TCP 427 (SLP) or vCenter web services from untrusted sources→ DC0085 Network Traffic ContentTunable:MgmtCIDRTimeWindowAN0225 Network DevicesAdversary exploits public admin services on routers/firewalls/switches. Chain: anomalous HTTP/SNMP/SmartInstall inputs → device syslog errors/restarts → config changes/CLI spawn → egress to attacker C2.networkdevice:controlplaneSyslog from edge devices with HTTP 500s on mgmt portal, SmartInstall events, unexpected CLI commands→ DC0038 Application Log ContentTunable:MgmtPortsTrustedAdmins
Sigma rules tagged attack.t1190 (149)
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-05-30 · logsource: category=webserver · 043c1609-0e32-4462-a6f2-5a0c2da3fafe
Detects a potential exploitation attempt of CVE-2023-25717 a Remote Code Execution via an unauthenticated HTTP GET Request, in Ruckus Wireless Admin
Author: @gott_cyber
· 2022-12-11 (modified 2023-03-24) · logsource: category=webserver · 0bbcd74b-0596-41a4-94a0-4e88a76ffdb3
Detects exploitation attempt of the CVE-2021-27905 which affects all Apache Solr versions prior to and including 8.8.1.
Author: Florian Roth (Nextron Systems)
· 2020-07-10 (modified 2023-01-02) · logsource: category=webserver · 0d0d9a8a-a49e-4e27-b061-7ce4b936cfb7
Detects exploitation attempt against Citrix Netscaler, Application Delivery Controller (ADS) and Citrix Gateway exploiting vulnerabilities reported as CVE-2020-8193 and CVE-2020-8195
Author: Thomas Patzke
· 2017-08-06 (modified 2020-09-01) · logsource: product=ruby_on_rails category=application · 0d2c3d4c-4b48-4ac3-8f23-ea845746bb1a
Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts
Author: Bhabesh Raj
· 2023-02-23 · logsource: category=webserver · 0e1ebc5a-15d0-4bf6-8199-b2535397433a
Detects the potential exploitation attempt of CVE-2023-23752 an Improper access check, in web service endpoints in Joomla
Author: Nisarg Suthar
· 2025-08-01 · logsource: product=windows category=process_creation · 0fdc7c7f-c690-4217-9ae3-31f5156eed72
Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.
Author: Florian Roth (Nextron Systems)
· 2019-05-22 (modified 2023-01-25) · logsource: product=windows category=process_creation · 1012f107-b8f1-4271-af30-5aed2de89b39
Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)
Author: jamesc-grafana
· 2024-07-11 · logsource: product=aws service=cloudtrail · 14f3f1c8-02d5-43a2-a191-91ffb52d3015
Detects changes to the security group entries for RDS databases.
This can indicate that a misconfiguration has occurred which potentially exposes the database to the public internet, a wider audience within the VPC or that removal of valid rules has occurred which could impact the availability of the database to legitimate services and users.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-20 · logsource: category=proxy · 15697955-6a29-47ca-92e9-0e05efae3260
Detects suspicious requests to Cisco ASA WebVpn via proxy logs associated with CVE-2025-20333 and CVE-2025-20362 exploitation.
Author: Bhabesh Raj
· 2021-01-25 (modified 2023-01-02) · logsource: category=webserver · 15c312b9-00d0-4feb-8870-7d940a4bdc5e
Detects the exploitation of the TerraMaster TOS vulnerability described in CVE-2020-28188
Author: Moti Harmats
· 2023-02-11 · logsource: product=velocity category=application · 16c86189-b556-4ee8-b4c7-7e350a195a4f
Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE.
Author: Bhabesh Raj
· 2021-02-24 (modified 2023-01-02) · logsource: category=webserver · 179ed852-0f9b-4009-93a7-68475910fd86
Detects the exploitation of VSphere Remote Code Execution vulnerability as described in CVE-2021-21972
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-12-22 (modified 2023-01-02) · logsource: category=webserver · 181f49fa-0b21-4665-a98c-a57025ebb8c7
Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint
Author: Nasreddine Bencherchali (Nextron Systems), Tim Shelton
· 2022-07-19 (modified 2026-06-11) · logsource: category=webserver · 19aa4f58-94ca-45ff-bc34-92e533c0994a
Detects known suspicious (default) user-agents related to scanning/recon tools
Author: Thomas Patzke
· 2017-08-12 (modified 2020-09-01) · logsource: product=python category=application · 19aefed0-ffd4-47dc-a7fc-f8b1425e84f9
Generic rule for SQL exceptions in Python according to PEP 249
All 149 rules on the technique page →
T1484.001 Group Policy Modification secondary impact
- DET0305 Detection of Group Policy Modifications via AD Object Changes and File Activity
AN0854 WindowsAdversary modifies GPO containers or files under SYSVOL using LDAP, ADSI, PowerShell (e.g., New-GPOImmediateTask) or GUI tools. This includes directory object changes (e.g., gPCFileSysPath), delegation assignments (SeEnableDelegationPrivilege), and SYSVOL file writes (ScheduledTasks.xml, GptTmpl.inf).Tunable:
ObjectDNTargetFilenameTimeWindowUserContextCommandLine
Sigma rules tagged attack.t1484.001 (6)
Author: Elastic, Josh Nickels, Marius Rothenbücher
· 2024-09-06 · logsource: product=windows service=security · 123e4e6d-b123-48f8-b261-7214938acaf0
Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.
Author: Elastic, Josh Nickels, Marius Rothenbücher
· 2024-09-04 · logsource: product=windows service=security · 1c480e10-7ee1-46d4-8ed2-85f9789e3ce4
Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or use them to add users as local admins.
Author: frack113
· 2022-08-19 · logsource: product=windows category=process_creation · ada4b0c4-758b-46ac-9033-9004613a150d
Detect malicious GPO modifications can be used to implement many other malicious behaviors.
Author: frack113
· 2022-08-19 · logsource: product=windows category=ps_script · b7216a7d-687e-4c8d-82b1-3080b2ad961f
Detect malicious GPO modifications can be used to implement many other malicious behaviors.
Author: TropChaud
· 2025-11-22 · logsource: product=windows category=process_creation · dcff7e85-d01f-4eb5-badd-84e2e6be8294
Detects the use of the Group Policy Management Editor (GPME) to modify Default Domain or Default Domain Controllers Group Policy Objects (GPOs).
Adversaries may leverage GPME to make stealthy changes in these default GPOs to deploy malicious GPOs configurations across the domain without raising suspicion.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-22 · logsource: product=windows service=security · e5ac86dd-2da1-454b-be74-05d26c769d7d
Detects modifications to Default Domain or Default Domain Controllers Group Policy Objects (GPOs).
Adversaries may modify these default GPOs to deploy malicious configurations across the domain.
T1505.003 Web Shell secondary impact
- DET0394 Web Shell Detection via Server Behavior and File Execution Chains
AN1108 WindowsUnexpected file creation in web directories followed by web server processes (e.g., w3wp.exe) spawning command shells or script interpreters (e.g., cmd.exe, powershell.exe)NSM:Flow
Inbound HTTP POST with suspicious payload size or user-agent→ DC0085 Network Traffic ContentTunable:WebRootPathParentProcessAN1109 LinuxFile creation of unauthorized script (e.g., .php, .sh) in /var/www/html followed by execution of unexpected system utilities (e.g., curl, bash, nc) by apache/nginxauditd:SYSCALLnew file created in /var/www/html, /srv/http, or similar web root→ DC0039 File CreationNSM:FlowPOST requests to .php, .jsp, .aspx files with high entropy body→ DC0085 Network Traffic ContentTunable:WebRootPathPayloadEntropyThresholdTimeWindowAN1110 macOSWeb servers (e.g., httpd) spawning abnormal processes post file upload into /Library/WebServer/Documents or /usr/local/var/wwwTunable:InterpreterNameExecutionParent
Sigma rules tagged attack.t1505.003 (35)
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-07-24 · logsource: product=windows category=file_event · 1f0489be-b496-4ddf-b3a9-5900f2044e9c
Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation.
This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.
Author: Jason Rathbun (Blackpoint Cyber)
· 2025-04-17 · logsource: product=windows category=process_creation · 2d79e371-2a27-42de-87a4-b4213fc72a6a
Detects unexpected command shell execution (cmd.exe) from w3wp.exe when tied to CentreStack's portal.config, indicating potential exploitation (e.g., CVE-2025-30406)
Author: Cian Heasley
· 2020-08-04 (modified 2023-01-02) · logsource: category=webserver · 2ea44a60-cfda-11ea-87d0-0242ac130003
Certain strings in the uri_query field when combined with null referer and null user agent can indicate activity associated with the webshell ReGeorg.
Author: Florian Roth (Nextron Systems)
· 2019-01-16 (modified 2024-01-18) · logsource: product=windows category=process_creation · 35efb964-e6a5-47ad-bbcd-19661854018d
Detects a program executing from a web server root folder. Use this rule to hunt for potential interesting activity such as webshell or backdoors
Author: Florian Roth (Nextron Systems)
· 2018-07-22 (modified 2023-01-02) · logsource: category=webserver · 37e8369b-43bb-4bf8-83b6-6dd43bda2000
Detects access to a webshell dropped into a keystore folder on the WebLogic server
Author: Beyu Denis, oscd.community, Tim Shelton, Thurein Oo
· 2019-10-22 (modified 2023-10-15) · logsource: product=windows category=file_event · 39f1f9f2-9636-45de-98f6-a4046aa8e4b9
Detects the creation of files with certain extensions on a static web site. This can be indicative of potential uploads of a web shell.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-06-03 (modified 2023-07-28) · logsource: category=webserver · 435e41f2-48eb-4c95-8a2b-ed24b50ec30b
Detects get requests to specific files used during the exploitation of MOVEit CVE-2023-34362
Author: Florian Roth (Nextron Systems)
· 2022-03-17 (modified 2023-11-09) · logsource: product=windows category=process_creation · 4ebc877f-4612-45cb-b3a5-8e3834db36c9
Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system
Author: Florian Roth (Nextron Systems), Rich Warren, Christian Burkard (Nextron Systems)
· 2021-08-09 (modified 2023-04-30) · logsource: product=windows service=msexchange-management · 516376b4-05cd-4122-bae0-ad7641c38d48
Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to place a webshell or the needed role assignment for it
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-14 · logsource: category=webserver · 639b893f-f93a-4e53-a7c8-f08cf73fe7f7
Detects potential Java webshell uploads via HTTP requests with Content-Type 'application/octet-stream' and Java file extensions.
This behavior might indicate exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution through webshells in SAP NetViewer.
Author: Florian Roth (Nextron Systems)
· 2022-10-04 · logsource: product=windows category=file_event · 6b269392-9eba-40b5-acb6-55c882b20ba6
Detects suspicious file type dropped by an Exchange component in IIS
Author: Florian Roth (Nextron Systems)
· 2022-02-25 · logsource: product=windows category=file_event · 7280c9f3-a5af-45d0-916a-bc01cb4151c9
Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which could be a sign of ProxyShell exploitation
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2017-02-19 (modified 2022-11-18) · logsource: category=webserver · 7ff9db12-1b94-4a79-ba68-a2402c5d6729
Detects common commands used in Windows webshells
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2021-10-15 (modified 2026-08-19) · logsource: product=linux category=process_creation · 818f7b24-0fba-4c49-a073-8b755573b9c7
Detects suspicious sub processes of web server processes
Author: Thomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)
· 2019-01-16 (modified 2024-11-26) · logsource: product=windows category=process_creation · 8202070f-edeb-4d31-a010-a26c72ac5600
Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation