Every published rule

This rule detects common commands used in Windows webshells

This rule detects exploitation attempt using the JNDI-Exploit-Kit

This rule detects anomalous Windows strings in URI which could indicate possible exfiltration or webshell communication

This rule detects potential SQL injection attempts via GET requests in access logs.

This rule detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which enables the execution of commands on the BIG-IP

This rule detects anomalous user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs

This rule detects download of certain file types from hosts in anomalous TLDs

This rule detects WebDav DownloadCradle

This rule detects network traffic potentially linked with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string.

This rule detects SSTI attempts sent via GET requests in access logs

This rule detects a potentially anomalous empty user agent strings in proxy log. Could potentially indicate an uncommon request method.

This rule detects anomalous malformed user agent strings in proxy logs

This rule detects executables launched from external WebDAV shares using the WebDAV Explorer integration, frequently seen in initial access campaigns.

This rule detects Windows PowerShell Web Access

This rule detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.

This rule detects Bitsadmin connections to IP addresses instead of FQDN names

This rule detects anomalous encoded User-Agent strings, as seen used by some malware.

This rule detects possible Java payloads in web access logs

This rule detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods).

This rule detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal behavior