Every published rule

WordPress wp2shell Plugin Webshell Access via wp-content/plugins URL Path

Alert on HTTP requests targeting the wp2shell WordPress plugin path used for webshell execution/persistence.

Antivirus Remote Access Tool Signature Matches Known RAT Names

Alerts on antivirus detections referencing multiple known RAT family signature names in the event signature field.

Antivirus signatures matching APT malware naming patterns

Flags Antivirus alerts when malware signatures reference APT-style naming patterns and family name substrings.

Windows Defender windefend Event 1119 flags RedSun TieringEngineService.exe EICAR test file

Alerts on WinDefend 1119 remediation failures involving TieringEngineService.exe marked with EICAR content or triggered by RedSun.exe.

Windows Named Pipe Created with Name "REDSUN"

Flags creation of the named pipe \REDSUN on Windows, consistent with RedSun-style IPC used during exploitation.

Windows File Creation: TieringEngineService.exe in RS- prefixed Temp Directory

Detects creation of TieringEngineService.exe under an RS-{GUID}-prefixed directory in %TEMP% on Windows.

Windows File Creation in SharePoint Web Server Extensions Suggesting ToolShell Drop

Alerts on Windows file creations within SharePoint Web Server Extensions that match suspicious spinstall/debug artifacts linked to CVE-2025-53770.

Bitbucket Audit: Unauthorized Full Data Export Triggered (Data Pipeline)

Flags Bitbucket audit events indicating an unauthorized user attempted a full data export.

Bitbucket Audit: Unauthorized Access to a Resource

Flags Bitbucket audit events reporting unauthorized access attempts to a resource.

Webserver Path Scan for ScreenConnect SetupWizard Authentication Bypass (CVE-2024-1709)

Alerts on web requests to '/SetupWizard.aspx/' that match exploitation patterns for ScreenConnect authentication bypass CVE-2024-1709.

Windows Security Event 4698 Scheduled Task Creation for TeamCity UI

Flags Windows scheduled task creation events where the task name is TeamCity Settings UI and content contains a specific marker.

Proxy HTTP GET Pattern Matching /MSHTML_C7/ with IPv4 Query Parameters

Alerts on proxy HTTP GET requests to /MSHTML_C7/ with an IPv4-like query parameter pattern.

Linux Process Execution of BarracudaMailService and Resize Utility Binaries

Alerts on Linux process creation for executables ending with three specific names linked to SEASPY deployment.

Windows Rundll32 Execution via Suspicious DLL Path Without .dll Extension

Alerts when rundll32.exe is started from suspicious parent scripts with a DLL-like path missing the .dll extension.

Windows Qakbot-associated Rundll32 execution via suspicious parent process and export strings

Flags rundll32.exe executions tied to Qakbot-style export strings when launched by script/cmd utilities.

Proxy HTTP GET to api.telegram.org with chat_id and text com/ (Small Sieve C2 behavior)

Alerts on proxy HTTP GET requests to api.telegram.org containing a specific chat_id and com/ prefix consistent with C2 behavior.

Windows Service Creation for Backdoor Persistence via GoogleUpdate (Event ID 7045)

Flags creation of a "GoogleUpdate" Windows service with rundll32/FileProtocolHandler image path pointing to ProgramData persistence.

Windows Service Creation for WerFaultSvc Using C:\Windows\WinSxS\WerFault.exe

Alerts on Windows service creation of WerFaultSvc pointing to C:\Windows\WinSxS\...\WerFault.exe.

Windows File Indicator: SNAKE Malware Kernel Driver Target File Comadmin.dat

Alerts on Windows file events involving C:\Windows\System32\Com\Comadmin.dat, an indicator tied to SNAKE kernel driver activity.

Windows: Suspicious child processes spawned from Veeam SQL Server service

Alerts on suspicious cmd/PowerShell/LOLBin and recon utilities spawned by the Veeam SQL service (sqlservr.exe with VEEAMSQL).