Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11,839 detections
Filters
Last updated
All Time
Detection languages
5,629
1,822
1,261
860
754
Contributors
3,246
2,040
1,233
910
828
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
9,739
2,542
1,172
276
100
Products / Services
3,075
2,979
2,352
1,065
955
MITRE Techniques
6,777
3,901
2,671
2,014
1,827
CVEs
21
19
18
14
14
IDS Classtypes
75
31
26
19
19
IDS Protocols
102
68
10
5
3
Detects the Tensorlake npm 0.5.144 compromise (Shai-Hulud worm via preinstall). Includes a baseline query to identify the affected package/version across Defender inventory, file, network, device and process events, plus preinstall download/obfuscated-exec behaviour. Results are summarized per device/account.
Detects the execution of PaperCut reverse SOCKS5 bridge kit operator-side scripts (such as admin_bridge.py, live_reverse_socks5.py, start_socks.sh) or the creation of related Java bridge class artifacts.
Detects malicious behaviors involving the Chisel tunneling tool, including reverse SOCKS proxy connections with TLS verification skipped, cron-based persistence referencing watchdog scripts in hidden /var/tmp directories, and associated tool staging activities.
Detects network connections, process command-line executions, and email URL info matching known APT28 (Swallowtail, HOOKEDGE, LegionRelay) indicators of compromise, including specific IP addresses and GUIDs.
MSI-backed loader execution chain
Cortex XDR
This query uses the process ID of each child to match the parent process's PID, then reconstructs the chain back to explorer.exe. It also checks for the encoded PowerShell, silent MSI installation, and embedded MSI execution behaviours described in the source article.
Important caveats
- Causality scope: This finds matching process events within a shared causality ID; it does not establish that each process directly launched the next.
- Explorer root: The root process may not share the same causality ID in every telemetry scenario. If this join removes otherwise valid results, investigate the root separately.
- Strict matching: Requiring every stage will miss partial chains and variants with different command-line arguments. Consider separate alerts for the encoded PowerShell and silent MSI behaviours.
- Validation: Confirm the field names, join syntax, and causality-ID population against your tenant before deploying this as a production detection.
Important caveats
- Causality scope: This finds matching process events within a shared causality ID; it does not establish that each process directly launched the next.
- Explorer root: The root process may not share the same causality ID in every telemetry scenario. If this join removes otherwise valid results, investigate the root separately.
- Strict matching: Requiring every stage will miss partial chains and variants with different command-line arguments. Consider separate alerts for the encoded PowerShell and silent MSI behaviours.
- Validation: Confirm the field names, join syntax, and causality-ID population against your tenant before deploying this as a production detection.
Detects suspicious post-exploitation activities, reconnaissance, and command execution originating from web server and PHP lineage processes, indicating potential webshell activity or compromised web applications.
Detects browser cache smuggling (ClickFix/FileFix delivery mechanisms) where a non-browser script interpreter or LOLBin accesses a browser HTTP-cache directory and writes an executable or script payload outside the cache, followed shortly by the execution of a payload from a user staging directory.
Detects when the Internet Information Services (IIS) worker process (w3wp.exe) spawns suspicious child processes, command interpreters, or reconnaissance utilities, which may indicate web shell activity, remote code execution (RCE) via ViewState deserialization, or other web application exploitation.
Detects behavioral indicators of an SSH or autossh reverse tunnel (-R) executed with no remote command (-N) and host-key checking disabled, combined with network connections to a known command and control IP address.
Detects process command lines referencing browser credential
store filenames such as Chromium "Login Data"/Cookies and Firefox
logins.json/key4.db/cookies.sqlite. Amatera and similar infostealers copy
or read these files to harvest saved passwords and session cookies for
account takeover.
store filenames such as Chromium "Login Data"/Cookies and Firefox
logins.json/key4.db/cookies.sqlite. Amatera and similar infostealers copy
or read these files to harvest saved passwords and session cookies for
account takeover.
Detects web server processes (apache2, httpd) spawning a Unix shell (sh, dash, bash) which subsequently executes curl, wget, or php to perform an external HTTP fetch or download. This behavior is commonly associated with PHP or web application post-exploitation callbacks (webshells).
Detects command execution patterns on NetScaler appliances involving the extraction of system details (id, uname, hostname, nsrelease) and writing or echoing them into HTML files within NetScaler web directories, indicative of web shell installation or staging.
Detects GitLab backend processes (such as puma, sidekiq, rails, ruby, bundle) spawning shells, scripting interpreters, or network tools with suspicious command-line parameters, potentially indicating post-exploitation activity or vulnerability exploitation.
Detects cmd.exe launched from the Windows Run dialog (explorer.exe
parent) downloading a payload with a living-off-the-land transfer utility such as
certutil, bitsadmin or curl. ClickFix pasted commands frequently chain cmd.exe with
these built-in binaries to fetch the secondary malware stage.
parent) downloading a payload with a living-off-the-land transfer utility such as
certutil, bitsadmin or curl. ClickFix pasted commands frequently chain cmd.exe with
these built-in binaries to fetch the secondary malware stage.
Detects a VS Code-family editor or extension host process running 'git config --global user.email' and, within one minute from the same parent process, a curl public-IP lookup (ifconfig.me / api.ipify.org), the host-profiling step of the trojanized anthropic.claude-code loader.
Detects a VS Code-family editor or extension host modifying ~/.ssh/authorized_keys, or shell commands appending the svc-telemetry label / embedded Ed25519 key, as used by the trojanized anthropic.claude-code extension.
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
Detects the setting of the TS_SERVE_ALLOW_ALL_INTERFACES environment variable or registry key combined with the execution of Tailscale serve or funnel commands on the same device within a 24-hour window, potentially indicating unauthorized exposure of local services.
Detects the archiving of the ProgramData AnyDesk directory using WinRAR/RAR with header encryption or the PowerShell Compress-Archive function, which indicates configuration staging for potential exfiltration.
Detects potential C2Agent parent-spoofing behavior characterized by short-lived scheduled tasks (created and deleted within a 10-minute window with names matching c2a_<n>) or process relaunches carrying specific -fork2 command-line markers.
Detects PowerShell using System.Net.WebClient DownloadFile or related commands to fetch tool dependencies (such as 7z, MSTSCLib, ffmpeg) from GitHub repositories associated with the 'websalat' naming convention, indicative of Salat Stealer or similar tool-loading activity.
Page 5 of 564