Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,480 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,166
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,480
11,863
5,881
5,162
4,867
Platforms
18,083
3,046
1,506
124
104
Products / Services
5,723
4,293
3,713
1,173
958
MITRE Techniques
9,480
7,573
3,458
2,848
2,702
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects web servers, PHP processes, or shell processes spawning fetch utilities such as wget or curl to communicate with a specific malicious payload IP address (162.35.99.94), often indicative of web shell exploitation or post-exploitation file download activity.
Detects behavior where a php-fpm process spawns a command shell (sh, dash, bash) to access credential files like /etc/passwd or /etc/shadow, or invoke known renamed interpreter payloads alongside setuid/setgid patterns.
Detects post-exploitation behavior where a Node.js process spawns a shell, interpreter, or utility (such as sh, bash, nc, curl, python), which may indicate Remote Code Execution (RCE) via vulnerabilities like CVE-2026-111497 in the Node.js Brotli decoder.
Detects persistence mechanisms associated with the trojanized anthropic.claude-code loader, including macOS LaunchAgent creation (com.apple.sysmond), Linux cron @reboot persistence using hidden config files (.smt), Windows scheduled tasks (SysMon SYSTEM task), and SSH authorized keys manipulation.
The following analytic detects the use of Ngrok on a Linux operating system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments associated with Ngrok. This activity is significant because Ngrok can be used by adversaries to establish reverse proxies, potentially bypassing network defenses. If confirmed malicious, this could allow attackers to create persistent, unauthorized access channels, facilitating data exfiltration or further exploitation of the compromised system.
Detects execution of virtualization and container software on Windows endpoints by image name, covering Hyper-V, VMware, VirtualBox, QEMU, Xen, Parallels, WSL, Docker and containerd. Attackers can run payloads inside a virtual machine or WSL instance to hide activity from host-based security tools. Developers and administrators use these tools routinely, so the rule suits inventory and hunting. To triage, check the user, parent process, command line and hash, and whether the host is expected to run virtual machines.
Detects suspicious process activity associated with PolyFlame malware on Linux endpoints, specifically monitoring for vdaemon spawning shell or command interpreter processes, or vdaemon child processes following rsshd/conf_sshd/aaamgrd loader activity.
Detects the installation or execution of unauthorized Remote Monitoring and Management (RMM) tools such as MeshCentral, Atera, Teramind, AnyDesk, or AdaptixC2 artifacts on endpoints. It flags devices running multiple distinct RMM tools or featuring AdaptixC2.
Detects behavior where a Node.js process spawns a command shell or interpreter (such as sh, bash, cmd.exe, or powershell.exe) executing suspicious commands indicative of remote code execution (RCE), reverse shells, or payload downloading, consistent with vulnerabilities like the Node.js decompression flaw CVE-2026-111497.
Detects behavioral indicators of an SSH or autossh reverse tunnel (-R) executed with no remote command (-N) and host-key checking disabled, combined with network connections to a known command and control IP address.
Detects the Tensorlake npm compromise (tensorlake@0.5.144, Shai-Hulud) through the two payload hashes, gh-token-monitor persistence, node or bun running lib/setup.mjs or Math_Symbol.js and node or bun connections to iseekaigogo.com or public Ethereum RPC hosts. It needs Defender for Endpoint events from developer machines and does not see lockfile or package cache contents. The query ran without errors in a live tenant
The following analytic identifies instances where `ipconfig.exe`, `systeminfo.exe`, `net1.exe`, or similar tools are executed by a non-standard shell parent process, excluding CMD, PowerShell, Explorer, or `net.exe`.
This detection leverages Endpoint Detection and Response (EDR) telemetry to monitor process creation events. Such behavior is significant as it may indicate adversaries using injected processes to perform system discovery, a tactic observed in FIN7's JSSLoader.
If confirmed malicious, this activity could allow attackers to gather critical host information, aiding in further exploitation or lateral movement within the network.
This detection leverages Endpoint Detection and Response (EDR) telemetry to monitor process creation events. Such behavior is significant as it may indicate adversaries using injected processes to perform system discovery, a tactic observed in FIN7's JSSLoader.
If confirmed malicious, this activity could allow attackers to gather critical host information, aiding in further exploitation or lateral movement within the network.
Identifies Node.js processes that spawn potentially suspicious child processes, including operating system shells, command interpreters, scripting runtimes, and download utilities. This behaviour may indicate exploitation of a Node.js application resulting in arbitrary command execution, followed by payload retrieval or additional post-exploitation activity.
Further than have the PHP software updated with the supported versions and take actions over the Exposed Devices,having the latest PHP version installed doesn't mean your web applications are actually using it. I would recommend a double check over IIS, Apache or other process that could be executing old PHP Versions even if the server has installed the newest ones, see example : https://lnkd.in/esrKn-FK
Detects a camera management software binary (e.g. iVMS-4200,
SmartPSS, NVR/DVR viewers, vendor CMS/VMS clients) spawning cmd.exe,
powershell.exe or pwsh.exe. In this campaign the compromised vendor update
channel abused the trusted, signed vendor executable to proxy execution of
follow-on payloads and shell commands, inheriting the vendor signature to
evade application allowlisting and static detection.
SmartPSS, NVR/DVR viewers, vendor CMS/VMS clients) spawning cmd.exe,
powershell.exe or pwsh.exe. In this campaign the compromised vendor update
channel abused the trusted, signed vendor executable to proxy execution of
follow-on payloads and shell commands, inheriting the vendor signature to
evade application allowlisting and static detection.
Detects Windows web/PHP worker processes (php.exe, php-cgi.exe,
apache.exe, httpd.exe, lsphp.exe, nginx.exe) spawning unexpected command shells
or download utilities. Exploitation of CVE-2026-109618 / CVE-2026-109619 in core
PHP grants unauthenticated RCE; the child process is the observable artifact since
the memory corruption leaves no trace in the PHP logs. mod_php deployments are
the highest-risk configuration.
apache.exe, httpd.exe, lsphp.exe, nginx.exe) spawning unexpected command shells
or download utilities. Exploitation of CVE-2026-109618 / CVE-2026-109619 in core
PHP grants unauthenticated RCE; the child process is the observable artifact since
the memory corruption leaves no trace in the PHP logs. mod_php deployments are
the highest-risk configuration.
Detects instances where Microsoft Teams (ms-teams.exe, Teams.exe) or its associated WebView2 process spawns a command or script interpreter (such as PowerShell, Cmd, Mshta, Wscript, Cscript) with suspicious download-and-execute arguments, which is commonly associated with ClickFix social engineering attacks or similar initial access tactics.
Detects PowerShell attempting to install and start the OpenSSH Server on Windows, typically triggered by malicious extensions or backdoors to enable remote SSH access.
Detects exploitation of the PHP2Shell RCE vulnerabilities in core PHP
(CVE-2026-109618 out-of-memory corruption and CVE-2026-109619 stale global state),
which allow unauthenticated remote code execution delivered through malicious
multipart uploads. Successful exploitation causes the PHP-FPM/Apache/httpd/lsphp
worker, typically running as www-data, to spawn a system shell (sh, bash, cmd,
powershell) or a download utility (curl, wget) to retrieve a second-stage payload.
A web server process spawning an interactive shell is a high-fidelity indicator of
web application compromise and should be investigated immediately.
(CVE-2026-109618 out-of-memory corruption and CVE-2026-109619 stale global state),
which allow unauthenticated remote code execution delivered through malicious
multipart uploads. Successful exploitation causes the PHP-FPM/Apache/httpd/lsphp
worker, typically running as www-data, to spawn a system shell (sh, bash, cmd,
powershell) or a download utility (curl, wget) to retrieve a second-stage payload.
A web server process spawning an interactive shell is a high-fidelity indicator of
web application compromise and should be investigated immediately.
Detects security software discovery behavior by identifying tasklist execution combined with directory listings of the CrowdStrike sensor folder on the same device within a short window, which can serve as a coverage check for hosts lacking the Falcon sensor.
Detects web server processes or spawned shell interpreters executing search tools (like grep, find, cat) against known configuration or shell history files containing credential-related keywords.
Page 2 of 976