Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,240 detections
Filters
Last updated
All Time
Detection languages
1,690
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,253
2,024
730
384
305
Platforms
2,613
886
443
69
43
Products / Services
938
630
365
186
163
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
3,240
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
Detects potential remote code execution, web shell activity, and post-exploitation behaviors originating from PHP worker processes on internet-facing hosts, referencing patterns associated with php2shell vulnerabilities. PHP-UP-2026
Detects potential web server remote code execution through suspicious child processes launched by PHP, FastCGI, Apache, and IIS workers. Identifies reverse shells, encoded commands, payload retrieval, reconnaissance, and temporary PHP execution.
Detects Node.js processes spawning shells, script hosts or download tools, which is how post exploitation of a Node.js server would look after CVE-2026-111497 (Brotli decoder out of bounds write, fixed in 22.23.4, 24.22.1 and 26.12.1). Devices that Defender Vulnerability Management lists as vulnerable are flagged and sorted first, and rows are still returned when the CVE is not listed. It excludes npm, npx, yarn and pnpm processes and GitHub Actions runner action processes, which start shells for build scripts. It does not detect the memory corruption itself. The query ran without errors in a live tenant.
Detects behavior where a Node.js process spawns a command shell or interpreter (such as sh, bash, cmd.exe, or powershell.exe) executing suspicious commands indicative of remote code execution (RCE), reverse shells, or payload downloading, consistent with vulnerabilities like the Node.js decompression flaw CVE-2026-111497.
Detects a Node.js web server process initiating a child process that is a known command shell or download utility, which is indicative of post-exploitation activity such as remote code execution.
Identifies Node.js processes that spawn potentially suspicious child processes, including operating system shells, command interpreters, scripting runtimes, and download utilities. This behaviour may indicate exploitation of a Node.js application resulting in arbitrary command execution, followed by payload retrieval or additional post-exploitation activity.
The following analytic detects PHP command-line interpreters executing code supplied directly on the command line with the CLI -r / --run options, or code supplied to PHPDBG through standard input.
It covers common CLI executable names on Linux and Windows, including php.exe, php-win.exe, the legacy php-cli.exe name, versioned Linux php binaries, phpdbg, and FrankenPHP's php-cli subcommand.
PHP-CGI and PHP-FPM are excluded because they do not support the PHP CLI inline -r option.
This behavior can be used legitimately for administration and automation, but unexpected or obfuscated inline PHP execution may indicate an attacker using an installed interpreter to run commands without dropping a script file.
It covers common CLI executable names on Linux and Windows, including php.exe, php-win.exe, the legacy php-cli.exe name, versioned Linux php binaries, phpdbg, and FrankenPHP's php-cli subcommand.
PHP-CGI and PHP-FPM are excluded because they do not support the PHP CLI inline -r option.
This behavior can be used legitimately for administration and automation, but unexpected or obfuscated inline PHP execution may indicate an attacker using an installed interpreter to run commands without dropping a script file.
Detects the Tensorlake npm compromise (tensorlake@0.5.144, Shai-Hulud) through the two payload hashes, gh-token-monitor persistence, node or bun running lib/setup.mjs or Math_Symbol.js and node or bun connections to iseekaigogo.com or public Ethereum RPC hosts. It needs Defender for Endpoint events from developer machines and does not see lockfile or package cache contents. The query ran without errors in a live tenant
Detects suspicious post-exploitation activities, reconnaissance, and command execution originating from web server and PHP lineage processes, indicating potential webshell activity or compromised web applications.
Detects post-exploitation behavior where a Node.js process spawns a shell, interpreter, or utility (such as sh, bash, nc, curl, python), which may indicate Remote Code Execution (RCE) via vulnerabilities like CVE-2026-111497 in the Node.js Brotli decoder.
Detects suspicious post-exploitation activities, reconnaissance, and command execution originating from web server and PHP lineage processes, indicating potential webshell activity or compromised web applications.
Detects post-exploitation activity where a Node.js or Bun runtime process spawns a shell, interpreter, or network download utility, which could indicate exploitation such as CVE-2026-111497 (Node2Shell).
Detects instances where web server processes or PHP interpreters (apache2, httpd, php-fpm, php) spawn a shell process (sh, bash, dash). This behavior is often indicative of post-exploitation activity such as remote code execution (RCE) via PHP session upload progress or web shell activity.
Detects package manager installations or executions spawned by an AI coding agent (such as claude, codex, or cursor) involving specific indicators like the 'function-color' package or running out of a Downloads working directory.
Detects web server worker processes (such as PHP-FPM, Apache httpd, etc.) launching shells, interpreters, or download/network tools, which is a common post-exploitation pattern following remote code execution (RCE) vulnerabilities.
Detects a Python process spawning a Node.js child process that executes a JavaScript script located within a temporary directory, accompanied by a .json or .br configuration argument, matching known PoC execution patterns (such as CVE-2026-111497).
Detects web server worker processes and PHP runtimes (associated with CVE-2026-109618 and CVE-2026-109619) spawning command-line shells, interpreters, or data transfer utilities, indicative of post-exploitation or RCE.
Detects web server or PHP worker processes spawning command interpreters, shells, or transfer tools, which is indicative of post-exploitation or remote code execution vulnerabilities.
Detects post-exploitation behavior where a Node.js, Node, or Bun runtime spawns a Unix shell process (such as sh, bash, or dash) with command line arguments indicative of code execution, reverse shells, or download tools (e.g., -c, /dev/tcp, mkfifo, curl, wget, nc, base64).
Detects node or agent-initiated npm installation commands (such as npm install or npm i) executed within 24 hours of creating or modifying a developer assistant instruction file (such as AGENTS.md, CLAUDE.md, .cursorrules) in common user directories like Downloads, Desktop, or Temp.
Detects process execution of Node.js or Bun where inline scripts or command-line arguments utilize Brotli decompress functions from the zlib library.
Page 1 of 155