Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
929 detections
Filters
Last updated
All Time
Detection languages
509
142
62
49
48
Contributors
250
202
86
62
43
Categories
670
666
270
163
112
Platforms
712
280
195
27
18
Products / Services
200
160
104
90
63
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
929
CVEs
10
9
9
8
7
IDS Classtypes
4
1
1
1
IDS Protocols
5
1
KQL detects suspicious child processes launched by PHP or web-server workers following possible exploitation of CVE-2026-109618 or CVE-2026-109619.
Detects Node.js processes spawning shells, script hosts or download tools, which is how post exploitation of a Node.js server would look after CVE-2026-111497 (Brotli decoder out of bounds write, fixed in 22.23.4, 24.22.1 and 26.12.1). Devices that Defender Vulnerability Management lists as vulnerable are flagged and sorted first, and rows are still returned when the CVE is not listed. It excludes npm, npx, yarn and pnpm processes and GitHub Actions runner action processes, which start shells for build scripts. It does not detect the memory corruption itself. The query ran without errors in a live tenant.
Detects potential web server remote code execution through suspicious child processes launched by PHP, FastCGI, Apache, and IIS workers. Identifies reverse shells, encoded commands, payload retrieval, reconnaissance, and temporary PHP execution.
Detects web server worker processes (php-fpm, apache2, httpd, nginx) or PHP interpreters spawning shell or reconnaissance utilities (sh, bash, curl, wget, id, whoami), consistent with post-exploitation activity such as PHP2Shell remote code execution.
Detects web servers, PHP processes, or shell processes spawning fetch utilities such as wget or curl to communicate with a specific malicious payload IP address (162.35.99.94), often indicative of web shell exploitation or post-exploitation file download activity.
Detects behavior where a Node.js process spawns a command shell or interpreter (such as sh, bash, cmd.exe, or powershell.exe) executing suspicious commands indicative of remote code execution (RCE), reverse shells, or payload downloading, consistent with vulnerabilities like the Node.js decompression flaw CVE-2026-111497.
Detects post-exploitation activity following PHP2Shell RCE vulnerabilities on Linux, where a web server or PHP worker process or web server user creates cron persistence, modifies SSH authorized_keys, or launches reverse shell one-liners.
Detects exploitation of the PHP2Shell RCE vulnerabilities in core PHP
(CVE-2026-109618 out-of-memory corruption and CVE-2026-109619 stale global state),
which allow unauthenticated remote code execution delivered through malicious
multipart uploads. Successful exploitation causes the PHP-FPM/Apache/httpd/lsphp
worker, typically running as www-data, to spawn a system shell (sh, bash, cmd,
powershell) or a download utility (curl, wget) to retrieve a second-stage payload.
A web server process spawning an interactive shell is a high-fidelity indicator of
web application compromise and should be investigated immediately.
(CVE-2026-109618 out-of-memory corruption and CVE-2026-109619 stale global state),
which allow unauthenticated remote code execution delivered through malicious
multipart uploads. Successful exploitation causes the PHP-FPM/Apache/httpd/lsphp
worker, typically running as www-data, to spawn a system shell (sh, bash, cmd,
powershell) or a download utility (curl, wget) to retrieve a second-stage payload.
A web server process spawning an interactive shell is a high-fidelity indicator of
web application compromise and should be investigated immediately.
Detects web server worker processes or PHP interpreters spawning suspicious child processes associated with reverse shells, network sockets, or reconnaissance commands.
Detects Linux process creation where a Node.js or Bun runtime spawns a shell or download utility as an anomalous child process (post-exploitation of the Brotli decoder out-of-bounds write, CVE-2026-111497), or where the Node2Shell PoC python script is run.
Detects a Node.js or Bun process spawning a shell or common download utility on Linux, indicating potential post-exploitation activity such as remote code execution (e.g., CVE-2026-111497).
Detects PHP SAPI processes accessing /proc/self/mem (or equivalent memory mapping) and subsequently spawning a Unix shell, which is characteristic of web shell activity or exploitation of PHP memory corruption/injection vulnerabilities like zif_system.
Detects instances where web server processes or PHP interpreters (apache2, httpd, php-fpm, php) spawn a shell process (sh, bash, dash). This behavior is often indicative of post-exploitation activity such as remote code execution (RCE) via PHP session upload progress or web shell activity.
Detects post-exploitation behavior where a Node.js, Node, or Bun runtime spawns a Unix shell process (such as sh, bash, or dash) with command line arguments indicative of code execution, reverse shells, or download tools (e.g., -c, /dev/tcp, mkfifo, curl, wget, nc, base64).
Detects web server or PHP worker processes spawning command interpreters, shells, or transfer tools, which is indicative of post-exploitation or remote code execution vulnerabilities.
Detects the execution of reverse shell commands, interpreters, or utilities (such as Netcat, Python, or bash using /dev/tcp) spawned from web server worker processes or script interpreters, which is typically indicative of a web shell or remote code execution exploitation.
Detects instances where the Apache web server spawns a shell process (sh, dash, bash) which subsequently executes common discovery or callback utilities (such as id, curl, wget, php, hostname, or uname), typically indicative of web application exploitation or remote code execution.
Detects observable consequences of remote code execution on a GitLab server (CVE-2026-97229), specifically where GitLab application services (such as Puma, Sidekiq, Ruby, GitLab Rails, or GitLab Workhorse) spawn a shell or interpreter with suspicious command-line parameters or external network utilities.
Detects anomalous activities associated with potential PHP2Shell exploitation or webshell deployment where a web server worker (such as Apache, HTTPD, or PHP) spawns a Unix shell containing suspicious utility tokens, drops a PHP file outside excluded directories, or creates a PHP session-derived file.
Detects web server processes (such as apache2, httpd, nginx, php-fpm) spawning a shell or curl process that performs LDAP queries using curl against URLs. This activity is indicative of Remote Code Execution (RCE) vulnerabilities being exploited against web applications to perform internal reconnaissance or LDAP enumeration.
Detects the execution of PaperCut reverse SOCKS5 bridge kit operator-side scripts (such as admin_bridge.py, live_reverse_socks5.py, start_socks.sh) or the creation of related Java bridge class artifacts.
Page 1 of 45