Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61,022 detections
Filters
Last updated
All Time
Detection languages
23,931
16,903
4,364
4,342
3,270
Contributors
11,679
8,654
7,555
6,800
4,504
Categories
20,580
11,924
5,908
5,189
4,871
Platforms
40,137
7,364
6,547
3,913
3,687
Products / Services
10,799
9,795
6,757
4,421
3,768
MITRE Techniques
18,173
15,727
12,654
8,468
6,288
CVEs
71
71
64
58
49
IDS Classtypes
1,937
503
461
381
237
IDS Protocols
2,431
869
408
324
97
Detects Portable Executable (PE) files written to a user's Downloads folder on Windows endpoints. CrowdStrike identifies PE files by file signature, so renamed or extensionless executables are caught as well as .exe files. Downloads is a common landing spot for payloads from phishing links and drive-by downloads. Most hits are legitimate installers, so use the rule for hunting or as a pivot. To triage, review the file name, company name, hash, writing process and download source.
Detects and correlates installed PHP software packages and active PHP process execution across endpoints using device inventory, configuration data, and system logs to provide exposure visibility for PHP environments.
Detects a process launched by msiexec.exe or WixShellExec from a user-writable install path (%LOCALAPPDATA%\Programs) that subsequently loads an unsigned DLL from its own application directory within a short time window.
Detects command-line activity staging files using utilities like tar or mkdir into an AppData\Roaming\KB<digits> directory, followed shortly by the execution of a renamed Bun runtime (.js) or Java runtime (.java) from that same path.
Detects Active Directory Certificate Services (AD CS) certificate issuance events (Event ID 4887) where the user requesting the certificate differs from the Subject Alternative Name (SAN) identity supplied in the request. This behavior is indicative of ESC1-style AD CS privilege escalation abuse, where a user requests a certificate on behalf of another privileged user.
Detects rclone-style copy operations from a file server share to an SFTP destination, including renamed binaries such as SearchApp.exe, by matching specific command-line arguments and parameters.
Detects Vertex AI model invocations such as GenerateContent, Predict, and RawPredict originating from common scripting user agents (e.g., Python requests, curl, Wget), which can indicate potential LLM jacking or unauthorized resource consumption.
Detects workload identity sign-ins from an IP /24 not seen for that service principal in the prior 30 days, followed by bulk Azure Key Vault secret reads by the same service principal within 1 hour, characteristic of Storm-0940 credential abuse and exfiltration.
Performs a retrospective threat hunt for Key Eater indicators of compromise, checking Entra ID sign-ins, Azure DevOps auditing logs, and network events for known malicious IPs, subnets, user agents, and tunnel infrastructure.
Performs a retrospective threat hunt for Key Eater indicators of compromise, checking Entra ID sign-ins, Azure DevOps auditing logs, and network events for known malicious IPs, subnets, user agents, and tunnel infrastructure.
Detects a potential command injection attack where a non-root hosting user utilizes curl or wget to relay requests containing shell metacharacters to the root CWP user API endpoint on loopback port 2302 (/v1/restoredatabase/), followed by a root-side MySQL child process spawned with the injected commands.
Inventory hunting query for the two critical PHP remote code execution vulnerabilities CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. PHP released the fixes on 21 October 2026 in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The query returns two kinds of rows. First, installed PHP packages in the Defender Vulnerability Management inventory whose version is below the fixed version of their branch or that belong to a branch the advisories do not cover (8.1 and older). Second, devices that Defender Vulnerability Management already associates with either CVE. Results show whether each device is internet facing and list those devices first. The query reads the Defender Vulnerability Management tables, so it runs in Defender XDR Advanced Hunting only. It lists installed versions and does not show which PHP build serves web requests or whether exploitation took place. Windows installs from zip archives are not inventoried and unusual package names are not matched. The second part can stay empty until Defender Vulnerability Management has processed the CVEs. The query follows the Microsoft Defender advanced hunting schemas and ran without errors in a live tenant.
Correlates an interactive MFA-satisfied user sign-in with a subsequent non-interactive or token-based successful authentication from a different IP address and country within a short time window for the same user and application. This pattern is indicative of adversary-in-the-middle (AitM) phishing attacks where session cookies or tokens are intercepted and replayed.
Detects Sysinternals executables written to disk on Windows endpoints, identified by the Sysinternals company name in the PE metadata of newly written EXE files. These are legitimate admin utilities, but attackers also copy them to hosts for discovery, process inspection and credential access. The rule shows tool presence only, not misuse, so it suits inventory and hunting. To triage, review the file path, hash, writing process and whether the user is an administrator.
Detects the execution of Xwizard tool with the "RunWizard" flag and a GUID like argument.
This utility can be abused in order to run custom COM object created in the registry.
This utility can be abused in order to run custom COM object created in the registry.
The following analytic detects the use of Ngrok on a Linux operating system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments associated with Ngrok. This activity is significant because Ngrok can be used by adversaries to establish reverse proxies, potentially bypassing network defenses. If confirmed malicious, this could allow attackers to create persistent, unauthorized access channels, facilitating data exfiltration or further exploitation of the compromised system.
Detects a camera management software binary (e.g. iVMS-4200,
SmartPSS, NVR/DVR viewers, vendor CMS/VMS clients) spawning cmd.exe,
powershell.exe or pwsh.exe. In this campaign the compromised vendor update
channel abused the trusted, signed vendor executable to proxy execution of
follow-on payloads and shell commands, inheriting the vendor signature to
evade application allowlisting and static detection.
SmartPSS, NVR/DVR viewers, vendor CMS/VMS clients) spawning cmd.exe,
powershell.exe or pwsh.exe. In this campaign the compromised vendor update
channel abused the trusted, signed vendor executable to proxy execution of
follow-on payloads and shell commands, inheriting the vendor signature to
evade application allowlisting and static detection.
The following analytic detects when an Azure AD guest user account has its UserType property changed from Guest to Member.
It leverages Azure Active Directory AuditLogs for the "Update user" operation and compares the UserType modifiedProperty old and new values.
A legacy account whose UserType was null is not a guest promotion and does not match.
Guest accounts carry inherent restrictions on tenant resource access; elevating to Member removes those restrictions.
If confirmed malicious, this activity indicates an attacker is expanding the capabilities of a compromised or attacker-controlled guest account to gain broader access to tenant resources.
It leverages Azure Active Directory AuditLogs for the "Update user" operation and compares the UserType modifiedProperty old and new values.
A legacy account whose UserType was null is not a guest promotion and does not match.
Guest accounts carry inherent restrictions on tenant resource access; elevating to Member removes those restrictions.
If confirmed malicious, this activity indicates an attacker is expanding the capabilities of a compromised or attacker-controlled guest account to gain broader access to tenant resources.
Detects a potential password spraying attack characterized by multiple authentication failures across numerous users from a single IP address, followed by a successful sign-in from that same IP, culminating in a privileged role or credential change performed by the compromised account.
Detects Microsoft Teams chat creation events originating from an external sender whose user ID or display name impersonates IT support (e.g., IT Support, Help Desk, Service Desk), often used in social engineering or phishing attempts.
Detects an address whose sign-ins are mostly failures across many accounts in a short window, with scripted clients and Storm-0940 campaign addresses flagged, which is how the password spray in Microsoft's ARTEX reporting looked. It does not cover the ConnectWise application sign-ins (service principal events) or a spray spread over many addresses. The query ran without errors in a live tenant.
Page 15 of 2906