Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61,046 detections
Filters
Last updated
All Time
Detection languages
23,955
16,903
4,364
4,342
3,270
Contributors
11,679
8,654
7,555
6,800
4,504
Categories
20,590
11,933
5,910
5,194
4,872
Platforms
40,154
7,369
6,547
3,915
3,692
Products / Services
10,809
9,795
6,757
4,421
3,771
MITRE Techniques
18,176
15,735
12,661
8,477
6,293
CVEs
71
71
64
58
49
IDS Classtypes
1,937
503
461
381
237
IDS Protocols
2,431
869
408
324
97
Detects an inbound email flood attack (many distinct senders to a single recipient within a 5-minute window) followed by an external Microsoft Teams message sent to the same user, typically associated with IT support pretexting or callback phishing attacks.
Detects potential stolen or replayed session tokens in Microsoft Entra ID (Azure AD) where the same SessionId is used from an IP address and ASN different from the interactive sign-in, without a fresh interactive authentication step.
Detects Python or shell processes executing inline code or command-line parameters that reference Langflow database files ('langflow.db'), environment variables ('os.environ', 'os.getenv'), configuration files ('.env'), and sensitive keywords such as apikey, credential, variable, provider, or sqlite, indicating potential credential harvesting or environment enumeration.
Detects Python or Langflow processes executing crontab reconnaissance (crontab -l) followed closely by reading known cryptocurrency miner artefacts or staging files on the same device.
Detects a sequence where a service principal successfully signs in from a suspicious or actor-linked IP address (including known Tor exit nodes), followed closely (within 1 hour) by Key Vault secret read operations (SecretGet or SecretList) originating from the same IP address.
Detects command-line activity staging files using utilities like tar or mkdir into an AppData\Roaming\KB<digits> directory, followed shortly by the execution of a renamed Bun runtime (.js) or Java runtime (.java) from that same path.
Detects Vertex AI model invocations such as GenerateContent, Predict, and RawPredict originating from common scripting user agents (e.g., Python requests, curl, Wget), which can indicate potential LLM jacking or unauthorized resource consumption.
Detects workload identity sign-ins from an IP /24 not seen for that service principal in the prior 30 days, followed by bulk Azure Key Vault secret reads by the same service principal within 1 hour, characteristic of Storm-0940 credential abuse and exfiltration.
Detects workload identity sign-ins from an IP /24 not seen for that service principal in the prior 30 days, followed by bulk Azure Key Vault secret reads by the same service principal within 1 hour, characteristic of Storm-0940 credential abuse and exfiltration.
Detects suspicious process activity associated with PolyFlame malware on Linux endpoints, specifically monitoring for vdaemon spawning shell or command interpreter processes, or vdaemon child processes following rsshd/conf_sshd/aaamgrd loader activity.
With a reported CVSS score of 9.2 and security updates scheduled for today, October 21, these vulnerabilities deserve attention, especially if you're still running legacy PHP versions.
𝗪𝗵𝗶𝗹𝗲 𝘄𝗮𝗶𝘁𝗶𝗻𝗴 𝗳𝗼𝗿 𝘁𝗵𝗲 𝗼𝗳𝗳𝗶𝗰𝗶𝗮𝗹 𝗽𝗮𝘁𝗰𝗵𝗲𝘀 𝗮𝗻𝗱 𝘁𝗲𝗰𝗵𝗻𝗶𝗰𝗮𝗹 𝗱𝗲𝘁𝗮𝗶𝗹𝘀, 𝘂𝗽𝗱𝗮𝘁𝗲 𝗮𝗹𝗹 𝗣𝗛𝗣 𝗩𝗲𝗿𝘀𝗶𝗼𝗻𝘀 𝘁𝗼 𝗮𝘁 𝗹𝗲𝗮𝘀𝘁 𝟴.𝟮 𝘁𝗼 𝗯𝗲 𝗮𝗯𝗹𝗲 𝘁𝗼 𝗵𝗮𝘃𝗲 𝘁𝗵𝗲 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝘂𝗽𝗱𝗮𝘁𝗲𝘀. I decided to spend some time exploring what we can already hunt for using Microsoft Defender XDR and KQL. I've put together a short technical article covering six hunting scenarios:
- PHP installations and outdated versions
- Suspicious child processes and command execution
- Reconnaissance activity
- Unexpected PHP file creation
- Unusual outbound network connections
- New process relationships compared to historical activity
These are not PHP2Shell-specific detections, but they can help identify suspicious activity on PHP servers without relying on published IoCs.
Sharing the queries in case they're useful for your own investigations.
𝗪𝗵𝗶𝗹𝗲 𝘄𝗮𝗶𝘁𝗶𝗻𝗴 𝗳𝗼𝗿 𝘁𝗵𝗲 𝗼𝗳𝗳𝗶𝗰𝗶𝗮𝗹 𝗽𝗮𝘁𝗰𝗵𝗲𝘀 𝗮𝗻𝗱 𝘁𝗲𝗰𝗵𝗻𝗶𝗰𝗮𝗹 𝗱𝗲𝘁𝗮𝗶𝗹𝘀, 𝘂𝗽𝗱𝗮𝘁𝗲 𝗮𝗹𝗹 𝗣𝗛𝗣 𝗩𝗲𝗿𝘀𝗶𝗼𝗻𝘀 𝘁𝗼 𝗮𝘁 𝗹𝗲𝗮𝘀𝘁 𝟴.𝟮 𝘁𝗼 𝗯𝗲 𝗮𝗯𝗹𝗲 𝘁𝗼 𝗵𝗮𝘃𝗲 𝘁𝗵𝗲 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝘂𝗽𝗱𝗮𝘁𝗲𝘀. I decided to spend some time exploring what we can already hunt for using Microsoft Defender XDR and KQL. I've put together a short technical article covering six hunting scenarios:
- PHP installations and outdated versions
- Suspicious child processes and command execution
- Reconnaissance activity
- Unexpected PHP file creation
- Unusual outbound network connections
- New process relationships compared to historical activity
These are not PHP2Shell-specific detections, but they can help identify suspicious activity on PHP servers without relying on published IoCs.
Sharing the queries in case they're useful for your own investigations.
This analytic detects repeated Linux process crash events followed by repeated successful executions of the same executable on the same host within 10 seconds.
A rapid crash and restart pattern in a service process can indicate exploitation attempts or unstable application behavior and should be correlated with network and application telemetry.
A rapid crash and restart pattern in a service process can indicate exploitation attempts or unstable application behavior and should be correlated with network and application telemetry.
eDiscovery or Compliance Search Created
Cortex XDR
Detects creation and execution of compliance searches or eDiscovery cases in Exchange/SaaS environments. Attackers with administrative access may use compliance searches to harvest sensitive data such as credentials, financial records, or PII across the organization.
The following analytic detects when an Azure AD guest user account has its UserType property changed from Guest to Member.
It leverages Azure Active Directory AuditLogs for the "Update user" operation and compares the UserType modifiedProperty old and new values.
A legacy account whose UserType was null is not a guest promotion and does not match.
Guest accounts carry inherent restrictions on tenant resource access; elevating to Member removes those restrictions.
If confirmed malicious, this activity indicates an attacker is expanding the capabilities of a compromised or attacker-controlled guest account to gain broader access to tenant resources.
It leverages Azure Active Directory AuditLogs for the "Update user" operation and compares the UserType modifiedProperty old and new values.
A legacy account whose UserType was null is not a guest promotion and does not match.
Guest accounts carry inherent restrictions on tenant resource access; elevating to Member removes those restrictions.
If confirmed malicious, this activity indicates an attacker is expanding the capabilities of a compromised or attacker-controlled guest account to gain broader access to tenant resources.
(Part 1 of a Correlation) Detects the creation of a potentially executable or script file by a browser or Microsoft Office application.
This rule is intended to be used in a correlation with a subsequent process execution.
This rule is intended to be used in a correlation with a subsequent process execution.
Detects file write, creation, or modification of C:\Windows\System32\TieringEngineService.exe
by any process other than legitimate Windows servicing components. The RedSun exploit
(CVE-2026-33825) overwrites this binary via a Defender cloud-file-rollback redirection
abuse, enabling SYSTEM-level code execution when the Tier Management Engine COM object
is subsequently invoked. Legitimate modification of this file is almost exclusively
performed by TrustedInstaller during Windows servicing operations.
by any process other than legitimate Windows servicing components. The RedSun exploit
(CVE-2026-33825) overwrites this binary via a Defender cloud-file-rollback redirection
abuse, enabling SYSTEM-level code execution when the Tier Management Engine COM object
is subsequently invoked. Legitimate modification of this file is almost exclusively
performed by TrustedInstaller during Windows servicing operations.
Detects PowerShell launching the exact remote script URL shown in the Exvicy ClickFix report.
Detects DLL files written to user-writable profile folders (Desktop, Downloads, Documents and similar) on Windows endpoints. Attackers use these folders to stage a malicious DLL next to a legitimate executable, often from a phishing archive, so the executable loads it via DLL side-loading. Events are grouped by endpoint and path with DLL names, vendor, SHA-256 and the writing process. Installers and portable apps also match, so triage by hash, vendor, writing process and download source.
This analytic detects Suricata multipart POST events with an uploaded filename containing a PHP opening tag.
Suricata EVE HTTP events do not expose multipart form field names, so this variant cannot confirm the PHPSESSID or PHP_SESSION_UPLOAD_PROGRESS fields without additional request-body inspection. The filename pattern may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.
Suricata EVE HTTP events do not expose multipart form field names, so this variant cannot confirm the PHPSESSID or PHP_SESSION_UPLOAD_PROGRESS fields without additional request-body inspection. The filename pattern may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.
Detects external Microsoft Teams messages containing support-related social engineering lures or originating from known malicious/IOC tenant domains, summarizing sender and thread metrics. The query ran without errors in a live tenant.
The following analytic detects the use of Ngrok on a Linux operating system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments associated with Ngrok. This activity is significant because Ngrok can be used by adversaries to establish reverse proxies, potentially bypassing network defenses. If confirmed malicious, this could allow attackers to create persistent, unauthorized access channels, facilitating data exfiltration or further exploitation of the compromised system.
Page 18 of 2907