Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61,022 detections
Filters
Last updated
All Time
Detection languages
23,931
16,903
4,364
4,342
3,270
Contributors
11,679
8,654
7,555
6,800
4,504
Categories
20,580
11,924
5,908
5,189
4,871
Platforms
40,137
7,364
6,547
3,913
3,687
Products / Services
10,799
9,795
6,757
4,421
3,768
MITRE Techniques
18,173
15,727
12,654
8,468
6,288
CVEs
71
71
64
58
49
IDS Classtypes
1,937
503
461
381
237
IDS Protocols
2,431
869
408
324
97
Detects the execution of the Google Chrome browser in headless mode using command-line arguments indicative of infostealer activity (specifically containing 'vt_udd_'), where the process is not initiated by standard parent applications like Chrome itself, Edge, or Explorer.
Detects the NETRYX RAT shell handler (DeviceSync.exe) spawning cmd.exe with the /c parameter to execute operator-supplied commands, excluding legitimate application paths in Program Files and Windows directories.
Detects Windows web/PHP worker processes (php.exe, php-cgi.exe,
apache.exe, httpd.exe, lsphp.exe, nginx.exe) spawning unexpected command shells
or download utilities. Exploitation of CVE-2026-109618 / CVE-2026-109619 in core
PHP grants unauthenticated RCE; the child process is the observable artifact since
the memory corruption leaves no trace in the PHP logs. mod_php deployments are
the highest-risk configuration.
apache.exe, httpd.exe, lsphp.exe, nginx.exe) spawning unexpected command shells
or download utilities. Exploitation of CVE-2026-109618 / CVE-2026-109619 in core
PHP grants unauthenticated RCE; the child process is the observable artifact since
the memory corruption leaves no trace in the PHP logs. mod_php deployments are
the highest-risk configuration.
Detects inbound exploitation attempts and subsequent outbound payload fetching associated with Metro4Shell (CVE-2025-11953) indicators of compromise, including known malicious source IPs and payload hosting endpoints.
Detects PowerShell execution of an executable from the Temp directory with a randomly generated name and long base64-like encoded arguments, characteristic of Metro4Shell activity.
Detects potential exploitation of CVE-2025-11953 (Metro4Shell) where a Node.js development server spawns a command shell executing an encoded PowerShell command. The PowerShell script performs defense evasion via Windows Defender exclusions (Add-MpPreference), downloads a payload over raw TCP sockets (System.Net.Sockets.TcpClient), and executes it using Start-Process.
Detects behavioral artifacts associated with Impacket remote execution tools (such as wmiexec, smbexec, and atexec) on target hosts using Microsoft Defender XDR process telemetry. It identifies command-line signatures spawned by system processes like WmiPrvSE.exe, services.exe, and svchost.exe.
Detects unauthorized modifications to the runit SSH service run script or execution of loader processes and injectors referencing SD-WAN components (such as conf_sshd, rsshd, system-vdaemon, or libdssl.so) on Linux devices using Microsoft Defender for Endpoint telemetry.
Detects an inbound SSH (port 22) or NETCONF (port 830) connection from a public IP source to a device, followed closely on the same device by KeyDrift staging file/folder activity associated with network controller components.
Further than have the PHP software updated with the supported versions and take actions over the Exposed Devices,having the latest PHP version installed doesn't mean your web applications are actually using it. I would recommend a double check over IIS, Apache or other process that could be executing old PHP Versions even if the server has installed the newest ones, see example : https://lnkd.in/esrKn-FK
Detects a malformed PHPSESSID Set-Cookie header indicative of CVE-2026-109618, which may result in stale session ID memory disclosure in PHP applications.
Detects a sequence of suspicious behaviors on a single device within a 4-hour window: web shell file creation by a web server process, subsequent credential extraction or dumping tooling execution (such as accessing LSASS, NTDS, or SAM), and enumeration of installed security software or endpoint sensors.
Detects a behavioral sequence where a signed process loads an unsigned DLL from a user-writable path (DLL sideloading) followed shortly by outbound HTTPS network connections from the same process to legitimate cloud storage or API infrastructure.
This analytic detects suspicious PHP web application upload activity using Cisco Secure Firewall Threat Defense Intrusion Events.
The matching network signature identifies a request pattern associated with attempts to exhaust server resources through PHP session handling.
Investigate the source, targeted application, and related web server activity to determine whether the request was part of PHP2Shell exploitation.
The matching network signature identifies a request pattern associated with attempts to exhaust server resources through PHP session handling.
Investigate the source, targeted application, and related web server activity to determine whether the request was part of PHP2Shell exploitation.
Detects processes reconnecting to a public IPv4 or IPv6 address after at least 7 days of inactivity on ports other than DNS (53), HTTP (80), HTTPS (443), 8000.
Command-and-control implants often sit idle and then call back to infrastructure they have contacted before. Private, loopback, link-local, multicast and documentation ranges are excluded, and connections are grouped by endpoint, process, remote IP and port, then split into the last 24 hours and the prior history. Backup agents, license checks, update services and scheduled jobs also reconnect on a long cycle, so triage by process, destination reputation and how rare the destination is.
Run this over a search window of 30 days or more.
Command-and-control implants often sit idle and then call back to infrastructure they have contacted before. Private, loopback, link-local, multicast and documentation ranges are excluded, and connections are grouped by endpoint, process, remote IP and port, then split into the last 24 hours and the prior history. Backup agents, license checks, update services and scheduled jobs also reconnect on a long cycle, so triage by process, destination reputation and how rare the destination is.
Run this over a search window of 30 days or more.
Detects HTTP POST requests containing multipart/form-data with PHP_SESSION_UPLOAD_PROGRESS, which is associated with CVE-2026-109618 and CVE-2026-109619 exploitation attempts, tracked via a detection filter.
Detects multipart POST requests abusing PHP session.upload_progress features, often associated with PHP2Shell exploitation techniques, followed by server errors, crash indicators, or memory corruption terms.
Detects behavior associated with the Phexia macOS stealer, which stages browser, extension, and Safari cookie data into temporary directories before compressing them into a zip archive.
Detects potential credential theft and staging on macOS where plaintext login credentials are written to disk (~/.passphrase and ~/.txid) by osascript or related shell processes, often accompanied by or following a local dscl authonly check.
Detects the Phexia macOS dropper persistence mechanism where a shell script writes a plist file into ~/Library/LaunchAgents, reloads it using launchctl, and subsequently executes a base64 encoded payload piped into osascript via a shell interpreter.
Detects potential macOS dropper activity where a shell downloads a script using curl (piped or fetched) and subsequently spawns osascript to execute AppleScript commands.
Page 19 of 2906