Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61,046 detections
Filters
Last updated
All Time
Detection languages
23,955
16,903
4,364
4,342
3,270
Contributors
11,679
8,654
7,555
6,800
4,504
Categories
20,590
11,933
5,910
5,194
4,872
Platforms
40,154
7,369
6,547
3,915
3,692
Products / Services
10,809
9,795
6,757
4,421
3,771
MITRE Techniques
18,176
15,735
12,661
8,477
6,293
CVEs
71
71
64
58
49
IDS Classtypes
1,937
503
461
381
237
IDS Protocols
2,431
869
408
324
97
Detects workload identity sign-ins from an IP /24 not seen for that service principal in the prior 30 days, followed by bulk Azure Key Vault secret reads by the same service principal within 1 hour, characteristic of Storm-0940 credential abuse and exfiltration.
Performs a retrospective threat hunt for Key Eater indicators of compromise, checking Entra ID sign-ins, Azure DevOps auditing logs, and network events for known malicious IPs, subnets, user agents, and tunnel infrastructure.
Performs a retrospective threat hunt for Key Eater indicators of compromise, checking Entra ID sign-ins, Azure DevOps auditing logs, and network events for known malicious IPs, subnets, user agents, and tunnel infrastructure.
Detects root shell-outs containing shell metacharacters from the Control Web Panel (CWP) loopback user API (127.0.0.1:2302) affecting endpoints like valid_token and newpass.
Detects a potential command injection attack where a non-root hosting user utilizes curl or wget to relay requests containing shell metacharacters to the root CWP user API endpoint on loopback port 2302 (/v1/restoredatabase/), followed by a root-side MySQL child process spawned with the injected commands.
Inventory hunting query for the two critical PHP remote code execution vulnerabilities CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. PHP released the fixes on 21 October 2026 in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The query returns two kinds of rows. First, installed PHP packages in the Defender Vulnerability Management inventory whose version is below the fixed version of their branch or that belong to a branch the advisories do not cover (8.1 and older). Second, devices that Defender Vulnerability Management already associates with either CVE. Results show whether each device is internet facing and list those devices first. The query reads the Defender Vulnerability Management tables, so it runs in Defender XDR Advanced Hunting only. It lists installed versions and does not show which PHP build serves web requests or whether exploitation took place. Windows installs from zip archives are not inventoried and unusual package names are not matched. The second part can stay empty until Defender Vulnerability Management has processed the CVEs. The query follows the Microsoft Defender advanced hunting schemas and ran without errors in a live tenant.
Detects the execution of Xwizard tool with the "RunWizard" flag and a GUID like argument.
This utility can be abused in order to run custom COM object created in the registry.
This utility can be abused in order to run custom COM object created in the registry.
Detects a camera management software binary (e.g. iVMS-4200,
SmartPSS, NVR/DVR viewers, vendor CMS/VMS clients) spawning cmd.exe,
powershell.exe or pwsh.exe. In this campaign the compromised vendor update
channel abused the trusted, signed vendor executable to proxy execution of
follow-on payloads and shell commands, inheriting the vendor signature to
evade application allowlisting and static detection.
SmartPSS, NVR/DVR viewers, vendor CMS/VMS clients) spawning cmd.exe,
powershell.exe or pwsh.exe. In this campaign the compromised vendor update
channel abused the trusted, signed vendor executable to proxy execution of
follow-on payloads and shell commands, inheriting the vendor signature to
evade application allowlisting and static detection.
Detects a potential password spraying attack characterized by multiple authentication failures across numerous users from a single IP address, followed by a successful sign-in from that same IP, culminating in a privileged role or credential change performed by the compromised account.
Detects Microsoft Teams chat creation events originating from an external sender whose user ID or display name impersonates IT support (e.g., IT Support, Help Desk, Service Desk), often used in social engineering or phishing attempts.
The following analytic detects instances where Java, web server, or application server processes attempts to spawn
a Linux shell, which may indicate exploitation attempts. This detection leverages Endpoint Detection and Response
(EDR) telemetry, focusing on process names and parent-child process relationships. This activity may indicate a
compromised service leading to unauthorized shell access. If confirmed malicious, attackers could execute commands,
escalate privileges, or maintain persistent access.
a Linux shell, which may indicate exploitation attempts. This detection leverages Endpoint Detection and Response
(EDR) telemetry, focusing on process names and parent-child process relationships. This activity may indicate a
compromised service leading to unauthorized shell access. If confirmed malicious, attackers could execute commands,
escalate privileges, or maintain persistent access.
Detects Linux shell command lines that tie the /var/.m re-infection script to boot persistence by appending it to rc.local, rcS, or JAWS mtd startup scripts, or by copying it to /etc/init.d/bot and symlinking it as S99bot in runlevel directories.
Detects a service principal attempting to delete multiple Azure SQL databases in a short timeframe, resulting in failures. This pattern is characteristic of malicious data destruction activity, such as that observed in Storm-3168 (JADEPUFFER) campaigns, but accounts for the possibility of misconfigured infrastructure-as-code pipelines by requiring a high volume of failed requests across distinct resources.
Detects execution of virtualization and container software on Windows endpoints by image name, covering Hyper-V, VMware, VirtualBox, QEMU, Xen, Parallels, WSL, Docker and containerd. Attackers can run payloads inside a virtual machine or WSL instance to hide activity from host-based security tools. Developers and administrators use these tools routinely, so the rule suits inventory and hunting. To triage, check the user, parent process, command line and hash, and whether the host is expected to run virtual machines.
Detects enumeration of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.
Detects instances where Microsoft Teams (ms-teams.exe, Teams.exe) or its associated WebView2 process spawns a command or script interpreter (such as PowerShell, Cmd, Mshta, Wscript, Cscript) with suspicious download-and-execute arguments, which is commonly associated with ClickFix social engineering attacks or similar initial access tactics.
Detects post-exploitation behavior where a Node.js process spawns a shell, interpreter, or utility (such as sh, bash, nc, curl, python), which may indicate Remote Code Execution (RCE) via vulnerabilities like CVE-2026-111497 in the Node.js Brotli decoder.
Detects processes (excluding common legitimate ones like browsers or backup tools) that access sensitive local data such as iPhone MobileSync backups or Slack workspace storage, while simultaneously initiating network connections to roblox.com.
Use this query if you don't have the Falcon Spotlight in your CrowdStrike subscription. Use this to identify any PHP running in your environment. We used this to quickly identify hosts running PHP.
Detects web servers, PHP processes, or shell processes spawning fetch utilities such as wget or curl to communicate with a specific malicious payload IP address (162.35.99.94), often indicative of web shell exploitation or post-exploitation file download activity.
Detects a sequence where an unsigned or untrusted kernel driver is loaded from a user-writable path (potentially indicating a Bring Your Own Vulnerable Driver / BYOVD pattern), followed by a security tampering attempt or antivirus tamper event on the same device within a 30-minute window.
Page 20 of 2907