Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,045 detections
Filters
Last updated
All Time
Detection languages
15,346
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,106
9,754
3,848
3,756
3,712
Platforms
40,045
7,313
6,542
3,903
3,660
Products / Services
10,431
9,678
6,722
1,887
1,878
MITRE Techniques
13,736
13,114
8,062
5,947
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects a single non-browser process that touches, copies, or stages files from multiple browser profile stores along with OpenVPN configuration files within a short timeframe, which is indicative of credential harvesting or session hijacking activity.
Detects executable files saved to user-writable profile folders (Desktop, Downloads, Documents and similar) on Windows endpoints when the file has no company name in its PE version information. Commercial software almost always carries this field, while malware, masqueraded tools and quick custom builds often do not. Detection relies on file signature rather than extension. Portable utilities and internal tools also match, so triage by hash, writing process, file path and download source.
Detects the installation of a Windows service (Event IDs 4697 or 7045) where the image path executes PowerShell, rundll32, or an ADMIN$ share binary, preceded within 10 minutes by a remote admin share access (Event ID 5140 to ADMIN$ or C$). This behavior is commonly associated with lateral movement frameworks such as Cobalt Strike.
Detects potential remote code execution, web shell activity, and post-exploitation behaviors originating from PHP worker processes on internet-facing hosts, referencing patterns associated with php2shell vulnerabilities. PHP-UP-2026
Detects rclone-style copy operations transferring data from a UNC share to an SFTP remote. It identifies malicious use by inspecting specific argument sets and handles renamed binaries (such as SearchApp.exe) masquerading as rclone.
Detects an executable launched from a KB-numbered staging folder under AppDataRoaming spawning cmd.exe to execute multiple host and network discovery commands such as registry queries, ipconfig, or tasklist.
Detects shell or downloader child processes (such as sh, bash, cmd.exe, powershell.exe, curl, or wget) spawned by common server application processes (such as Java, Ruby, Perl, or Exiftool), which may indicate Remote Code Execution (RCE) exploitation such as CVE-2021-26084, CVE-2023-22518, or CVE-2021-22205.
Detects the execution of unauthorized Remote Monitoring and Management (RMM) tools shortly after either Microsoft Teams activity or a surge of inbound emails (email bombing) targeting the same user, a common precursor pattern used by threat actors for social engineering and initial access.
Detects persistence mechanisms associated with the trojanized anthropic.claude-code loader, including macOS LaunchAgent creation (com.apple.sysmond), Linux cron @reboot persistence using hidden config files (.smt), Windows scheduled tasks (SysMon SYSTEM task), and SSH authorized keys manipulation.
With binaries blocked, operators upload using .NET primitives and web cmdlets (WebClient.UploadFile, Invoke-RestMethod -Method Post -InFile, FtpWebRequest). Logic is anchored on strong upload indicators, not webclient + URL (which mostly catches download cradles).
Detects potential web server remote code execution through suspicious child processes launched by PHP, FastCGI, Apache, and IIS workers. Identifies reverse shells, encoded commands, payload retrieval, reconnaissance, and temporary PHP execution.
Detects inbound exploitation sources and outbound callback destinations associated with PHP2Shell infrastructure (CVE-2026-109618), correlating both directions per device while filtering out standard browser traffic.
Identifies devices running PHP versions affected by CVE-2026-109618 or CVE-2026-109619. The detection returns affected hosts, operating system platform, installed PHP version, and associated IPv4 addresses to support vulnerability assessment and remediation.
Detects instances of BTCPay Server running version 2.4.1 or earlier, which contain known vulnerabilities patched in version 2.4.2.
Identifies devices that have communicated with domains present in the OpenPhish public phishing feed by comparing domains observed in DeviceNetworkEvents.RemoteUrl against domains extracted from the current OpenPhish feed.
Detects DLL files written to user-writable profile folders (Desktop, Downloads, Documents and similar) on Windows endpoints. Attackers use these folders to stage a malicious DLL next to a legitimate executable, often from a phishing archive, so the executable loads it via DLL side-loading. Events are grouped by endpoint and path with DLL names, vendor, SHA-256 and the writing process. Installers and portable apps also match, so triage by hash, vendor, writing process and download source.
Detects and correlates installed PHP software packages and active PHP process execution across endpoints using device inventory, configuration data, and system logs to provide exposure visibility for PHP environments.
Detects Portable Executable (PE) files written to a user's Downloads folder on Windows endpoints. CrowdStrike identifies PE files by file signature, so renamed or extensionless executables are caught as well as .exe files. Downloads is a common landing spot for payloads from phishing links and drive-by downloads. Most hits are legitimate installers, so use the rule for hunting or as a pivot. To triage, review the file name, company name, hash, writing process and download source.
Detects suspicious chains involving LuaJIT binary execution, dropped dist.lua scripts in temp directories, scheduled task persistence utilizing numbered LuaJIT executables, and specific lure zip file downloads or anomalous script creation in setup directories.
Detects the execution of Xwizard tool with the "RunWizard" flag and a GUID like argument.
This utility can be abused in order to run custom COM object created in the registry.
This utility can be abused in order to run custom COM object created in the registry.
Detects a camera management software binary (e.g. iVMS-4200,
SmartPSS, NVR/DVR viewers, vendor CMS/VMS clients) spawning cmd.exe,
powershell.exe or pwsh.exe. In this campaign the compromised vendor update
channel abused the trusted, signed vendor executable to proxy execution of
follow-on payloads and shell commands, inheriting the vendor signature to
evade application allowlisting and static detection.
SmartPSS, NVR/DVR viewers, vendor CMS/VMS clients) spawning cmd.exe,
powershell.exe or pwsh.exe. In this campaign the compromised vendor update
channel abused the trusted, signed vendor executable to proxy execution of
follow-on payloads and shell commands, inheriting the vendor signature to
evade application allowlisting and static detection.
Page 4 of 1907