Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61,022 detections
Filters
Last updated
All Time
Detection languages
23,931
16,903
4,364
4,342
3,270
Contributors
11,679
8,654
7,555
6,800
4,504
Categories
20,580
11,924
5,908
5,189
4,871
Platforms
40,137
7,364
6,547
3,913
3,687
Products / Services
10,799
9,795
6,757
4,421
3,768
MITRE Techniques
18,173
15,727
12,654
8,468
6,288
CVEs
71
71
64
58
49
IDS Classtypes
1,937
503
461
381
237
IDS Protocols
2,431
869
408
324
97
Detects a sequence where a non-browser process connects to a dead drop/paste or chat service (such as Pastebin, Nostr, or Telegram), followed on the same device by contact with the FLATROOF C2 webhook domain.
Correlates a certificate-based (PKINIT) Kerberos logon by an account with a DCSync-style directory replication from the same account within a 5-minute window, using Microsoft Defender for Identity logs.
Identify potential defense evasion activity where attackers abuse built-in Windows administration tools to stop services, clear logs, or modify auditing and security controls.
Detects a sequence where a ZIP file from known lure repositories or names is downloaded, followed within a day by the execution of a LuaJIT binary (util64.exe or luajit.exe) via a script launcher (Application.bat or Launcher.cmd) using obfuscated text files.
KQL detects suspicious child processes launched by PHP or web-server workers following possible exploitation of CVE-2026-109618 or CVE-2026-109619.
Detects when an account reads a Local Administrator Password Solution (LAPS) password attribute and subsequently modifies the resource-based constrained delegation (msDS-AllowedToActOnBehalfOfOtherIdentity) attribute within a 4-hour window, which may indicate privilege escalation activity.
Detects mass creation or renaming of files with the .L0CK3D extension (associated with C3RB3R / eCh0raix ransomware) within a short timeframe across multiple folders, optionally correlated with the creation of the read-me3.txt ransom note.
This analytic detects multipart POST requests containing a PHPSESSID form field and an uploaded filename with a PHP opening tag.
When observed with "PHP_SESSION_UPLOAD_PROGRESS" behavior, this may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.
When observed with "PHP_SESSION_UPLOAD_PROGRESS" behavior, this may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.
Dual-use transfer tools (rclone, WinSCP, curl, AzCopy, AWS/gcloud CLI) are favored by ransomware affiliates and APT operators because they are signed/legitimate. The hunt keys on upload-oriented flags and verbs per tool, not binary presence. Each tool has its own
KQL Query from file: PHP2Shell ThreatLock
Detects any file write event in a user's Downloads folder on Windows endpoints, covering every CrowdStrike Falcon Written event type.
Downloads is a common landing spot for payloads from phishing links and drive-by downloads. This is the broad version of the PE file rule and includes it, so it is very noisy and suits threat hunting or investigation pivots more than alerting. To triage, review the event type, file name, writing process, hash and company name.
Downloads is a common landing spot for payloads from phishing links and drive-by downloads. This is the broad version of the PE file rule and includes it, so it is very noisy and suits threat hunting or investigation pivots more than alerting. To triage, review the event type, file name, writing process, hash and company name.
Detects a VS Code-family editor or extension host process running 'git config --global user.email' and, within one minute from the same parent process, a curl public-IP lookup (ifconfig.me / api.ipify.org), the host-profiling step of the trojanized anthropic.claude-code loader.
Detects high volume POST requests to WordPress authentication or RPC endpoints (xmlrpc.php or wp-login.php) from external IPs, correlating whether the source previously enumerated WordPress users via wp-json/wp/v2/users or author parameters.
Detects a sequence where an unsigned or untrusted kernel driver is loaded from a user-writable path (potentially indicating a Bring Your Own Vulnerable Driver / BYOVD pattern), followed by a security tampering attempt or antivirus tamper event on the same device within a 30-minute window.
Detects service principal or non-interactive user sign-ins from an IP address not seen for that identity in the previous 14 days, with multiple successful sign-ins or accessed resources. This behavior may indicate compromised static credentials or secrets used for persistence or lateral movement without MFA.
Detects a potential web shell by identifying a web server or runtime process creating or modifying a script file (PHP, JS, MJS) in a web-accessible directory, followed closely by the same web server process spawning a shell or command interpreter.
Detects behavior where a php-fpm process spawns a command shell (sh, dash, bash) to access credential files like /etc/passwd or /etc/shadow, or invoke known renamed interpreter payloads alongside setuid/setgid patterns.
Detects the process-level execution of agentic offensive tooling and servers associated with the BOSSAI report, including HexStrike, Kali MCP, HalberdStrike, and CyberStrike.
Staging data into an archive and then sending it out within a short window is a hallmark of exfiltration. Correlating the two events on the same device (archive, then a public network connection from a transfer tool within 2 hours) is much higher fidelity than either event alone. The result is summarised per archive event to avoid join row multiplication.
KQL Query
Detects machine account NTLM logons to an Active Directory Certificate Services (AD CS) Web Enrollment server where the source device differs from the account's own host (indicative of NTLM coercion like PetitPotam), followed within 10 minutes by certificate enrollment requests (/certsrv/) from the same source host.
Page 7 of 2906