Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,085 detections
Filters
Last updated
All Time
Detection languages
937
669
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
208
171
Platforms
1,854
491
298
26
12
Products / Services
10,670
9,758
6,693
4,421
3,749
2,085
MITRE Techniques
760
704
336
308
238
CVEs
8
7
6
6
6
IDS Protocols
1
Detects outbound IPv4 and IPv6 connections from endpoints to public addresses on ports other than DNS (53), HTTP (80), HTTPS (443), 8000.
Command-and-control tools and tunnels often use uncommon ports to avoid web-focused filtering. Private, loopback, link-local, multicast and documentation ranges are excluded, and repeated connections are grouped by endpoint, process, remote IP and port. Custom apps and admin tools also use these ports, so triage by process, destination reputation and how rare the destination is.
Command-and-control tools and tunnels often use uncommon ports to avoid web-focused filtering. Private, loopback, link-local, multicast and documentation ranges are excluded, and repeated connections are grouped by endpoint, process, remote IP and port. Custom apps and admin tools also use these ports, so triage by process, destination reputation and how rare the destination is.
The following analytic detects PHP command-line interpreters executing code supplied directly on the command line with the CLI -r / --run options, or code supplied to PHPDBG through standard input.
It covers common CLI executable names on Linux and Windows, including php.exe, php-win.exe, the legacy php-cli.exe name, versioned Linux php binaries, phpdbg, and FrankenPHP's php-cli subcommand.
PHP-CGI and PHP-FPM are excluded because they do not support the PHP CLI inline -r option.
This behavior can be used legitimately for administration and automation, but unexpected or obfuscated inline PHP execution may indicate an attacker using an installed interpreter to run commands without dropping a script file.
It covers common CLI executable names on Linux and Windows, including php.exe, php-win.exe, the legacy php-cli.exe name, versioned Linux php binaries, phpdbg, and FrankenPHP's php-cli subcommand.
PHP-CGI and PHP-FPM are excluded because they do not support the PHP CLI inline -r option.
This behavior can be used legitimately for administration and automation, but unexpected or obfuscated inline PHP execution may indicate an attacker using an installed interpreter to run commands without dropping a script file.
Detects any file write event in a user's Downloads folder on Windows endpoints, covering every CrowdStrike Falcon Written event type.
Downloads is a common landing spot for payloads from phishing links and drive-by downloads. This is the broad version of the PE file rule and includes it, so it is very noisy and suits threat hunting or investigation pivots more than alerting. To triage, review the event type, file name, writing process, hash and company name.
Downloads is a common landing spot for payloads from phishing links and drive-by downloads. This is the broad version of the PE file rule and includes it, so it is very noisy and suits threat hunting or investigation pivots more than alerting. To triage, review the event type, file name, writing process, hash and company name.
The following analytic identifies the execution of suspicious processes typically associated with WebShell activity on web servers.
It detects when processes like `cmd.exe`, `powershell.exe`, or `bash.exe` are spawned by web server processes such as `w3wp.exe` or `nginx.exe`.
This behavior is significant as it may indicate an adversary exploiting a web application vulnerability to install a WebShell, providing persistent access and command execution capabilities.
If confirmed malicious, this activity could allow attackers to maintain control over the compromised server, execute arbitrary commands, and potentially escalate privileges or exfiltrate sensitive data.
It detects when processes like `cmd.exe`, `powershell.exe`, or `bash.exe` are spawned by web server processes such as `w3wp.exe` or `nginx.exe`.
This behavior is significant as it may indicate an adversary exploiting a web application vulnerability to install a WebShell, providing persistent access and command execution capabilities.
If confirmed malicious, this activity could allow attackers to maintain control over the compromised server, execute arbitrary commands, and potentially escalate privileges or exfiltrate sensitive data.
Detects Tor client execution on Windows endpoints, including the tor.exe binary and the Tor client bundled with Brave Browser (Private Window with Tor). Tor can hide command-and-control or exfiltration traffic, and some malware ships or drops a Tor client. To triage, check the parent process, image path, command line and SHA-256 hash, and confirm whether the user is authorized to use Tor.
Detects executable files saved to user-writable profile folders (Desktop, Downloads, Documents and similar) on Windows endpoints when the file has no company name in its PE version information. Commercial software almost always carries this field, while malware, masqueraded tools and quick custom builds often do not. Detection relies on file signature rather than extension. Portable utilities and internal tools also match, so triage by hash, writing process, file path and download source.
Use this query if you don't have the Falcon Spotlight in your CrowdStrike subscription. Use this to identify any PHP running in your environment. We used this to quickly identify hosts running PHP.
Detects Portable Executable (PE) files written to a user's Downloads folder on Windows endpoints. CrowdStrike identifies PE files by file signature, so renamed or extensionless executables are caught as well as .exe files. Downloads is a common landing spot for payloads from phishing links and drive-by downloads. Most hits are legitimate installers, so use the rule for hunting or as a pivot. To triage, review the file name, company name, hash, writing process and download source.
Detects DLL files written to user-writable profile folders (Desktop, Downloads, Documents and similar) on Windows endpoints. Attackers use these folders to stage a malicious DLL next to a legitimate executable, often from a phishing archive, so the executable loads it via DLL side-loading. Events are grouped by endpoint and path with DLL names, vendor, SHA-256 and the writing process. Installers and portable apps also match, so triage by hash, vendor, writing process and download source.
Detects Sysinternals executables written to disk on Windows endpoints, identified by the Sysinternals company name in the PE metadata of newly written EXE files. These are legitimate admin utilities, but attackers also copy them to hosts for discovery, process inspection and credential access. The rule shows tool presence only, not misuse, so it suits inventory and hunting. To triage, review the file path, hash, writing process and whether the user is an administrator.
Detects execution of virtualization and container software on Windows endpoints by image name, covering Hyper-V, VMware, VirtualBox, QEMU, Xen, Parallels, WSL, Docker and containerd. Attackers can run payloads inside a virtual machine or WSL instance to hide activity from host-based security tools. Developers and administrators use these tools routinely, so the rule suits inventory and hunting. To triage, check the user, parent process, command line and hash, and whether the host is expected to run virtual machines.
Detects execution of various PHP interpreter binaries and evaluates their version regarding the new (CVE-2026-109618 / CVE-2026-109619) if upgraded or fix is needed.
Detects attempts to download the cache_base file using various command-line utilities (wget, curl, node fetch) on a single device, correlating multiple download methods within a 10-minute window or matching known malicious mirror IOCs.
Detects post-exploitation activity targeting PaperCut servers, including shells spawned by the PaperCut Java process or the creation of malicious files (such as .class files in lib/ or .txt webshells in custom/web/) by the Java application.
Detects when the aws command line binary is used to create an address group with a 0.0.0.0 IP, which means any IP address. This action would expose services to the internet and is used by adversaries to allow access to compromised systems.
Detects the execution of Microsoft Quick Assist followed by a different remote access tool (RAT) or remote monitoring and management (RMM) utility on the same device within a 24-hour window, which may indicate adversary staging or persistence establishment.
Correlates per-device reads of .env secret files by utility commands (such as cat, grep, findstr) with subsequent or preceding Prisma Studio or database activity within a 30-minute window, indicating potential credential theft or unauthorized database management tool usage.
Detects DNS requests to major generative AI and Large Language Model API endpoints (such as OpenAI, Anthropic, Google Gemini, Mistral, Groq, DeepSeek, and others) initiated by processes other than standard web browsers (e.g., chrome, msedge, firefox, safari). This behavior may indicate unauthorized data exfiltration, shadow AI usage, or automated tooling/scripts interacting with LLM APIs.
Detects the execution of administrative commands and scripting interpreters spawned by the VMware Tools daemon (vmtoolsd), which may indicate an adversary leveraging ESXi guest operations for remote code execution.
Detects web or FTP server parent processes (such as apache2, httpd, nginx, php-fpm, or proftpd) spawning shell or utility processes (such as bash, sh, python, nc, curl, wget), which is consistent with webshell execution or post-exploitation activities.
Detects execution of Node.js and NPM related commands involving potential supply chain indicators, script execution, or download utilities (such as curl, wget, powershell, or eval) within command lines.
Page 1 of 100