Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11,829 detections
Filters
Last updated
All Time
Detection languages
5,623
1,822
1,261
860
752
Contributors
3,246
2,040
1,233
910
828
Categories
20,439
11,829
5,873
5,151
4,864
Platforms
9,730
2,538
1,168
276
100
Products / Services
3,075
2,976
2,352
1,065
955
MITRE Techniques
6,773
3,899
2,668
2,013
1,825
CVEs
21
19
18
14
14
IDS Classtypes
75
31
26
19
19
IDS Protocols
102
68
10
5
3
Detects attempts to disable or tamper with Windows Defender settings, services, or registry keys via command-line execution (such as reg.exe, PowerShell, or sc.exe) or direct registry modifications.
Detects post-exploitation behavior where a PaperCut server Java process spawns local account creation or administrator reset followed closely by Active Directory enumeration on the same host, indicating potential post-RCE meterpreter activity.
Detects PowerShell execution spawning 7zr.exe to extract password-protected 7z archives using overwrite and password switches within a specified timeframe, or referencing specific malicious IOC file names and domains.
Detects a sequence where PowerShell downloads an .msi installer file from Azure Blob Storage, followed closely by msiexec.exe spawning a PowerShell process on the same device.
Detects anomalous activities associated with potential PHP2Shell exploitation or webshell deployment where a web server worker (such as Apache, HTTPD, or PHP) spawns a Unix shell containing suspicious utility tokens, drops a PHP file outside excluded directories, or creates a PHP session-derived file.
Detects the correlation of two or more distinct discovery tools or artifacts (such as SharpShares, NetScan, NetExec, ShareFinder, and specific nltest.exe domain trust commands) executed on the same device within a one-hour window.
Detects outbound network connections from Python processes associated with known indicators of compromise or specific suspicious command line arguments such as cook.py, cook.pth, or privcollect.
Detects observable consequences of remote code execution on a GitLab server (CVE-2026-97229), specifically where GitLab application services (such as Puma, Sidekiq, Ruby, GitLab Rails, or GitLab Workhorse) spawn a shell or interpreter with suspicious command-line parameters or external network utilities.
Detects execution of a Python script named SysMon.py via a scheduled task, correlated with a subsequent network connection to ipinfo.io initiated by the same Python interpreter within a 10-minute window.
Detects the addition of Microsoft Defender exclusions targeting the C:\Windows directory or SystemHealth\Update paths via PowerShell commands (Add-MpPreference/Set-MpPreference) or direct Registry modifications, which may indicate an attempt to evade security detection.
Detects the execution of the AI prompt hook script 'project_context_hook.py' or the creation/modification of the associated investigation state files (scope.md, surface.md, notes.md) within the same folder.
Detects PowerShell registering a logon scheduled task that executes a Trays.exe binary from an AppData Yandex Trays path with the -tray argument, or a scheduled task specifically named 'Microsoft apdate'. Associated with the RareWolf AnyDesk dropper batch script.
Detects suspicious Ghostscript execution patterns where Python spawns Ghostscript with dangerous I/O pipe arguments or disabled SAFER mode, or where Ghostscript spawns shell interpreters.
Detects when a shell process (such as sh, bash, dash, cmd.exe, or powershell.exe) is spawned by a metrics, logging, or authentication management service shortly after the service accepts an inbound network connection, potentially approximating exploitation of an internal management service.
Detects script-driven (curl, wget, python) outbound connections to
AI/LLM API endpoints. The campaign uses legitimate AI platform APIs as covert
command, control, and exfiltration channels, blending malicious traffic with
approved web services to evade network-based detection.
AI/LLM API endpoints. The campaign uses legitimate AI platform APIs as covert
command, control, and exfiltration channels, blending malicious traffic with
approved web services to evade network-based detection.
Detects the Tensorlake npm 0.5.144 compromise (Shai-Hulud worm via preinstall). Includes a baseline query to identify the affected package/version across Defender inventory, file, network, device and process events, plus preinstall download/obfuscated-exec behaviour. Results are summarized per device/account.
Detects the execution of PaperCut reverse SOCKS5 bridge kit operator-side scripts (such as admin_bridge.py, live_reverse_socks5.py, start_socks.sh) or the creation of related Java bridge class artifacts.
Detects malicious behaviors involving the Chisel tunneling tool, including reverse SOCKS proxy connections with TLS verification skipped, cron-based persistence referencing watchdog scripts in hidden /var/tmp directories, and associated tool staging activities.
MSI-backed loader execution chain
Cortex XDR
This query uses the process ID of each child to match the parent process's PID, then reconstructs the chain back to explorer.exe. It also checks for the encoded PowerShell, silent MSI installation, and embedded MSI execution behaviours described in the source article.
Important caveats
- Causality scope: This finds matching process events within a shared causality ID; it does not establish that each process directly launched the next.
- Explorer root: The root process may not share the same causality ID in every telemetry scenario. If this join removes otherwise valid results, investigate the root separately.
- Strict matching: Requiring every stage will miss partial chains and variants with different command-line arguments. Consider separate alerts for the encoded PowerShell and silent MSI behaviours.
- Validation: Confirm the field names, join syntax, and causality-ID population against your tenant before deploying this as a production detection.
Important caveats
- Causality scope: This finds matching process events within a shared causality ID; it does not establish that each process directly launched the next.
- Explorer root: The root process may not share the same causality ID in every telemetry scenario. If this join removes otherwise valid results, investigate the root separately.
- Strict matching: Requiring every stage will miss partial chains and variants with different command-line arguments. Consider separate alerts for the encoded PowerShell and silent MSI behaviours.
- Validation: Confirm the field names, join syntax, and causality-ID population against your tenant before deploying this as a production detection.
Detects network connections, process command-line executions, and email URL info matching known APT28 (Swallowtail, HOOKEDGE, LegionRelay) indicators of compromise, including specific IP addresses and GUIDs.
Detects suspicious post-exploitation activities, reconnaissance, and command execution originating from web server and PHP lineage processes, indicating potential webshell activity or compromised web applications.
Page 4 of 564