Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,427 detections
Filters
Last updated
All Time
Detection languages
8,114
7,121
1,351
1,156
1,060
Contributors
4,878
2,724
2,695
2,646
2,346
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
18,046
3,015
1,489
123
104
Products / Services
5,718
4,275
3,709
1,168
958
MITRE Techniques
9,458
7,567
3,444
2,845
2,689
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects execution of Node.js and NPM related commands involving potential supply chain indicators, script execution, or download utilities (such as curl, wget, powershell, or eval) within command lines.
Detects a sequence of events on a Linux device where a sudo command execution is followed within 15 minutes by a Perl process executing base64 decoding commands within the same SSH session.
Detects shadow copy destruction and recovery feature tampering used
by Akira and other ransomware families to prevent victims from restoring data.
Covers vssadmin / wmic shadowcopy deletion, wbadmin catalog deletion and
bcdedit recovery-disabling commands executed from the command line.
by Akira and other ransomware families to prevent victims from restoring data.
Covers vssadmin / wmic shadowcopy deletion, wbadmin catalog deletion and
bcdedit recovery-disabling commands executed from the command line.
Detects an AhsayCBS / Tomcat / Java web service process spawning a
command or script interpreter. After exploiting AhsayCBS, attackers executed
shell commands through the dropped webshell to run reconnaissance and download
the XMRig payload. A backup web service should never directly spawn cmd.exe,
powershell.exe, or a Unix shell - this indicates webshell command execution.
command or script interpreter. After exploiting AhsayCBS, attackers executed
shell commands through the dropped webshell to run reconnaissance and download
the XMRig payload. A backup web service should never directly spawn cmd.exe,
powershell.exe, or a Unix shell - this indicates webshell command execution.
Detects AI coding assistants and agents (such as Copilot, Cursor, Claude Code, etc.) spawning command-line interpreters (PowerShell, CMD, Node, Bun, Deno) with potential API keys, tokens, or credentials exposed in the process command line.
Detects when a web browser (such as Chrome, Edge, Firefox, Internet Explorer, Brave, or Opera) spawns common command interpreters, scripting engines, or Living off the Land Binaries (LOLBins) like cmd, powershell, mshta, rundll32, or certutil. This behavior is often indicative of a drive-by compromise or browser exploitation attempt.
The following analytic identifies the execution of commonly used NirSoft utilities on Windows systems.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution details such as process name, parent process, and command-line arguments.
This activity is significant for a SOC because NirSoft utilities, while legitimate, can be used by adversaries for malicious purposes like credential theft or system reconnaissance.
If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further system compromise.
Note that this search does not use a where clause to filter out known benign paths, as NirSoft utilities can be executed from various locations. This might hinder performance in environments with high data volumes.
Apply additional filtering as necessary to enhance this.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution details such as process name, parent process, and command-line arguments.
This activity is significant for a SOC because NirSoft utilities, while legitimate, can be used by adversaries for malicious purposes like credential theft or system reconnaissance.
If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further system compromise.
Note that this search does not use a where clause to filter out known benign paths, as NirSoft utilities can be executed from various locations. This might hinder performance in environments with high data volumes.
Apply additional filtering as necessary to enhance this.
Detects service-initiated processes using cryptocurrency mining algorithms, pool configurations, or miner-specific execution parameters.
This detection flags a parent and child process pair on internet-facing Windows servers, where the parent is a web server process and the child is the process it launched. The web server processes covered are w3wp, httpd, nginx and Tomcat, including versioned Tomcat service executables such as tomcat9.exe and Tomcat running under java.exe, which is identified by the Catalina bootstrap class in its command line. A server is treated as internet-facing based on the most recent status recorded for it.
Instead of matching known web shell names, the query builds a baseline from the previous 30 days of process activity on each device and alerts when a pair appears in the latest window that has never been seen on that device before, so it can catch web shell activity it has never seen before. Because the baseline is held per device, a pair that is normal on one server does not hide the same pair appearing on another.
The rule runs every 24 hours, as this is the only Defender custom detection frequency with a 30-day lookback, and the alert window covers the last 25 hours so that a slightly delayed run does not leave a gap.
The baseline and alert windows are separated by ingestion time rather than event time, so events that arrive late are still evaluated.
Instead of matching known web shell names, the query builds a baseline from the previous 30 days of process activity on each device and alerts when a pair appears in the latest window that has never been seen on that device before, so it can catch web shell activity it has never seen before. Because the baseline is held per device, a pair that is normal on one server does not hide the same pair appearing on another.
The rule runs every 24 hours, as this is the only Defender custom detection frequency with a 30-day lookback, and the alert window covers the last 25 hours so that a slightly delayed run does not leave a gap.
The baseline and alert windows are separated by ingestion time rather than event time, so events that arrive late are still evaluated.
Detects script execution (such as wscript, cscript, mshta) spawned from a shell parent process (like explorer.exe or cmd.exe) referencing browser cache files (matching f_* in browser profile directories) or copying scripts to the local Temp directory as t.vbs.
Detects potential defense evasion activity where Windows Defender configurations are modified or disabled, followed closely within 20 minutes by a silent, quiet, or unattended software uninstallation initiated by a script interpreter or command processor on the same device.
Detects Tailscale serve commands setting up a TCP forward to a Unix socket (such as tailscaled.sock), correlated with recent file creation, modification, or renaming events involving the socket file by a non-standard process within a 1-hour window.
Detects the execution of Wireshark or tshark with command-line arguments indicating TLS key logging or packet capture file handling, followed shortly by a crash handler process (WerFault.exe or WerFaultSecure.exe) for the same process.
Detects the execution of tools and commands commonly used to enumerate Group Policy Objects (GPOs) within an environment, such as gpresult.exe with specific flags, PowerShell scripts querying GPO modules, or ldifde.exe checking group policy containers.
Detects instances where inst.exe running from C:\ProgramData\Intel with specific command-line arguments (extensionless and key-like) subsequently writes files to the EFI system partition or boot paths on the same device.
Detects web server processes (such as nginx, apache2, httpd, uwsgi, gunicorn, php-fpm) spawning command-line utilities typically used for system and user discovery (such as id, whoami, groups, hostname, uname, netstat, ps, etc.), which often indicates web application exploitation and remote code execution.
Detects a sequence where a FortiSIEM-related process writes or modifies a shell script in a cron or phoenix directory, followed closely within 2 minutes by a child process spawned by cron executing that same written script file.
Detects web servers (httpd, apache2, nginx, php-fpm) or Request Tracker (RT) Perl worker processes spawning suspicious child processes such as shells, downloaders, netcat, or Python interpreters, indicative of post-exploitation or web application compromise.
Detects Python interpreter activity accessing multiple credential store categories (such as password managers, Discord, SSH keys, or Steam) in a short window on a single device, or specific stealer scripts associated with known file paths.
Detects potential Linux privilege escalation and persistence activities by monitoring for the creation of persistence scripts in post_boot.d, modifications to the sudoers.template file appending NOPASSWD, or system configuration rebuilds shortly after sudoers template changes.
Detects shell or interpreter processes spawned as children of the
PAN-OS management web service. Exploitation of CVE-2026-0322 (authenticated RCE,
CWE-94) in the management interface results in the web server process forking
unexpected /bin/sh, curl, wget or scripting interpreter children to run
post-exploitation commands on the management plane.
PAN-OS management web service. Exploitation of CVE-2026-0322 (authenticated RCE,
CWE-94) in the management interface results in the web server process forking
unexpected /bin/sh, curl, wget or scripting interpreter children to run
post-exploitation commands on the management plane.
Page 8 of 973