Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,439
11,829
5,873
5,151
4,864
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects the execution of the ROMULUS staging script via PowerShell script block logging (Event ID 4104). The rule identifies specific indicators including the use of environment variable '__ST', '$MyInvocation.MyCommand.Path', dynamic code reconstruction via '[scriptblock]::Create', and a high comma count exceeding 200.
Detects the correlation of two or more distinct discovery tools or artifacts (such as SharpShares, NetScan, NetExec, ShareFinder, and specific nltest.exe domain trust commands) executed on the same device within a one-hour window.
Detects outbound network connections from Python processes associated with known indicators of compromise or specific suspicious command line arguments such as cook.py, cook.pth, or privcollect.
Detects execution of a Python script named SysMon.py via a scheduled task, correlated with a subsequent network connection to ipinfo.io initiated by the same Python interpreter within a 10-minute window.
Detects the execution of the AI prompt hook script 'project_context_hook.py' or the creation/modification of the associated investigation state files (scope.md, surface.md, notes.md) within the same folder.
Detects suspicious Ghostscript execution patterns where Python spawns Ghostscript with dangerous I/O pipe arguments or disabled SAFER mode, or where Ghostscript spawns shell interpreters.
Detects when a shell process (such as sh, bash, dash, cmd.exe, or powershell.exe) is spawned by a metrics, logging, or authentication management service shortly after the service accepts an inbound network connection, potentially approximating exploitation of an internal management service.
Detects script-driven (curl, wget, python) outbound connections to
AI/LLM API endpoints. The campaign uses legitimate AI platform APIs as covert
command, control, and exfiltration channels, blending malicious traffic with
approved web services to evade network-based detection.
AI/LLM API endpoints. The campaign uses legitimate AI platform APIs as covert
command, control, and exfiltration channels, blending malicious traffic with
approved web services to evade network-based detection.
Detects the Tensorlake npm 0.5.144 compromise (Shai-Hulud worm via preinstall). Includes a baseline query to identify the affected package/version across Defender inventory, file, network, device and process events, plus preinstall download/obfuscated-exec behaviour. Results are summarized per device/account.
Detects the execution of PaperCut reverse SOCKS5 bridge kit operator-side scripts (such as admin_bridge.py, live_reverse_socks5.py, start_socks.sh) or the creation of related Java bridge class artifacts.
MSI-backed loader execution chain
Cortex XDR
This query uses the process ID of each child to match the parent process's PID, then reconstructs the chain back to explorer.exe. It also checks for the encoded PowerShell, silent MSI installation, and embedded MSI execution behaviours described in the source article.
Important caveats
- Causality scope: This finds matching process events within a shared causality ID; it does not establish that each process directly launched the next.
- Explorer root: The root process may not share the same causality ID in every telemetry scenario. If this join removes otherwise valid results, investigate the root separately.
- Strict matching: Requiring every stage will miss partial chains and variants with different command-line arguments. Consider separate alerts for the encoded PowerShell and silent MSI behaviours.
- Validation: Confirm the field names, join syntax, and causality-ID population against your tenant before deploying this as a production detection.
Important caveats
- Causality scope: This finds matching process events within a shared causality ID; it does not establish that each process directly launched the next.
- Explorer root: The root process may not share the same causality ID in every telemetry scenario. If this join removes otherwise valid results, investigate the root separately.
- Strict matching: Requiring every stage will miss partial chains and variants with different command-line arguments. Consider separate alerts for the encoded PowerShell and silent MSI behaviours.
- Validation: Confirm the field names, join syntax, and causality-ID population against your tenant before deploying this as a production detection.
Detects browser cache smuggling (ClickFix/FileFix delivery mechanisms) where a non-browser script interpreter or LOLBin accesses a browser HTTP-cache directory and writes an executable or script payload outside the cache, followed shortly by the execution of a payload from a user staging directory.
Detects web server processes (apache2, httpd) spawning a Unix shell (sh, dash, bash) which subsequently executes curl, wget, or php to perform an external HTTP fetch or download. This behavior is commonly associated with PHP or web application post-exploitation callbacks (webshells).
Detects GitLab backend processes (such as puma, sidekiq, rails, ruby, bundle) spawning shells, scripting interpreters, or network tools with suspicious command-line parameters, potentially indicating post-exploitation activity or vulnerability exploitation.
Detects the execution of the public Horizon3.ai PoC exploit for CVE-2026-106173 (FortiSIEM gRPC path traversal RCE) utilizing python interpreters with specific command-line arguments indicative of the exploit tool.
Detects the creation of AI coding assistant configuration files (such as .cursorrules, CLAUDE.md) in user directories (Downloads, Desktop, Temp) by non-git processes, followed within a short time window by execution of interpreters or tools (like node, npm, powershell, cmd, curl) with suspicious command line parameters indicating possible download or script execution.
Detects a burst of newly created Python or Shell scripts on a host running the Zammad ticketing system, which can indicate post-exploitation activity or automated staging.
Detects web server processes (Apache httpd, apache2, php-cgi, php-fpm) spawning a Unix shell (sh, bash, dash) that executes a wget or curl command piped directly into the shell for execution, indicative of potential remote code execution or web shell activity.
Detects script execution (such as wscript, cscript, mshta) spawned from a shell parent process (like explorer.exe or cmd.exe) referencing browser cache files (matching f_* in browser profile directories) or copying scripts to the local Temp directory as t.vbs.
Detects the execution of administrative commands and scripting interpreters spawned by the VMware Tools daemon (vmtoolsd), which may indicate an adversary leveraging ESXi guest operations for remote code execution.
Detects the creation of cook.pth or cook.py in Python site-packages or dist-packages directories by package managers or interpreters, followed by a Python interpreter execution on the same device within one hour. This pattern matches the malicious supply chain behavior observed in compromised LiteLLM versions (e.g., 1.107.0) utilizing .pth auto-import chains for persistence and execution.
Page 2 of 191