Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
1
1
Platforms
1
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
Linux Interpreter with Command Execution
Cortex XDR
Detects the execution of PHP, Perl, or Ruby script interpreters on Linux systems when they are invoked with command-line arguments that suggest direct execution of code, especially when combined with commands or functions commonly used for remote code execution or data exfiltration. This rule aims to identify potential web shell activity or other forms of arbitrary command execution.
