Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,229 detections
Filters
Last updated
All Time
Detection languages
1,679
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,241
2,013
731
383
305
Platforms
2,603
874
438
69
42
Products / Services
935
630
365
185
162
MITRE Techniques
18,115
15,635
12,582
8,393
6,221
3,229
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
The following analytic detects PHP command-line interpreters executing code supplied directly on the command line with the CLI -r / --run options, or code supplied to PHPDBG through standard input.
It covers common CLI executable names on Linux and Windows, including php.exe, php-win.exe, the legacy php-cli.exe name, versioned Linux php binaries, phpdbg, and FrankenPHP's php-cli subcommand.
PHP-CGI and PHP-FPM are excluded because they do not support the PHP CLI inline -r option.
This behavior can be used legitimately for administration and automation, but unexpected or obfuscated inline PHP execution may indicate an attacker using an installed interpreter to run commands without dropping a script file.
It covers common CLI executable names on Linux and Windows, including php.exe, php-win.exe, the legacy php-cli.exe name, versioned Linux php binaries, phpdbg, and FrankenPHP's php-cli subcommand.
PHP-CGI and PHP-FPM are excluded because they do not support the PHP CLI inline -r option.
This behavior can be used legitimately for administration and automation, but unexpected or obfuscated inline PHP execution may indicate an attacker using an installed interpreter to run commands without dropping a script file.
Detects Node.js processes spawning shells, script hosts or download tools, which is how post exploitation of a Node.js server would look after CVE-2026-111497 (Brotli decoder out of bounds write, fixed in 22.23.4, 24.22.1 and 26.12.1). Devices that Defender Vulnerability Management lists as vulnerable are flagged and sorted first, and rows are still returned when the CVE is not listed. It excludes npm, npx, yarn and pnpm processes and GitHub Actions runner action processes, which start shells for build scripts. It does not detect the memory corruption itself. The query ran without errors in a live tenant.
Detects potential remote code execution, web shell activity, and post-exploitation behaviors originating from PHP worker processes on internet-facing hosts, referencing patterns associated with php2shell vulnerabilities. PHP-UP-2026
Detects potential web server remote code execution through suspicious child processes launched by PHP, FastCGI, Apache, and IIS workers. Identifies reverse shells, encoded commands, payload retrieval, reconnaissance, and temporary PHP execution.
Detects post-exploitation behavior where a Node.js process spawns a shell, interpreter, or utility (such as sh, bash, nc, curl, python), which may indicate Remote Code Execution (RCE) via vulnerabilities like CVE-2026-111497 in the Node.js Brotli decoder.
Detects behavior where a Node.js process spawns a command shell or interpreter (such as sh, bash, cmd.exe, or powershell.exe) executing suspicious commands indicative of remote code execution (RCE), reverse shells, or payload downloading, consistent with vulnerabilities like the Node.js decompression flaw CVE-2026-111497.
Identifies Node.js processes that spawn potentially suspicious child processes, including operating system shells, command interpreters, scripting runtimes, and download utilities. This behaviour may indicate exploitation of a Node.js application resulting in arbitrary command execution, followed by payload retrieval or additional post-exploitation activity.
Detects the Tensorlake npm compromise (tensorlake@0.5.144, Shai-Hulud) through the two payload hashes, gh-token-monitor persistence, node or bun running lib/setup.mjs or Math_Symbol.js and node or bun connections to iseekaigogo.com or public Ethereum RPC hosts. It needs Defender for Endpoint events from developer machines and does not see lockfile or package cache contents. The query ran without errors in a live tenant
Detects suspicious post-exploitation activities, reconnaissance, and command execution originating from web server and PHP lineage processes, indicating potential webshell activity or compromised web applications.
Detects instances where Microsoft Teams (ms-teams.exe, Teams.exe) or its associated WebView2 process spawns a command or script interpreter (such as PowerShell, Cmd, Mshta, Wscript, Cscript) with suspicious download-and-execute arguments, which is commonly associated with ClickFix social engineering attacks or similar initial access tactics.
Detects suspicious post-exploitation activities, reconnaissance, and command execution originating from web server and PHP lineage processes, indicating potential webshell activity or compromised web applications.
Detects post-exploitation activity targeting PaperCut servers, including shells spawned by the PaperCut Java process or the creation of malicious files (such as .class files in lib/ or .txt webshells in custom/web/) by the Java application.
Detects node or agent-initiated npm installation commands (such as npm install or npm i) executed within 24 hours of creating or modifying a developer assistant instruction file (such as AGENTS.md, CLAUDE.md, .cursorrules) in common user directories like Downloads, Desktop, or Temp.
Detects instances where web server processes or PHP interpreters (apache2, httpd, php-fpm, php) spawn a shell process (sh, bash, dash). This behavior is often indicative of post-exploitation activity such as remote code execution (RCE) via PHP session upload progress or web shell activity.
Detects PaperCut server processes (such as pc-app.exe, pc-server.exe, or Java running PaperCut) spawning command shells or utility binaries associated with credential dumping, internal reconnaissance, or pivoting.
Detects suspicious post-exploitation activities, reconnaissance, and command execution originating from web server and PHP lineage processes, indicating potential webshell activity or compromised web applications.
Detects when a Java or JavaW process spawns a Unix shell (bash, sh, dash) with command-line arguments indicative of a reverse shell utilizing /dev/tcp and interactive shell flags.
Detects instances where the Claude Code AI assistant CLI or related node processes spawn command-line shells (such as cmd, powershell, bash, sh, zsh), followed by system firewall rule modifications on the same device within a 4-hour window.
Detects web server processes (such as apache2, httpd, nginx, php-fpm) spawning a shell or curl process that performs LDAP queries using curl against URLs. This activity is indicative of Remote Code Execution (RCE) vulnerabilities being exploited against web applications to perform internal reconnaissance or LDAP enumeration.
Detects node.exe or npm spawning command shells or Living-off-the-Land Binaries (LOLBins) as part of npm preinstall or postinstall lifecycle scripts.
Detects the deployment of the ARTEX AI penetration testing framework via Docker/Docker-compose combined with the execution of offensive security and scanning tools (such as nmap, sqlmap, nuclei, httpx, apktool, frida) on the same host within a specified timeframe.
Page 1 of 154