Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,230 detections
Filters
Last updated
All Time
Detection languages
1,680
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,242
2,014
731
383
305
Platforms
2,604
874
438
69
42
Products / Services
935
630
365
185
162
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,230
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
This detection identifies suspicious child process execution spawned from Notepad++ (notepad++.exe), which may indicate exploitation attempts related to CVE-2026-48778 and CVE-2026-48800. These vulnerabilities involve potential arbitrary code execution through malicious manipulation of Notepad++ configuration (config.xml) and shortcut (shortcuts.xml) files.
The rule detects abnormal execution of system binaries such as PowerShell, CMD, MSHTA, Rundll32, and Regsvr32 launched from Notepad++, which is not expected in normal user activity. Such behavior may indicate successful exploitation, plugin abuse, or post-exploitation execution triggered via malicious configuration or user interaction.
This detection is intended for identifying early indicators of code execution chains originating from Notepad++.
The rule detects abnormal execution of system binaries such as PowerShell, CMD, MSHTA, Rundll32, and Regsvr32 launched from Notepad++, which is not expected in normal user activity. Such behavior may indicate successful exploitation, plugin abuse, or post-exploitation execution triggered via malicious configuration or user interaction.
This detection is intended for identifying early indicators of code execution chains originating from Notepad++.
Identifies processes launched with the __DAEMONIZED=1 environment variable. This specific marker is used by the vpmdhaj malicious npm packages to spawn their stage-2 credential harvesting payload as a detached process, allowing it to survive parent termination.
KQL Query
Detects the export of Microsoft Teams messages, transcripts, recordings, and chat retrieval activities, particularly when performed via the Graph API. This rule identifies suspicious activity by looking for specific operation names in SaaS audit logs from Microsoft Teams and flags user agents commonly associated with automation tools (e.g., python-requests, axios, go-http, curl, wget, powershell, httpx, aiohttp, node) which could indicate post-compromise attackers using stolen tokens to silently export chat history.
This rule detects the download of JavaScript (.js) or HTML Application (.hta) files followed by the execution of scripting interpreters like mshta, cscript, wscript, node, or powershell with encoded commands on the same device within a one-hour window. It assigns a score based on the count of downloaded files and executed scripts, triggering an alert if the combined score exceeds 2. This behavior is indicative of potential malicious script execution, often seen in initial access or execution phases of an attack.
Sublime Threat Intelligence and Research (STIR) identified a phishing campaign using a recently published open-source Javascript virtual machine and obfuscation tool called KrakVM. The initial KrakVM-encoded HTML file arrives as an attachment in phishing emails. These emails are short, often not even including a body, with subjects and HTML attachment filenames suggesting the target has a new voicemail, a vendor credit, or unpaid invoices
Suspicious Azure VM Extension Deployment
Cortex XDR
This rule detects the deployment of suspicious or potentially malicious extensions on Azure Virtual Machines. These extensions, such as CustomScriptExtension, RunCommandHandler, DSCExtension, AADLoginForWindows, and NetworkWatcherAgent, can be abused by adversaries for various purposes including remote code execution, account manipulation, and network reconnaissance. Monitoring their deployment can help identify unauthorized activity within an Azure environment.
Monitors for Windows cmd.exe executions leveraging '//c' to run hidden batch files. This matches the Metasploit module's evasion technique for bypassing MSYS2 mangling on Windows Gogs installations during the argument injection exploit.
Azure VM RunCommand Activity
Cortex XDR
This rule detects activity related to Azure VM RunCommand, which allows execution of scripts on virtual machines without requiring RDP/SSH access. It specifically looks for 'WRITE', 'ACTION', 'DELETE', and 'READ' operations, filtering for successful or accepted statuses and valid identities. This activity can indicate an attacker executing commands or performing post-execution cleanup.
Detects network connections from Node.js or Bun runtime processes to common cloud instance metadata service IPs (AWS, Azure, GCP) or to the default HashiCorp Vault port (8200). This activity can indicate credential access attempts, especially in the context of a supply chain attack where malicious code might be injected into a Node.js/Bun application to exfiltrate sensitive information or gain further access. The rule correlates network connection events with process execution events to identify the specific runtime responsible.
One KQL to catch them all ... DirtyFrag or CopyFail (Fileless or ElfBinary execution)
Linux Interpreter with Command Execution
Cortex XDR
Detects the execution of PHP, Perl, or Ruby script interpreters on Linux systems when they are invoked with command-line arguments that suggest direct execution of code, especially when combined with commands or functions commonly used for remote code execution or data exfiltration. This rule aims to identify potential web shell activity or other forms of arbitrary command execution.
Detects behavioral characteristics of the Needle Rust desktop agent: an unsigned Rust PE in the 5-50MB range, executing from user-writable paths, and establishing the Run-key persistence the agent installs at HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. The Rust panic-handler source paths (src/views/zelcore/app.rs, src/views/trezor/seed_panel.rs, src/views/ledger/screens/seed_recovery.rs) are also surfaced via the binary's data section and are extremely high-fidelity if visible in any command-line or memory-scan telemetry. This rule pairs the persistence registration with the agent execution context.
Detects suspicious command execution originating from cPanel daemons. This rule identifies instances where cPanel processes (cpsrvd, cpsrvd-ssl, cpaneld, whostmgrd) or their immediate children execute common shell interpreters or specific commands indicative of potential compromise, such as writing to /etc/passwd, modifying authorized_keys, or using base64/perl/python/bash for interactive shells.
This rule detects suspicious command-line patterns indicative of obfuscation, encoding, or stealth techniques often used by adversaries. It scores various characteristics such as hidden window styles, variable manipulation, string operations, and decoding functions (e.g., Base64, Gzip, Deflate). The rule filters out known legitimate processes and command-line boilerplate to reduce false positives and classifies detections based on the highest scoring obfuscation category.
Identifies the first time a specific local Model Context Protocol (MCP) server configuration is executed on a device within the last 24 hours. This rule uses a 7-day historical baseline to filter out previously seen regular activity. It groups rapid-fire child processes spawned by varying MCP initiator arguments (e.g., claude.exe --strict-mcp-config vs --squirrel-firstrun) into a single, consolidated 5-minute session alert.
Detects the creation of DaemonSets in a Kubernetes cluster using the `kubectl` command-line tool. DaemonSets are designed to run a copy of a Pod on all (or some) nodes in the cluster, making them a powerful mechanism for persistence and cluster-wide credential harvesting by attackers. This rule specifically looks for `kubectl` commands that include 'daemonset' and either 'create' or 'apply' operations.
Identifies the first time a specific local Model Context Protocol (MCP) server configuration is executed on a device within the last 24 hours. This rule uses a 7-day historical baseline to filter out previously seen regular activity. It groups rapid-fire child processes spawned by varying MCP initiator arguments (e.g., claude.exe --strict-mcp-config vs --squirrel-firstrun) into a single, consolidated 5-minute session alert.
This rule detects the execution of commands that include 'splice' in conjunction with common privilege escalation utilities such as 'su', 'sudo', or 'passwd', or attempts to access '/etc/passwd'. This privilege escalation resembles Copy Fail.
Detects the execution of the 'gh auth token' command. This behavior was observed being used by the TeamPCP malicious npm package (hijacked @bitwarden/cli) via a shell collector script to harvest active GitHub CLI authentication tokens from developer endpoints.
High-confidence detection for probable Copy Fail exploitation requiring AF_ALG or algif_aead references, syscall-style splice usage, and privileged binary targeting. https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/main/copy_fail_exp.py https://xint.io/blog/copy-fail-linux-distributions#how-we-found-it-9
Page 112 of 154