Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,229 detections
Filters
Last updated
All Time
Detection languages
1,679
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,241
2,013
731
383
305
Platforms
2,603
874
438
69
42
Products / Services
935
630
365
185
162
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
3,229
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
The following analytic identifies the creation of executables or scripts in temporary file paths on Windows systems. It leverages the Endpoint.Filesystem data set to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in temporary directories (e.g., \windows\Temp\, \AppData\Local\Temp\).
This activity can be significant as adversaries often use these paths to evade detection and maintain persistence.
If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.
This activity can be significant as adversaries often use these paths to evade detection and maintain persistence.
If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Detects suspicious use of Node.js package managers running malicious lifecycle hooks, installing rogue dependencies, or invoking script execution during package installation.
Correlates an inbound connection to a Python/Xoscar/Xinference pool process with an outbound connection from a shell spawned by that same pool process shortly afterward, potentially indicating exploitation and reverse shell activity.
Detects host-side telemetry indicating Cairn agent worker artifacts, including specific process command line terms, tsec skill files and environment variables, combined with network connections to OpenRouter from the same host.
Detects suspicious exploitation activity against NetScaler ADC/Gateway appliances, including requests to CGI, VPN, or authentication endpoints with command execution, webshell, or encoded payload behavior associated with CVE-2026-88771.
Detects suspicious command execution activities using Azure RunCommand, Custom Script Extension, or Azure Connected Machine Agent combined with potentially malicious command arguments or tools such as PowerShell encoded commands, 'IEX', download strings, certutil, whoami, base64, curl, or wget.
Detects AI coding assistants and agents (such as Copilot, Cursor, Claude Code, etc.) spawning command-line interpreters (PowerShell, CMD, Node, Bun, Deno) with potential API keys, tokens, or credentials exposed in the process command line.
Detects when a web browser (such as Chrome, Edge, Firefox, Internet Explorer, Brave, or Opera) spawns common command interpreters, scripting engines, or Living off the Land Binaries (LOLBins) like cmd, powershell, mshta, rundll32, or certutil. This behavior is often indicative of a drive-by compromise or browser exploitation attempt.
Detects shell or interpreter processes spawned as children of the
PAN-OS management web service. Exploitation of CVE-2026-0322 (authenticated RCE,
CWE-94) in the management interface results in the web server process forking
unexpected /bin/sh, curl, wget or scripting interpreter children to run
post-exploitation commands on the management plane.
PAN-OS management web service. Exploitation of CVE-2026-0322 (authenticated RCE,
CWE-94) in the management interface results in the web server process forking
unexpected /bin/sh, curl, wget or scripting interpreter children to run
post-exploitation commands on the management plane.
Detects the creation of WordPress administrator accounts using MySQL or WP-CLI command-line tools on hosts, specifically looking for specific username prefixes or email domains associated with suspicious activities.
Detects when common office applications (Word, Excel, PowerPoint, Outlook, OneNote, etc.) or archive utilities/PDF readers spawn command-line interpreters or scripting engines (cmd.exe, powershell.exe, wscript.exe, etc.), which is a common indicator of phishing document execution or malicious archive extraction.
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Hunts for sqlservr.exe spawning command shells or system utilities, a pattern consistent with xp_cmdshell abuse. It also flags later steps from a public intrusion write-up: certutil decoding, SAM, SYSTEM or SECURITY hive saves and local account or group changes.
Results are grouped per device and day and ranked by stage count. Rows can also appear without a SQL parent when two later stages occur on the same device and day.
Triage: Some jobs use xp_cmdshell legitimately. Review the command line and the account. Hunting query, not an alert.
Limitations: Activity inside the SQL process with no child process is not visible. Renamed tools, obfuscation and privilege escalation tools are not covered. Needs Defender for Endpoint on the SQL servers.
Results are grouped per device and day and ranked by stage count. Rows can also appear without a SQL parent when two later stages occur on the same device and day.
Triage: Some jobs use xp_cmdshell legitimately. Review the command line and the account. Hunting query, not an alert.
Limitations: Activity inside the SQL process with no child process is not visible. Renamed tools, obfuscation and privilege escalation tools are not covered. Needs Defender for Endpoint on the SQL servers.
Detects commands executed on a Barracuda load balancer. Network appliances sit
outside most endpoint monitoring, so their own audit trail is frequently the only
record that anyone logged in and did something.
Onboarding: BARRACUDA-LOADBALANCER is ingested via Syslog (CEF) (Bloo extractor 859).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=auditd where sourcename='BARRACUDA-LOADBALANCER' and action='SESSION_ENDED'
| groupby user, process, commandline
outside most endpoint monitoring, so their own audit trail is frequently the only
record that anyone logged in and did something.
Onboarding: BARRACUDA-LOADBALANCER is ingested via Syslog (CEF) (Bloo extractor 859).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=auditd where sourcename='BARRACUDA-LOADBALANCER' and action='SESSION_ENDED'
| groupby user, process, commandline
Detects a Slack workflow being published. Workflows run automation inside the
workspace — they can post, collect responses, and reach external endpoints via
webhooks — which makes a malicious one a credential-harvesting form or an
exfiltration channel that looks like an internal tool.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=slack-workflow where sourcename='SLACK' and action='PUBLISHED'
| groupby user, workflow
workspace — they can post, collect responses, and reach external endpoints via
webhooks — which makes a malicious one a credential-harvesting form or an
exfiltration channel that looks like an internal tool.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=slack-workflow where sourcename='SLACK' and action='PUBLISHED'
| groupby user, workflow
Detects a privileged command executed through Centrify on Windows. Brokered
elevation records the command under the identity that requested it rather than the
shared administrative account it ran as, which restores attribution that local
Windows auditing frequently loses.
Onboarding: CENTRIFY-AUDITTRAIL-WINDOWS is ingested via Syslog (KV) (Bloo extractor 821).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-WINDOWS'
and action='USER_COMMAND_EXECUTED'
| groupby user, targetuser, role, domain
elevation records the command under the identity that requested it rather than the
shared administrative account it ran as, which restores attribution that local
Windows auditing frequently loses.
Onboarding: CENTRIFY-AUDITTRAIL-WINDOWS is ingested via Syslog (KV) (Bloo extractor 821).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-WINDOWS'
and action='USER_COMMAND_EXECUTED'
| groupby user, targetuser, role, domain
Detects the creation or modification of web script files (.aspx, .jsp) within common web application directories by unusual processes (such as command shells or download utilities) or by non-standard user accounts, indicating potential web shell deployment.
Detects the creation of cook.pth or cook.py in Python site-packages or dist-packages directories by package managers or interpreters, followed by a Python interpreter execution on the same device within one hour. This pattern matches the malicious supply chain behavior observed in compromised LiteLLM versions (e.g., 1.107.0) utilizing .pth auto-import chains for persistence and execution.
Detects suspicious use of Node.js package managers running malicious lifecycle hooks, installing rogue dependencies, or invoking script execution during package installation.
Page 3 of 154