Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
519 detections
Filters
Last updated
All Time
Detection languages
271
88
34
34
26
Contributors
144
82
54
25
22
Categories
347
256
244
69
63
Platforms
401
213
110
16
9
Products / Services
148
112
100
30
30
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
14
4
3
3
3
IDS Classtypes
7
2
1
1
IDS Protocols
11
KQL detects suspicious child processes launched by PHP or web-server workers following possible exploitation of CVE-2026-109618 or CVE-2026-109619.
Detects web server worker processes or PHP interpreters spawning suspicious child processes associated with reverse shells, network sockets, or reconnaissance commands.
Detects the creation of cook.pth or cook.py in Python site-packages or dist-packages directories by package managers or interpreters, followed by a Python interpreter execution on the same device within one hour. This pattern matches the malicious supply chain behavior observed in compromised LiteLLM versions (e.g., 1.107.0) utilizing .pth auto-import chains for persistence and execution.
Detects outbound network connections from Python processes associated with known indicators of compromise or specific suspicious command line arguments such as cook.py, cook.pth, or privcollect.
Detects observable consequences of remote code execution on a GitLab server (CVE-2026-97229), specifically where GitLab application services (such as Puma, Sidekiq, Ruby, GitLab Rails, or GitLab Workhorse) spawn a shell or interpreter with suspicious command-line parameters or external network utilities.
Detects execution of a Python script named SysMon.py via a scheduled task, correlated with a subsequent network connection to ipinfo.io initiated by the same Python interpreter within a 10-minute window.
Detects the execution of PaperCut reverse SOCKS5 bridge kit operator-side scripts (such as admin_bridge.py, live_reverse_socks5.py, start_socks.sh) or the creation of related Java bridge class artifacts.
Detects GitLab backend processes (such as puma, sidekiq, rails, ruby, bundle) spawning shells, scripting interpreters, or network tools with suspicious command-line parameters, potentially indicating post-exploitation activity or vulnerability exploitation.
Detects the execution of the public Horizon3.ai PoC exploit for CVE-2026-106173 (FortiSIEM gRPC path traversal RCE) utilizing python interpreters with specific command-line arguments indicative of the exploit tool.
Detects an Xoscar or Xinference Python actor pool process spawning a Unix shell child process with suspicious command-line flags (such as reverse shell indicators, downloads, or base64 decoding), potentially indicative of cloudpickle deserialization remote code execution (CVE-2026-49950).
Detects the creation of cook.pth or cook.py in Python site-packages or dist-packages directories by package managers or interpreters, followed by a Python interpreter execution on the same device within one hour. This pattern matches the malicious supply chain behavior observed in compromised LiteLLM versions (e.g., 1.107.0) utilizing .pth auto-import chains for persistence and execution.
Detects Chromium-based browsers launched with remote debugging port 9222 or execution of chrome-decryptor tooling by Python processes, indicative of credential theft or Chrome CDP cookie extraction (such as Armorsteal).
Detects a Python process spawning msiexec.exe followed by a high volume of LDAP connections (burst) from the same device within a 30-minute window, potentially indicating post-exploitation activity such as domain enumeration.
This analytic detects outbound network connections from a Python process running from suspicious or non-standard directories to social media related domains.
It leverages Sysmon Event ID 3 to surface this anomalous behavior.
Legitimate Python applications rarely originate from paths such as "C:\Users\Public\", Windows font or debug folders, or the Recycle Bin, making direct outbound calls to social media infrastructure from these locations a strong indicator of compromise.
For example the Braodo Stealer, a Python-based credential-harvesting malware, abuses authenticated browser sessions to query the Meta Graph API and enumerate the victim's Facebook and Meta advertising infrastructure.
It leverages Sysmon Event ID 3 to surface this anomalous behavior.
Legitimate Python applications rarely originate from paths such as "C:\Users\Public\", Windows font or debug folders, or the Recycle Bin, making direct outbound calls to social media infrastructure from these locations a strong indicator of compromise.
For example the Braodo Stealer, a Python-based credential-harvesting malware, abuses authenticated browser sessions to query the Meta Graph API and enumerate the victim's Facebook and Meta advertising infrastructure.
Detects web servers (httpd, apache2, nginx, php-fpm) or Request Tracker (RT) Perl worker processes spawning suspicious child processes such as shells, downloaders, netcat, or Python interpreters, indicative of post-exploitation or web application compromise.
Detects Python interpreter activity accessing multiple credential store categories (such as password managers, Discord, SSH keys, or Steam) in a short window on a single device, or specific stealer scripts associated with known file paths.
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.
Detects endpoint execution of specific known brute-force scripts and tools (such as ssh_brute.py, brute3.py, auto_login.py, etc.) using Python or shell interpreters, correlated with a high outbound network connection fan-out (50 or more distinct target IPs) from the same process.
Detects endpoint execution of specific known brute-force scripts and tools (such as ssh_brute.py, brute3.py, auto_login.py, etc.) using Python or shell interpreters, correlated with a high outbound network connection fan-out (50 or more distinct target IPs) from the same process.
Detects endpoint execution of specific known brute-force scripts and tools (such as ssh_brute.py, brute3.py, auto_login.py, etc.) using Python or shell interpreters, correlated with a high outbound network connection fan-out (50 or more distinct target IPs) from the same process.
Detects endpoint execution of specific known brute-force scripts and tools (such as ssh_brute.py, brute3.py, auto_login.py, etc.) using Python or shell interpreters, correlated with a high outbound network connection fan-out (50 or more distinct target IPs) from the same process.
Page 1 of 25