Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
KQL detects suspicious child processes launched by PHP or web-server workers following possible exploitation of CVE-2026-109618 or CVE-2026-109619.
Detects any file write event in a user's Downloads folder on Windows endpoints, covering every CrowdStrike Falcon Written event type.
Downloads is a common landing spot for payloads from phishing links and drive-by downloads. This is the broad version of the PE file rule and includes it, so it is very noisy and suits threat hunting or investigation pivots more than alerting. To triage, review the event type, file name, writing process, hash and company name.
Downloads is a common landing spot for payloads from phishing links and drive-by downloads. This is the broad version of the PE file rule and includes it, so it is very noisy and suits threat hunting or investigation pivots more than alerting. To triage, review the event type, file name, writing process, hash and company name.
Detects Node.js processes spawning shells, script hosts or download tools, which is how post exploitation of a Node.js server would look after CVE-2026-111497 (Brotli decoder out of bounds write, fixed in 22.23.4, 24.22.1 and 26.12.1). Devices that Defender Vulnerability Management lists as vulnerable are flagged and sorted first, and rows are still returned when the CVE is not listed. It excludes npm, npx, yarn and pnpm processes and GitHub Actions runner action processes, which start shells for build scripts. It does not detect the memory corruption itself. The query ran without errors in a live tenant.
Detects potential remote code execution, web shell activity, and post-exploitation behaviors originating from PHP worker processes on internet-facing hosts, referencing patterns associated with php2shell vulnerabilities. PHP-UP-2026
Detects web servers, PHP processes, or shell processes spawning fetch utilities such as wget or curl to communicate with a specific malicious payload IP address (162.35.99.94), often indicative of web shell exploitation or post-exploitation file download activity.
Detects Portable Executable (PE) files written to a user's Downloads folder on Windows endpoints. CrowdStrike identifies PE files by file signature, so renamed or extensionless executables are caught as well as .exe files. Downloads is a common landing spot for payloads from phishing links and drive-by downloads. Most hits are legitimate installers, so use the rule for hunting or as a pivot. To triage, review the file name, company name, hash, writing process and download source.
Detects Sysinternals executables written to disk on Windows endpoints, identified by the Sysinternals company name in the PE metadata of newly written EXE files. These are legitimate admin utilities, but attackers also copy them to hosts for discovery, process inspection and credential access. The rule shows tool presence only, not misuse, so it suits inventory and hunting. To triage, review the file path, hash, writing process and whether the user is an administrator.
Identifies Node.js processes that spawn potentially suspicious child processes, including operating system shells, command interpreters, scripting runtimes, and download utilities. This behaviour may indicate exploitation of a Node.js application resulting in arbitrary command execution, followed by payload retrieval or additional post-exploitation activity.
Detects cmd.exe launching curl.exe with TLS verification disabled, redirect following, an output file, and forced hostname-to-IP resolution, or the PowerShell Invoke-WebRequest with a certificate-check bypass switch, often associated with malicious trojan droppers.
Detects attempts to download the cache_base file using various command-line utilities (wget, curl, node fetch) on a single device, correlating multiple download methods within a 10-minute window or matching known malicious mirror IOCs.
Detects command-line execution of script interpreters (PowerShell, CMD, MSHTA) spawned via Windows Explorer containing download primitives and URLs, followed by immediate external network connections.
Detects a sequence where PowerShell downloads an .msi file from Azure Blob storage (blob.core.windows.net), followed by msiexec.exe spawning PowerShell on the same device within 30 minutes.
Detects instances where a browser process (Chrome, Edge, Firefox, Brave) is observed on a device shortly before an explorer.exe-initiated PowerShell, PWSH, or CMD process executes a command containing download strings or script execution patterns (such as DownloadString, Invoke-WebRequest, IEX, or encoded commands) referencing URLs.
Detects a sequence where PowerShell downloads an .msi installer file from Azure Blob Storage, followed closely by msiexec.exe spawning a PowerShell process on the same device.
Detects mshta.exe launched with an inline javascript: one-liner that chains MSXML2.XMLHTTP to download, ADODB.Stream to write to disk, and WScript.Shell to execute. This identifies the ClickFix social engineering variant that fetches and executes payloads without using PowerShell.
Detects anomalous activities associated with potential PHP2Shell exploitation or webshell deployment where a web server worker (such as Apache, HTTPD, or PHP) spawns a Unix shell containing suspicious utility tokens, drops a PHP file outside excluded directories, or creates a PHP session-derived file.
Detects observable consequences of remote code execution on a GitLab server (CVE-2026-97229), specifically where GitLab application services (such as Puma, Sidekiq, Ruby, GitLab Rails, or GitLab Workhorse) spawn a shell or interpreter with suspicious command-line parameters or external network utilities.
Detects the Tensorlake npm 0.5.144 compromise (Shai-Hulud worm via preinstall). Includes a baseline query to identify the affected package/version across Defender inventory, file, network, device and process events, plus preinstall download/obfuscated-exec behaviour. Results are summarized per device/account.
Detects malicious behaviors involving the Chisel tunneling tool, including reverse SOCKS proxy connections with TLS verification skipped, cron-based persistence referencing watchdog scripts in hidden /var/tmp directories, and associated tool staging activities.
Detects web server processes (apache2, httpd) spawning a Unix shell (sh, dash, bash) which subsequently executes curl, wget, or php to perform an external HTTP fetch or download. This behavior is commonly associated with PHP or web application post-exploitation callbacks (webshells).
Detects cmd.exe launched from the Windows Run dialog (explorer.exe
parent) downloading a payload with a living-off-the-land transfer utility such as
certutil, bitsadmin or curl. ClickFix pasted commands frequently chain cmd.exe with
these built-in binaries to fetch the secondary malware stage.
parent) downloading a payload with a living-off-the-land transfer utility such as
certutil, bitsadmin or curl. ClickFix pasted commands frequently chain cmd.exe with
these built-in binaries to fetch the secondary malware stage.
Page 1 of 121