Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,693 detections
Filters
Last updated
All Time
Detection languages
2,745
1,499
1,114
673
407
Contributors
1,570
1,362
1,278
896
185
Categories
3,709
2,352
767
581
457
Platforms
6,666
71
52
31
29
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
2,448
1,976
1,633
1,400
855
CVEs
11
10
9
9
7
IDS Classtypes
1
IDS Protocols
1
The following analytic detects PHP command-line interpreters executing code supplied directly on the command line with the CLI -r / --run options, or code supplied to PHPDBG through standard input.
It covers common CLI executable names on Linux and Windows, including php.exe, php-win.exe, the legacy php-cli.exe name, versioned Linux php binaries, phpdbg, and FrankenPHP's php-cli subcommand.
PHP-CGI and PHP-FPM are excluded because they do not support the PHP CLI inline -r option.
This behavior can be used legitimately for administration and automation, but unexpected or obfuscated inline PHP execution may indicate an attacker using an installed interpreter to run commands without dropping a script file.
It covers common CLI executable names on Linux and Windows, including php.exe, php-win.exe, the legacy php-cli.exe name, versioned Linux php binaries, phpdbg, and FrankenPHP's php-cli subcommand.
PHP-CGI and PHP-FPM are excluded because they do not support the PHP CLI inline -r option.
This behavior can be used legitimately for administration and automation, but unexpected or obfuscated inline PHP execution may indicate an attacker using an installed interpreter to run commands without dropping a script file.
Detects an Active Directory password spray attack originating from a single source IP, followed closely by a user account creation event (Event ID 4720) associated with a logon from that same source IP.
The following analytic identifies the execution of suspicious processes typically associated with WebShell activity on web servers.
It detects when processes like `cmd.exe`, `powershell.exe`, or `bash.exe` are spawned by web server processes such as `w3wp.exe` or `nginx.exe`.
This behavior is significant as it may indicate an adversary exploiting a web application vulnerability to install a WebShell, providing persistent access and command execution capabilities.
If confirmed malicious, this activity could allow attackers to maintain control over the compromised server, execute arbitrary commands, and potentially escalate privileges or exfiltrate sensitive data.
It detects when processes like `cmd.exe`, `powershell.exe`, or `bash.exe` are spawned by web server processes such as `w3wp.exe` or `nginx.exe`.
This behavior is significant as it may indicate an adversary exploiting a web application vulnerability to install a WebShell, providing persistent access and command execution capabilities.
If confirmed malicious, this activity could allow attackers to maintain control over the compromised server, execute arbitrary commands, and potentially escalate privileges or exfiltrate sensitive data.
Detects cmd.exe launching curl.exe with TLS verification disabled, redirect following, an output file, and forced hostname-to-IP resolution, or the PowerShell Invoke-WebRequest with a certificate-check bypass switch, often associated with malicious trojan droppers.
Detects WinRAR or 7-Zip extracting an archive with a hard-coded password supplied via command line from a cmd.exe batch parent, using switch patterns associated with the RareWolf AnyDesk dropper.
Detects the execution of Microsoft Quick Assist followed by a different remote access tool (RAT) or remote monitoring and management (RMM) utility on the same device within a 24-hour window, which may indicate adversary staging or persistence establishment.
Detects the addition of Microsoft Defender exclusions targeting the C:\Windows directory or SystemHealth\Update paths via PowerShell commands (Add-MpPreference/Set-MpPreference) or direct Registry modifications, which may indicate an attempt to evade security detection.
Detects Trays.exe started with the -tray argument from a Trays subfolder or a batch script, as observed in the RareWolf BAT dropper ahead of a silent AnyDesk installation.
Detects indicators of ToolShell web shell creation (spinstall0.aspx) and ASP.NET machine key harvesting activities (reading web.config or accessing validationkey/decryptionkey materials via w3wp child processes or file access audits) on SharePoint servers.
Detects the creation or renaming of the 'ESX Admins' Active Directory security group combined with the addition of members to it, which is often used for privilege escalation or persistence in VMware ESXi environments managed via Active Directory.
Detects the creation of scheduled tasks using schtasks.exe or PowerShell that execute SysMon.py from the non-standard C:\Windows\SystemHealth\Update\ directory, or the corresponding scheduled task creation events.
Detects execution of GoldenDMSA hacktool used for Directory Service Account manipulation.
Detects potential mimikatz-like tools accessing LSASS from non system account
The following analytic identifies the execution of commonly used NirSoft utilities on Windows systems.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution details such as process name, parent process, and command-line arguments.
This activity is significant for a SOC because NirSoft utilities, while legitimate, can be used by adversaries for malicious purposes like credential theft or system reconnaissance.
If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further system compromise.
Note that this search does not use a where clause to filter out known benign paths, as NirSoft utilities can be executed from various locations. This might hinder performance in environments with high data volumes.
Apply additional filtering as necessary to enhance this.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution details such as process name, parent process, and command-line arguments.
This activity is significant for a SOC because NirSoft utilities, while legitimate, can be used by adversaries for malicious purposes like credential theft or system reconnaissance.
If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further system compromise.
Note that this search does not use a where clause to filter out known benign paths, as NirSoft utilities can be executed from various locations. This might hinder performance in environments with high data volumes.
Apply additional filtering as necessary to enhance this.
Detects when a domain user account is renamed (Event ID 4781) where the old account name ends with a dollar sign (indicating a computer account) but the new name does not, or vice-versa, specifically checking if the new name matches a Domain Controller. This behavior can be indicative of account manipulation or exploitation attempts such as golden ticket or related attacks.
Detects the execution of Wireshark or tshark with command-line arguments indicating TLS key logging or packet capture file handling, followed shortly by a crash handler process (WerFault.exe or WerFaultSecure.exe) for the same process.
Detects the trusted .NET host used in Blinder Tunnel to run an attacker-supplied AppDomainManager: a renamed signed Visual Studio hosting binary as RuntimeBroker.exe, or vshost32.exe for the Blackwood tunneling tool. The attacker’s <host>.exe .config names the malicious DLL, which loads before any host code. The genuine RuntimeBroker.exe only runs from System32, and the \Microsoft\RuntimeBrokers\ install folder does not exist on a clean Windows install. The path arm therefore still fires if the actor renames the host. A LaunchContext field separates first execution (MSBuild/devenv .csproj trigger or Inno Setup installer) from Explorer autostart.
Detects PowerShell launched hidden and non-interactive with an insecure execution policy and Base64 decode-and-execute, or a script combining Base64 decode-and-execute with browser history collection and WMI shadow copy enumeration, as seen in the Midnight Blizzard (GTG-20006) stager.
Detects process handle on LSASS process with certain access mask
Detects Windows Terminal or related console hosts spawning PowerShell or PowerShell Core with command-line arguments indicative of staging, downloading, or executing remote scripts (such as encoded commands, Invoke-Expression, or web requests), commonly associated with ClickFix or social engineering techniques.
Detects the persistence mechanism used by ShelbyLoader V2 (RuntimeBroker.dll), the loader in the Iran-nexus Blinder Tunnel campaign (CL-STA-1178). The implant writes HKCU\...\Run\MicrosoftRuntime pointing at %LOCALAPPDATA%\Microsoft\RuntimeBrokers\RuntimeBroker.exe, then re-asserts it hourly. The genuine RuntimeBroker.exe is a System32 COM broker that is never autostarted from a Run key, so matching either the implant’s value name or RuntimeBroker.exe in Run data gives a near-binary signal with no allow-list. Covers both the Unit 42 and Nextron variants.
Page 1 of 319