Detection rules

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

11,605
detections

Search detections

Filters

Showing 30 of 11,605

Public TLS certificate with classical signature on Application Gateway

An Application Gateway or Front Door is presenting a TLS certificate signed with a classical algorithm (RSA / ECDSA) that is quantum-vulnerable. If the certificate's validity extends past the plausible arrival of cryptographically-relevant quantum computers, replace with a PQ-hybrid certificate now.

T1190

Licence: MIT License
Published: Oct 24, 2026

MediumMicrosoft Sentinel analytics

Quantum-vulnerable key detected in Key Vault

A key in Azure Key Vault has been classified as quantum-vulnerable (RSA or elliptic-curve). These key types are broken by Shor's algorithm on a sufficiently large fault-tolerant quantum computer. Rotate to a PQ-hybrid key (ML-KEM, ML-DSA) or plan migration before the harvest-now-decrypt-later window closes for long-lived data.

T1565

Licence: MIT License
Published: Oct 24, 2026

HighMicrosoft Sentinel analytics

Quantum-vulnerable certificate on Entra app registration

An Entra ID (Azure AD) app registration or service principal has a certificate credential using a classical algorithm (RSA or elliptic-curve) that is vulnerable to Shor's algorithm. These certificates authenticate workloads and service-to-service flows -- a compromised cert allows impersonation of the application identity. Rotate to a PQ-hybrid certificate or shorten the validity window.

T1552

Licence: MIT License
Published: Oct 24, 2026

InformationalMicrosoft Sentinel analytics

New quantum-vulnerable resource appeared

A resource with quantum-vulnerable posture appeared that was not observed in the previous 24-hour scan cycle. Investigate whether this is a new deployment that should have been provisioned with PQ-hybrid cryptography from the start.

T1082

Licence: MIT License
Published: Oct 24, 2026

HighMicrosoft Sentinel analytics

Certificate expiring after 2030 still uses classical signature

A TLS or Key Vault certificate has an expiry date after 2030-01-01 and is signed with a quantum-vulnerable classical algorithm. Long-lived certificates are the primary harvest-now- decrypt-later risk vector. Reissue with a PQ-hybrid signature or shorten validity window.

T1556

Licence: MIT License
Published: Oct 24, 2026

MediumMicrosoft Sentinel analytics

App Service using TLS < 1.3

An Azure App Service is configured to accept inbound TLS below 1.3. Only TLS 1.3 supports the negotiation of hybrid PQ key exchange (X25519MLKEM768 etc.); legacy versions cannot be upgraded to PQ without a client protocol change.

T1190

Licence: MIT License
Published: Oct 24, 2026

HighElastic detection rules

Web Shell Detection: Script Process Child of Common Web Processes

Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access.

T1047T1059T1059.001T1059.003T1059.005+4 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

HighElastic detection rules

Persistence via Microsoft Office AddIns

Detects attempts to establish persistence on an endpoint by abusing Microsoft Office add-ins.

T1137T1137.006

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

HighElastic detection rules

Unusual Child Process of dns.exe

Identifies an unexpected process spawning from dns.exe, the process responsible for Windows DNS server services, which may indicate activity related to remote code execution or other forms of exploitation.

T1190T1210

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

HighElastic detection rules

Suspicious SolarWinds Web Help Desk Java Module Load or Child Process

Identifies the SolarWinds Web Help Desk Java process loading an untrusted or remote native module (DLL) or spawning a suspicious child process such as cmd, PowerShell, or rundll32. This behavior is uncommon for the Web Help Desk server and may indicate successful exploitation of deserialization vulnerabilities (CVE-2025-40536, CVE-2025-40551), which allow attackers to load malicious SQLite extensions and achieve remote code execution.

T1059T1059.001T1059.003T1129T1190+2 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

HighElastic detection rules

Suspicious Windows Command Shell Arguments

Identifies the execution of the Windows Command Shell process (cmd.exe) with suspicious argument values. This behavior is often observed during malware installation.

T1027T1059T1059.003T1105T1218+2 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

LowElastic detection rules

Whoami Process Activity

Identifies suspicious use of whoami.exe which displays user, group, and privileges information for the user who is currently logged on to the local system.

T1033T1069

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

HighElastic detection rules

Script Execution via Microsoft HTML Application

Identifies the execution of scripts via HTML applications using Windows utilities rundll32.exe or mshta.exe. Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed binaries.

T1059T1059.005T1059.007T1218T1218.005+1 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

HighElastic detection rules

Suspicious Microsoft Diagnostics Wizard Execution

Identifies potential abuse of the Microsoft Diagnostics Troubleshooting Wizard (MSDT) to proxy malicious command or binary execution via malicious process arguments.

T1036T1036.003T1218

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

MediumElastic detection rules

MsiExec Service Child Process With Network Connection

Identifies the execution of an MsiExec service child process followed by network or dns lookup activity. Adversaries may abuse Windows Installers for initial access and delivery of malware.

T1218T1218.007

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

HighElastic detection rules

Suspicious Microsoft HTML Application Child Process

Identifies Mshta.exe spawning a suspicious child process. This may indicate adversarial activity, as Mshta is often leveraged by adversaries to execute malicious scripts and evade detection.

T1059T1059.001T1059.003T1218T1218.005+2 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

HighElastic detection rules

Proxy Execution via Console Window Host

Identifies abuse of the Console Window Host (conhost.exe) to execute commands via proxy. This behavior is used as a defense evasion technique to blend-in malicious activity with legitimate Windows software.

T1059T1059.001T1059.003T1202

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

HighElastic detection rules

Network Activity to a Suspicious Top Level Domain

Identifies DNS queries to commonly abused Top Level Domains by common LOLBINs or executables running from world writable directories or unsigned binaries. This behavior matches on common malware C2 abusing less formal domain names.

T1071T1071.004T1127T1127.001T1218

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

HighElastic detection rules

Potential NetScaler Log Poisoning Command Injection Attempt

Detects shell syntax in NetScaler Pitboss records or in Citrix records that combine Pitboss, packet-engine, or core terminology with shell syntax. This may indicate that attacker-controlled data poisoned an appliance log consumed by a privileged script. The behavior includes CVE-2026-88771, but the detection is intended to identify similar NetScaler log-poisoning command-injection attempts without requiring a specific vulnerability, failure phrase, or command.

T1059T1059.004T1190

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

MediumElastic detection rules

Multiple RMM Vendors Queried by a Single DNS Client

Identifies a DNS client that queries infrastructure associated with two or more distinct Remote Monitoring and Management (RMM) vendors during the same short rule window. Multiple RMM products on one endpoint can indicate attacker staging, redundant persistence, or unauthorized remote access.

T1219T1219.002

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

MediumElastic detection rules

First Time Seen RMM Service Hostname from Network DNS

Identifies when a source IP first queries a domain associated with commonly abused Remote Monitoring and Management (RMM) software within the seven-day new-terms history window. RMM tools are legitimate administration products, but adversaries frequently install or abuse them for command and control, persistence, and remote execution.

T1219T1219.002

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

MediumElastic detection rules

Namespace Manipulation Using Unshare

Identifies suspicious usage of unshare to manipulate system namespaces. Unshare can be utilized to escalate privileges or escape container security boundaries. Threat actors have utilized this binary to allow themselves to escape to the host and access other resources or escalate privileges.

T1543T1611

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

MediumElastic detection rules

Potential Container Escape via Kernel core_pattern Modification

The Linux kernel invokes the program named in "/proc/sys/kernel/core_pattern" whenever a process core-dumps. When that value begins with a pipe (|), the kernel runs the handler from the host's initial namespace as root, regardless of where the crashing process lived. Because the core-dump up-call is not namespaced, a process inside a container that can write core_pattern can register an attacker-controlled handler and then deliberately crash a process to have it execute on the host as root,

T1611

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

MediumElastic detection rules

Suspicious Command Execution via Web Server

Identifies suspicious command executions via a web server, which may suggest a vulnerability and remote shell access. Attackers may exploit a vulnerability in a web application to execute commands via a web server, or place a backdoor file that can be abused to gain code execution as a mechanism for persistence.

T1059T1190T1505T1505.003

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

MediumElastic detection rules

Suspicious Child Execution via Web Server

Identifies suspicious child processes executed via a web server, which may suggest a vulnerability and remote shell access. Attackers may exploit a vulnerability in a web application to execute commands via a web server, or place a backdoor file that can be abused to gain code execution as a mechanism for persistence.

T1059T1190T1505T1505.003

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

MediumElastic detection rules

OpenSSL Password Hash Generation

This rule detects the usage of the "openssl" binary to generate password hashes on Linux systems. The "openssl" command is a cryptographic utility that can be used to generate password hashes. Attackers may use "openssl" to generate password hashes for new user accounts or to change the password of existing accounts, which can be leveraged to maintain persistence on a Linux system.

T1098T1136T1136.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

LowElastic detection rules

Linux User Added to Privileged Group

Identifies attempts to add a user to a privileged group. Attackers may add users to a privileged group in order to establish persistence on a system.

T1098T1098.007T1136T1136.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

LowElastic detection rules

GRUB Configuration Generation through Built-in Utilities

This rule detects the generation of a new GRUB configuration file using built-in Linux commands. The GRUB configuration file is used to configure the GRUB bootloader, which is responsible for loading the Linux kernel and initramfs image during the boot process. Attackers may use these built-in utilities to generate a new GRUB configuration file that includes malicious kernel parameters or boot options, which can be leveraged to maintain persistence on the system.

T1542T1543T1574

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

MediumElastic detection rules

Memory Swap Modification

This rule detects memory swap modification events on Linux systems. Memory swap modification can be used to manipulate the system's memory and potentially impact the system's performance. This behavior is commonly observed in malware that deploys miner software such as XMRig.

T1059T1059.004T1496T1496.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

MediumElastic detection rules

Potential Data Exfiltration Through Wget

Detects the use of wget to upload files to an internet server. Threat actors often will collect data on a system and attempt to exfiltrate it back to their command and control servers. Use of wget in this way, while not inherently malicious, should be considered highly abnormal and suspicious activity.

T1005T1048

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

Load more detections

Loading detection rules

Back to results

HighElastic detection rules Elastic

Potential EtherHiding C2 via Curl JSON-RPC Request

Detects when curl or nscurl is spawned by a shell or osascript to make a JSON-RPC request to a blockchain endpoint for command and control purposes. Adversaries may leverage blockchain smart contracts as a covert C2…

Description

Detection logic

Its licence does not clear it for publishing here

Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.

Detection requirements

Platform: Containers ESXi IaaS Identity Provider Linux macOS Network Devices Office Suite SaaS Windows
The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.
Log source category: event_index

MITRE ATT&CK mappings

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.

Execution

T1059Command and Scripting Interpreter602 detections cover this technique
- T1059.002AppleScript 32 detections cover this technique
- T1059.004Unix Shell 202 detections cover this technique

Command and Control

T1102Web Service56 detections cover this technique
- T1102.001Dead Drop Resolver 9 detections cover this technique
- T1102.002Bidirectional Communication 19 detections cover this technique

References

Links the source published beside this detection. Reference is the link the source wrote, unmodified. Class is decided by this catalogue from the host and path, not stated by the source. Cited by counts published detections citing the same resource, including this one, and the sources beneath it count the repositories this catalogue ingests, which is not the same as independent research.
Reference	Class	Cited by
cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding	Product documentation	Only this detection cites it
cloud.google.com/blog/topics/threat-intelligence/unc5142-etherhiding-distribute-malware	Product documentation	Only this detection cites it
notes.netbytesec.com/2026/08/anatomy-of-macos-clickfix-crimekit-that.html	Unclassified	Only this detection cites it

From the source

At source: Open at source
Upstream identifier: 54285d96-2b7c-4345-890e-3c40e173f099
Tagged by the source as: Data Source: Elastic DefendDomain: EndpointOS: macOSPlatform: macOSResources: Investigation GuideRule Type: Event Correlation (EQL)Tactic: Command and ControlTactic: ExecutionUse Case: Threat Detection

Licence

Published under: Elastic License 2.0Read the licence
Attribution: Required

Authorship

Written by: Elastic
Published: Sep 20, 2026
Version: 2