Identifies evidence of brute force activity against a user based on multiple authentication failures and at least one successful authentication within a given time window. This query limits IPAddresses to 100 and may not potentially cover all IPAddresses. The default failure threshold is 10, success threshold is 1, and the default time window is 20 minutes.

T1110

Licence: MIT License
Published: Oct 30, 2026

MediumMicrosoft Sentinel analytics

New High Severity Vulnerability Detected Across Multiple Hosts

This creates an incident when a new high severity vulnerability is detected across multilple hosts

T1190

Licence: MIT License
Published: Oct 30, 2026

LowSplunk security content

Serialized PHP Token in Upload Filename - Suricata

This analytic detects multipart POST traffic with a serialized PHP structure in an uploaded filename, which may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity. Suricata EVE's standard HTTP events do not expose multipart form field names, so this Suricata variant cannot confirm the PHP_SESSION_UPLOAD_PROGRESS field without additional request-body inspection.

T1190

Written by: Raven TaitAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Oct 29, 2026

LowSplunk security content

PHP Session Upload Progress with PHP Code in Upload Filename

This analytic detects multipart POST requests containing a PHPSESSID form field and an uploaded filename with a PHP opening tag. When observed with "PHP_SESSION_UPLOAD_PROGRESS" behavior, this may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.

T1190

Written by: Raven TaitAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Oct 29, 2026

LowSplunk security content

PHP Session Upload Progress Serialized Payload in Upload Filename

This analytic detects multipart POST requests containing the "PHP_SESSION_UPLOAD_PROGRESS" form field and a serialized PHP structure in an uploaded filename. This combination may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity.

T1190

Written by: Raven TaitAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Oct 29, 2026

LowSplunk security content

PHP Opening Tag in Upload Filename - Suricata

This analytic detects Suricata multipart POST events with an uploaded filename containing a PHP opening tag. Suricata EVE HTTP events do not expose multipart form field names, so this variant cannot confirm the PHPSESSID or PHP_SESSION_UPLOAD_PROGRESS fields without additional request-body inspection. The filename pattern may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.

T1190

Written by: Raven TaitAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Oct 29, 2026

LowSplunk security content

PHP Memory Exhaustion Exploitation Attempt via Multipart Request

This analytic correlates Apache and Nginx access and error logs when "multipart/form-data" requests and PHP memory-limit exhaustion errors occur for the same PID, host, and client. It extracts web request details and "PHP" error messages to support investigation of possible PHP2Shell exploitation attempts.

T1190

Written by: Onur Mustafa ErdoganAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Oct 29, 2026

InformationalSplunk security content

Large HTTP POST Request Resulting in Server Error

This analytic detects HTTP POST requests with a body of at least one megabyte that receive an HTTP 500 response. Large failed uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.

T1190

Written by: Raven TaitAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Oct 29, 2026

InformationalSplunk security content

Large HTTP POST Request Failure or Missing Response - Suricata

This analytic detects HTTP POST requests with a declared body size of at least one megabyte that receive an HTTP 500 response or have no response status recorded. Large failed or unanswered uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.

T1190

Written by: Raven TaitAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Oct 29, 2026

MediumSplunk security content

Cisco Secure Firewall - PHP2Shell Suspicious Upload Activity

This analytic detects suspicious PHP web application upload activity using Cisco Secure Firewall Threat Defense Intrusion Events. The matching network signature identifies a request pattern associated with attempts to exhaust server resources through PHP session handling. Investigate the source, targeted application, and related web server activity to determine whether the request was part of PHP2Shell exploitation.

T1190

Written by: SplunkAttributed by Splunk security content
Licence: Apache License 2.0
Published: Oct 29, 2026

MediumSplunk security content

Cisco Secure Firewall - PHP2Shell Serialized Payload Activity

This analytic detects suspicious PHP web application requests using Cisco Secure Firewall Threat Defense Intrusion Events. The matching network signature identifies a serialized input pattern associated with attempts to exploit PHP request handling. Investigate the source, targeted application, and related web server activity to determine whether the request was part of PHP2Shell exploitation.

T1190

Written by: Nasreddine BencherchaliAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 29, 2026

HighSplunk security content

Cisco Secure Firewall - PHP2Shell Exploitation Attempt

This correlation analytic identifies likely PHP2Shell exploitation attempts by correlating a PHP memory disclosure indicator with either of two independent PHP web exploitation indicators from Cisco Secure Firewall Threat Defense Intrusion Events. Seeing these behaviors from the same source against the same destination within a short period can indicate an attempt to improve the reliability of subsequent exploitation. Investigate the complete network and web server activity.

T1190

Written by: SplunkAttributed by Splunk security content
Licence: Apache License 2.0
Published: Oct 29, 2026

InformationalSplunk security content

Windows Suspicious Child Process Spawned From WebServer

This analytic detects selected system, scripting, discovery, and administration utilities spawned by Windows web or application server processes. Parent processes include common web server and application server services; Java and JavaW parents are included when their command lines identify known server frameworks or applications. Unexpected child process activity may indicate that an exposed application or web server has been abused to run commands on the host.

T1505.003

Written by: Steven DickAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 29, 2026

MediumSplunk security content

Web or Application Server Spawning a Shell

The following analytic detects instances where Java, web server, or application server processes spawn a Linux shell, which may indicate exploitation attempts. This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and parent-child process relationships. This activity may indicate a compromised service leading to unauthorized shell access. If confirmed malicious, attackers could execute commands, escalate privileges, or maintain persistent access.

T1133T1190

Written by: Michael HaagAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 29, 2026

InformationalSplunk security content

Inline PHP Code Execution

The following analytic detects PHP command-line interpreters executing code supplied directly on the command line with the CLI -r / --run options, per-line execution flags, non-empty auto-prepend or auto-append settings, or code supplied to PHPDBG through standard input. It covers common CLI executable names on Linux and Windows, including php.exe, php-win.exe, the legacy php-cli.exe name, versioned Linux php binaries, phpdbg, and FrankenPHP's php-cli subcommand.

T1059

Written by: Nasreddine BencherchaliAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Oct 29, 2026

MediumMicrosoft Sentinel analytics

ZeroTrust(TIC3.0) Control Assessment Posture Change

Zero Trust(TIC3.0) Control Assessments have Deviated from Configured Threshold Baselines

T1082

Licence: MIT License
Published: Oct 29, 2026

HighMicrosoft Sentinel analytics

Caramel Tsunami Actor IOC - July 2021

Identifies a match across IOC's related to an actor tracked by Microsoft as Caramel Tsunami

T1546

Licence: MIT License
Published: Oct 29, 2026

HighMicrosoft Sentinel analytics

Power Apps - Multiple users access a malicious link after launching new app

Identifies a chain of events, where a new Power App is created, followed by mulitple users launching the app within the detection window and clicking on the same malicious URL.

T1189T1566

Licence: MIT License
Published: Oct 29, 2026

Load more detections

Loading detection rules

Back to results

MediumElastic detection rules Elastic

Newly Seen Commonly Abused Network Scanner

Identifies newly observed execution of SoftPerfect Network Scanner or Advanced IP/Port Scanner on a Windows host. Adversaries commonly use these legitimate scanners during post-compromise discovery to map live hosts,…

Description

Detection logic

Its licence does not clear it for publishing here

Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.

Detection requirements

Platform: Containers ESXi IaaS Linux macOS Network Devices Windows
The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.
Log source category: event_index

MITRE ATT&CK mappings

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.

Discovery

T1018Remote System Discovery 64 detections cover this technique
T1046Network Service Discovery 91 detections cover this technique

References

Links the source published beside this detection. Reference is the link the source wrote, unmodified. Class is decided by this catalogue from the host and path, not stated by the source. Cited by counts published detections citing the same resource, including this one, and the sources beneath it count the repositories this catalogue ingests, which is not the same as independent research.
Reference	Class	Cited by
github.com/Securityinbits/defender-hunt-queries/blob/main/discovery-tools.md	Tool	Only this detection cites it
thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/	Threat report	5from 3 sources
thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment/	Threat report	2from 2 sources
www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a	Vendor advisory	5from 2 sources
www.cyfirma.com/news/weekly-intelligence-report-26-jan-2024/	Unclassified	Only this detection cites it
www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/	Threat report	3from 2 sources

From the source

At source: Open at source
Upstream identifier: 64037f09-7bf0-4051-ab51-b6daa1d853c6
Tagged by the source as: Data Source: CrowdstrikeData Source: Elastic DefendData Source: Microsoft Defender XDRData Source: SentinelOneData Source: SysmonData Source: Windows Security Event LogsDomain: EndpointOS: WindowsPlatform: WindowsResources: Investigation GuideRule Type: New TermsTactic: DiscoveryUse Case: Threat Detection

Licence

Published under: Elastic License 2.0Read the licence
Attribution: Required

Authorship

Written by: Elastic
Published: Sep 16, 2026
Version: 2