Detection rules

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

11,631
detections

Search detections

Filters

Showing 30 of 11,631

Shell or Suspicious Process Spawned by Ray Worker

Detects a Ray worker (`ray/_private/workers/default_worker.py`) spawning a shell, an inline Python command (`python -c` / `python3 -c`), or a discovery or download utility. Ray runs job entrypoints from that worker through a shell, so a Python reverse shell shows up as `sh -c` or `bash -c` whose command line contains `python -c` and the program it starts, such as `/bin/sh -i`. On an exposed cluster this is exploitation of the public-facing Ray jobs API (CVE-2023-48022).

T1033T1059T1059.001T1059.003T1059.004+4 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Nov 1, 2026

MediumElastic detection rules

GenAI Agent Instruction File Written to Downloads

Detects creation or change of an AI coding-agent instruction file (agents.md or claude.md) in a user Downloads folder by a browser or an archive tool. A web page can save AGENTS.md or CLAUDE.md into Downloads without a click, and opening an archive can extract the same files there. Codex and Claude Code treat those files as trusted project instructions, which can lead them to rewrite their own configuration, install a package, or leak a login token.

T1189T1204T1204.002

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Nov 1, 2026

MediumMicrosoft Sentinel analytics

Zscaler - Unexpected ZPA session duration

Detects Unexpected ZPA session duration.

T1078T1133

Licence: MIT License
Published: Oct 30, 2026

MediumMicrosoft Sentinel analytics

Zscaler - ZPA connections outside operational hours

Detects ZAP connections outside operational hours.

T1133T1190

Licence: MIT License
Published: Oct 30, 2026

MediumMicrosoft Sentinel analytics

Zscaler - ZPA connections from new IP

Detects ZPA connections from new IP.

T1078T1133

Licence: MIT License
Published: Oct 30, 2026

MediumMicrosoft Sentinel analytics

Zscaler - ZPA connections from new country

Detects ZPA connections from new country.

T1133T1190

Licence: MIT License
Published: Oct 30, 2026

MediumMicrosoft Sentinel analytics

Zscaler - ZPA connections by new user

Detects ZPA connections by new user.

T1078

Licence: MIT License
Published: Oct 30, 2026

HighMicrosoft Sentinel analytics

Zscaler - Connections by dormant user

Detects ZPA connections by dormant user.

T1078

Licence: MIT License
Published: Oct 30, 2026

MediumMicrosoft Sentinel analytics

Zscaler - Unexpected update operation

Detects unexpected version of update operation.

T1133T1190

Licence: MIT License
Published: Oct 30, 2026

HighMicrosoft Sentinel analytics

Zscaler - Forbidden countries

Detects suspicious ZPA connections from forbidden countries.

T1133T1190

Licence: MIT License
Published: Oct 30, 2026

HighMicrosoft Sentinel analytics

Zscaler - Unexpected event count of rejects by policy

Detects unexpected event count of rejects by policy.

T1078T1133

Licence: MIT License
Published: Oct 30, 2026

HighMicrosoft Sentinel analytics

Zscaler - Shared ZPA session

Detects shared ZPA session.

T1078T1133

Licence: MIT License
Published: Oct 30, 2026

MediumMicrosoft Sentinel analytics

Port Scan Detected

This alert creates an incident when a source IP addresses attempt to communicate with a large amount of distinct ports within a short period.

T1046

Licence: MIT License
Published: Oct 30, 2026

MediumMicrosoft Sentinel analytics

Excessive Amount of Denied Connections from a Single Source

This creates an incident in the event that a single source IP address generates a excessive amount of denied connections.

T1499

Licence: MIT License
Published: Oct 30, 2026

MediumMicrosoft Sentinel analytics

Brute force attack against user credentials

Identifies evidence of brute force activity against a user based on multiple authentication failures and at least one successful authentication within a given time window. This query limits IPAddresses to 100 and may not potentially cover all IPAddresses. The default failure threshold is 10, success threshold is 1, and the default time window is 20 minutes.

T1110

Licence: MIT License
Published: Oct 30, 2026

MediumMicrosoft Sentinel analytics

New High Severity Vulnerability Detected Across Multiple Hosts

This creates an incident when a new high severity vulnerability is detected across multilple hosts

T1190

Licence: MIT License
Published: Oct 30, 2026

LowSplunk security content

Serialized PHP Token in Upload Filename - Suricata

This analytic detects multipart POST traffic with a serialized PHP structure in an uploaded filename, which may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity. Suricata EVE's standard HTTP events do not expose multipart form field names, so this Suricata variant cannot confirm the PHP_SESSION_UPLOAD_PROGRESS field without additional request-body inspection.

T1190

Written by: Raven TaitAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Oct 29, 2026

LowSplunk security content

PHP Session Upload Progress with PHP Code in Upload Filename

This analytic detects multipart POST requests containing a PHPSESSID form field and an uploaded filename with a PHP opening tag. When observed with "PHP_SESSION_UPLOAD_PROGRESS" behavior, this may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.

T1190

Written by: Raven TaitAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Oct 29, 2026

LowSplunk security content

PHP Session Upload Progress Serialized Payload in Upload Filename

This analytic detects multipart POST requests containing the "PHP_SESSION_UPLOAD_PROGRESS" form field and a serialized PHP structure in an uploaded filename. This combination may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity.

T1190

Written by: Raven TaitAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Oct 29, 2026

LowSplunk security content

PHP Opening Tag in Upload Filename - Suricata

This analytic detects Suricata multipart POST events with an uploaded filename containing a PHP opening tag. Suricata EVE HTTP events do not expose multipart form field names, so this variant cannot confirm the PHPSESSID or PHP_SESSION_UPLOAD_PROGRESS fields without additional request-body inspection. The filename pattern may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.

T1190

Written by: Raven TaitAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Oct 29, 2026

LowSplunk security content

PHP Memory Exhaustion Exploitation Attempt via Multipart Request

This analytic correlates Apache and Nginx access and error logs when "multipart/form-data" requests and PHP memory-limit exhaustion errors occur for the same PID, host, and client. It extracts web request details and "PHP" error messages to support investigation of possible PHP2Shell exploitation attempts.

T1190

Written by: Onur Mustafa ErdoganAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Oct 29, 2026

InformationalSplunk security content

Large HTTP POST Request Resulting in Server Error

This analytic detects HTTP POST requests with a body of at least one megabyte that receive an HTTP 500 response. Large failed uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.

T1190

Written by: Raven TaitAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Oct 29, 2026

InformationalSplunk security content

Large HTTP POST Request Failure or Missing Response - Suricata

This analytic detects HTTP POST requests with a declared body size of at least one megabyte that receive an HTTP 500 response or have no response status recorded. Large failed or unanswered uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.

T1190

Written by: Raven TaitAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Oct 29, 2026

MediumSplunk security content

Cisco Secure Firewall - PHP2Shell Suspicious Upload Activity

This analytic detects suspicious PHP web application upload activity using Cisco Secure Firewall Threat Defense Intrusion Events. The matching network signature identifies a request pattern associated with attempts to exhaust server resources through PHP session handling. Investigate the source, targeted application, and related web server activity to determine whether the request was part of PHP2Shell exploitation.

T1190

Written by: SplunkAttributed by Splunk security content
Licence: Apache License 2.0
Published: Oct 29, 2026

MediumSplunk security content

Cisco Secure Firewall - PHP2Shell Serialized Payload Activity

This analytic detects suspicious PHP web application requests using Cisco Secure Firewall Threat Defense Intrusion Events. The matching network signature identifies a serialized input pattern associated with attempts to exploit PHP request handling. Investigate the source, targeted application, and related web server activity to determine whether the request was part of PHP2Shell exploitation.

T1190

Written by: Nasreddine BencherchaliAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 29, 2026

HighSplunk security content

Cisco Secure Firewall - PHP2Shell Exploitation Attempt

This correlation analytic identifies likely PHP2Shell exploitation attempts by correlating a PHP memory disclosure indicator with either of two independent PHP web exploitation indicators from Cisco Secure Firewall Threat Defense Intrusion Events. Seeing these behaviors from the same source against the same destination within a short period can indicate an attempt to improve the reliability of subsequent exploitation. Investigate the complete network and web server activity.

T1190

Written by: SplunkAttributed by Splunk security content
Licence: Apache License 2.0
Published: Oct 29, 2026

InformationalSplunk security content

Windows Suspicious Child Process Spawned From WebServer

This analytic detects selected system, scripting, discovery, and administration utilities spawned by Windows web or application server processes. Parent processes include common web server and application server services; Java and JavaW parents are included when their command lines identify known server frameworks or applications. Unexpected child process activity may indicate that an exposed application or web server has been abused to run commands on the host.

T1505.003

Written by: Steven DickAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 29, 2026

MediumSplunk security content

Web or Application Server Spawning a Shell

The following analytic detects instances where Java, web server, or application server processes spawn a Linux shell, which may indicate exploitation attempts. This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and parent-child process relationships. This activity may indicate a compromised service leading to unauthorized shell access. If confirmed malicious, attackers could execute commands, escalate privileges, or maintain persistent access.

T1133T1190

Written by: Michael HaagAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 29, 2026

InformationalSplunk security content

Inline PHP Code Execution

The following analytic detects PHP command-line interpreters executing code supplied directly on the command line with the CLI -r / --run options, per-line execution flags, non-empty auto-prepend or auto-append settings, or code supplied to PHPDBG through standard input. It covers common CLI executable names on Linux and Windows, including php.exe, php-win.exe, the legacy php-cli.exe name, versioned Linux php binaries, phpdbg, and FrankenPHP's php-cli subcommand.

T1059

Written by: Nasreddine BencherchaliAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Oct 29, 2026

MediumMicrosoft Sentinel analytics

ZeroTrust(TIC3.0) Control Assessment Posture Change

Zero Trust(TIC3.0) Control Assessments have Deviated from Configured Threshold Baselines

T1082

Licence: MIT License
Published: Oct 29, 2026

Load more detections

Loading detection rules

Back to results

MediumElastic detection rules Elastic

GenAI Agent Instruction File Written to Downloads

Description

Detection logic

Its licence does not clear it for publishing here

Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.

Detection requirements

Platform: Containers IaaS Identity Provider Linux macOS Windows
The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.

MITRE ATT&CK mappings

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.

Initial Access

T1189Drive-by Compromise 94 detections cover this technique

Execution

T1204User Execution184 detections cover this technique
- T1204.002Malicious File 122 detections cover this technique

References

Links the source published beside this detection. Reference is the link the source wrote, unmodified. Class is decided by this catalogue from the host and path, not stated by the source. Cited by counts published detections citing the same resource, including this one, and the sources beneath it count the repositories this catalogue ingests, which is not the same as independent research.
Reference	Class	Cited by
forever.security/blog/hijacking-ai-agents-via-downloads-folder	Unclassified	Only this detection cites it

From the source

At source: Open at source
Upstream identifier: c6c790fe-2bfa-45fa-b3c5-6b702e66bbea
Tagged by the source as: Mitre Atlas: AML.T0051Mitre Atlas: AML.T0093Data Source: Elastic DefendDomain: EndpointDomain: GenAIOS: LinuxOS: macOSOS: WindowsPlatform: LinuxPlatform: macOSPlatform: WindowsResources: Investigation GuideRule Type: ES|QLTactic: ExecutionTactic: Initial AccessThreat: Unauthorized AI UsageUse Case: Threat Detection

Licence

Published under: Elastic License 2.0Read the licence
Attribution: Required

Authorship

Written by: Elastic
Published: Nov 1, 2026
Version: 1