Detection rules

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

11,649
detections

Search detections

Filters

Showing 30 of 11,649

Serialized PHP Token in Upload Filename - Suricata

This analytic detects multipart POST traffic with a serialized PHP structure in an uploaded filename, which may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity. Suricata EVE's standard HTTP events do not expose multipart form field names, so this Suricata variant cannot confirm the PHP_SESSION_UPLOAD_PROGRESS field without additional request-body inspection.

T1190

Written by: Raven TaitAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Nov 3, 2026

InformationalSplunk security content

PHP Worker Segmentation Fault After Multipart POST

This analytic pairs an Apache AH00051 worker segmentation-fault notice with the most recent logged request from that child PID on the same host and Apache instance. It looks for multipart POST requests within short time frame around the crash, a pattern that can occur during PHP2Shell exploitation. Captured access event is a candidate for the associated request that leads to crash. Yet, request that kills the worker may never reach the access log.

T1190

Written by: Onur Mustafa ErdoganAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Nov 3, 2026

LowSplunk security content

PHP Memory Exhaustion Exploitation Attempt via Multipart Request

This analytic correlates Apache and Nginx access and error logs when "multipart/form-data" requests and PHP memory-limit exhaustion errors occur for the same PID, host, and client. It extracts web request details and "PHP" error messages to support investigation of possible PHP2Shell exploitation attempts.

T1190

Written by: Onur Mustafa ErdoganAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Nov 3, 2026

InformationalSplunk security content

Large HTTP POST Request Resulting in Server Error

This analytic detects HTTP POST requests with a body of at least one megabyte that receive an HTTP 500 response or cause a server crash. Large failed uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.

T1190

Written by: Raven TaitAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Nov 3, 2026

MediumSplunk security content

Windows User Profile Binary Terminating Process Via Taskkill

The following analytic detects taskkill.exe being launched with a process ID (/pid) argument by an executable that resides directly within a user profile folder, such as the Downloads or Desktop folder. Filtering for parent processes located two to three directory levels deep under root folder. This activity is significant because browser hijackers and adware droppers executed from the Downloads folder forcefully terminate the running browser by PID so that they can modify its profile and

T1685

Written by: Onur Mustafa ErdoganAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Nov 3, 2026

MediumSplunk security content

Windows Scheduled Task XML Built Via Console Echo

The following analytic detects cmd.exe being used to write a Windows Scheduled Task XML definition to disk through the echo command. This analytic focuses on command lines that combine echo with the Task Scheduler XML namespace. This is a significant activity because legitimate software rarely assembles a task definition on the fly from the console. Browser hijackers and adware droppers do this to create a scheduled task, through schtasks.

T1053.005

Written by: Onur Mustafa ErdoganAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Nov 3, 2026

InformationalSplunk security content

Windows Cmdline Tool Execution From Non-Shell Process

The following analytic identifies instances where `ipconfig.exe`, `systeminfo.exe`, `net1.exe`, or similar tools are executed by a non-standard shell parent process, excluding CMD, PowerShell, Explorer, or `net.exe`. This detection leverages Endpoint Detection and Response (EDR) telemetry to monitor process creation events. Such behavior is significant as it may indicate adversaries using injected processes to perform system discovery, a tactic observed in FIN7's JSSLoader.

T1059.007

Written by: Teoderick ContrerasAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Nov 3, 2026

MediumSplunk security content

Windows Chromium Session Restored With Crash Bubble Suppressed

The following analytic detects a Chromium-based browser being launched with both the --hide-crash-restore-bubble and --restore-last-session command-line flags by a process other than the browser itself. Focusing on browser command lines that silently restore the previous session without showing the "Chrome didn't shut down correctly" notification.

T1176.001

Written by: Onur Mustafa ErdoganAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Nov 3, 2026

MediumSplunk security content

Web or Application Server Spawning a Shell

The following analytic detects instances where Java, web server, or application server processes spawn a Linux shell, which may indicate exploitation attempts. This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and parent-child process relationships. This activity may indicate a compromised service leading to unauthorized shell access. If confirmed malicious, attackers could execute commands, escalate privileges, or maintain persistent access.

T1133T1190

Written by: Michael HaagAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Nov 3, 2026

MediumSplunk security content

Linux Suspicious React or Next.js Child Process

This analytic detects Linux processes such as sh, bash, and common Linux LOLBINs being spawned by React or Next.js application servers. In the context of CVE-2025-55182 / React2Shell / CVE-2025-66478 for Next.js, successful exploitation can lead to arbitrary JavaScript execution on the server, which in turn is commonly used to invoke Node's child_process APIs (for example child_process.execSync) to run OS-level commands.

T1059.004T1190

Written by: Nasreddine BencherchaliAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Nov 3, 2026

InformationalSplunk security content

Linux Ngrok Reverse Proxy Usage

The following analytic detects the use of Ngrok on a Linux operating system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments associated with Ngrok. This activity is significant because Ngrok can be used by adversaries to establish reverse proxies, potentially bypassing network defenses.

T1090T1102T1572

Written by: Michael HaagAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Nov 3, 2026

MediumSplunk security content

Linux Auditd Web or Application Server Spawning a Shell

The following analytic detects instances where Java, web server, or application server processes attempts to spawn a Linux shell, which may indicate exploitation attempts. This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and parent-child process relationships. This activity may indicate a compromised service leading to unauthorized shell access.

T1190

Written by: Raven TaitAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Nov 3, 2026

InformationalSplunk security content

Linux Auditd Service Crash and Restart Burst

This analytic detects repeated Linux process crash events followed by repeated successful executions of the same executable on the same host within 10 seconds. A rapid crash and restart pattern in a service process can indicate exploitation attempts or unstable application behavior and should be correlated with network and application telemetry.

T1499.004

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Nov 3, 2026

MediumSplunk security content

Linux Auditd Process Image Change Under Same PID

This analytic detects a successful Linux execve event where a PID changes executable image under the same parent after the prior image has been active for at least one second and no more than 60 seconds. A delayed image change in an existing process can indicate execution following exploitation and should be investigated with related endpoint and network activity.

T1106

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Nov 3, 2026

InformationalSplunk security content

Linux Auditd Inline PHP Code Execution

The following analytic detects PHP command-line interpreters executing code supplied directly on the command line with CLI code-execution options such as -r / --run and -B / -R / -E / -F, or PHP runtime INI overrides that can load code. It also detects code supplied to PHPDBG through the -s option and FrankenPHP php-cli execution. It covers common Linux CLI executable names, including php, versioned PHP binaries, phpdbg, and FrankenPHP.

T1059

Written by: Raven TaitAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Nov 3, 2026

InformationalSplunk security content

Azure AD Suspicious Device Registration

The following analytic detects suspicious Azure Active Directory device registrations by monitoring "Register device" audit events for device names matching specific DESKTOP patterns or the user agent "Dsreg/10.0 (Windows 10.0.19041.928)". This user agent may indicate device registration activity through ROADtools, an offensive security framework targeting EntraID deployments. Device registration can support persistence or provide a device identity that can be used to access internal resources.

T1098.005T1586.003

Written by: Jake EneaAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Nov 3, 2026

LowElastic detection rules

User Added to the Admin Group

Identifies users being added to the admin group. This could be an indication of privilege escalation activity.

T1078T1078.003T1098T1098.007

Written by: Thijs XhaflaireAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Nov 3, 2026

HighElastic detection rules

Privilege Escalation via Parallels Appliance Extract Argument Injection

Identifies the Parallels Desktop root dispatcher (prl_disp_service) spawning tar/bsdtar with more arguments than its fixed extract command uses. The dispatcher always runs a 5-token command (tar -xf <archive> -C <dir>), so any additional arguments indicate an attacker-controlled folder name injecting extra tar flags. On macOS these flags let tar read or write attacker-chosen paths or execute an external program as root, resulting in local privilege escalation (CVE-2026-90894, Parallels

T1068T1202

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Nov 3, 2026

HighElastic detection rules

Persistence via Suspicious Launch Agent or Launch Daemon

Identifies the creation of a launch agent or daemon property list file containing abnormal or suspicious values. An adversary may establish persistence by installing a new launch agent or daemon which executes at login. This rule looks for plist files created in LaunchAgents/LaunchDaemons directories with paths commonly used by malware.

T1543T1543.001T1543.004T1547T1647

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Nov 3, 2026

MediumElastic detection rules

Screensaver Plist File Modified by Unexpected Process

Identifies when a screensaver plist file is modified by an unexpected process. An adversary can maintain persistence on a macOS endpoint by creating a malicious screensaver (.saver) file and configuring the screensaver plist file to execute code each time the screensaver is activated.

T1546T1546.002

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Nov 3, 2026

MediumElastic detection rules

Unexpected Child Process of macOS Screensaver Engine

Identifies when a child process is spawned by the screensaver engine process, which is consistent with an attacker's malicious payload being executed after the screensaver activated on the endpoint. An adversary can maintain persistence on a macOS endpoint by creating a malicious screensaver (.saver) file and configuring the screensaver plist file to execute code each time the screensaver is activated.

T1546T1546.002

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Nov 3, 2026

MediumElastic detection rules

Potential Persistence via Login Hook

Identifies the creation or modification of the login window property list (plist). Adversaries may modify plist files to run a program during system boot or user login for persistence.

T1037T1037.002T1547T1647

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Nov 3, 2026

HighElastic detection rules

Persistence via a Hidden Plist Filename

Identifies the creation of a hidden launch agent or daemon property list file. An adversary may establish persistence by installing a new launch agent or daemon which executes at login. Hidden plist files with filenames starting with a dot are particularly suspicious.

T1543T1543.001T1547T1564T1564.001+1 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Nov 3, 2026

MediumElastic detection rules

Suspicious pbpaste High Volume Activity

Identifies a high volume of `pbpaste` executions, which may indicate a bash loop continuously collecting clipboard contents, potentially allowing an attacker to harvest user credentials or other sensitive information.

T1056T1115

Written by: Thijs XhaflaireAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Nov 3, 2026

LowElastic detection rules

Excessive Sudo Authentication Failures via macOS Security Events

Identifies a high number of failed sudo password attempts on a macOS host within a short time window, using sudo messages collected by the Authentication data stream of the macOS Security Events integration. Repeated sudo authentication failures may indicate an adversary with access to a low-privileged account attempting to guess an administrator password to escalate privileges.

T1110T1110.001T1548T1548.003

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Nov 3, 2026

MediumElastic detection rules

Launch Item Registration with Suspicious Executable Path via macOS Security Events

Identifies the registration of a launch agent or launch daemon whose target executable resides in a temporary or user-writable location, using launch item registration messages collected by the macOS Security Events integration. An adversary may establish persistence with a launch agent or daemon that runs a program staged in a world-writable or temporary directory, which is uncommon for legitimate software.

T1543T1543.001T1543.004

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Nov 3, 2026

MediumElastic detection rules

Persistence via a Hidden Plist Filename via macOS Security Events

Identifies the registration of a launch agent or launch daemon whose property list (plist) filename begins with a dot, using launch item registration messages collected by the macOS Security Events integration. An adversary may establish persistence by installing a launch agent or daemon that executes at login or boot; plist files with filenames starting with a dot are hidden from default directory listings and are particularly suspicious.

T1543T1543.001T1543.004T1547T1564+2 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Nov 3, 2026

LowElastic detection rules

GitHub OAuth Application Authorized

Detects when a user authorizes a GitHub OAuth application. Stolen OAuth grants persist after password changes until revoked and can clone or ZIP private repositories. This is not a GitHub App installation (integration_installation.create).

T1078T1078.004T1528

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Nov 3, 2026

MediumElastic detection rules

New GitHub Self Hosted Action Runner

This rule detects the registration of a self-hosted GitHub Actions runner by a user and source ASN (autonomous system) pair not seen in the last 5 days. The source IP is resolved to its ASN at query time, so address churn inside the same ISP or cloud provider does not produce new alerts. Adversaries may abuse self-hosted runners to execute workflow jobs on customer infrastructure.

T1195T1195.001T1195.002

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Nov 3, 2026

LowElastic detection rules

GitHub Activity on a Private Repository from an Unusual ASN

Detects when a GitHub user pushes to or clones a private repository from an autonomous system (ASN) not previously seen for that user in the last 7 days. The source IP is resolved to its ASN at query time, so address churn inside the same ISP or cloud provider does not produce new alerts. Adversaries may access private repositories from unfamiliar ASNs to exfiltrate sensitive code or data, potentially indicating a compromise or unauthorized access.

T1059T1078T1078.004T1195T1195.002+2 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Nov 3, 2026

Load more detections

Loading detection rules

Back to results

HighElastic detection rules Elastic

GitHub SSO Recovery Codes Activity

Detects viewing, downloading, printing, generating, or using GitHub enterprise or organization SSO recovery codes. These codes bypass the IdP and are break-glass credentials.

Detection logic

Its licence does not clear it for publishing here

Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.

Detection requirements

Platform: Containers ESXi IaaS Identity Provider Linux macOS Network Devices Office Suite SaaS Windows
The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.

Known benign triggers

Documented disaster-recovery tests. Dual-control these events and store codes offline.

MITRE ATT&CK mappings

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.

Initial Access

T1078Valid AccountsAlso under Persistence, Privilege Escalation, and Stealth.716 detections cover this technique
- T1078.004Cloud Accounts 300 detections cover this technique

Credential Access

T1552Unsecured Credentials 183 detections cover this technique

References

Links the source published beside this detection. Reference is the link the source wrote, unmodified. Class is decided by this catalogue from the host and path, not stated by the source. Cited by counts published detections citing the same resource, including this one, and the sources beneath it count the repositories this catalogue ingests, which is not the same as independent research.
Reference	Class	Cited by
docs.github.com/en/enterprise-cloud@latest/admin/identity-and-access-management/managing-recovery-codes-for-your-enterprise/downloading-your-enterprise-accounts-single-sign-on-recovery-codes	Unclassified	Only this detection cites it

From the source

At source: Open at source
Upstream identifier: 76c4cafe-0da8-41ab-a9f5-ca95eb2e644e
Tagged by the source as: Data Source: GitHub Audit LogsDomain: CloudDomain: SaaSPlatform: GitHubResources: Investigation GuideRule Type: ESQLTactic: Credential AccessTactic: PersistenceUse Case: Threat Detection

Licence

Published under: Elastic License 2.0Read the licence
Attribution: Required

Authorship

Written by: Elastic
Published: Nov 3, 2026
Version: 1