Detection rules

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

11,658
detections

Search detections

Filters

Showing 30 of 11,658

This analytic detects selected processes spawned directly by Windows Remote Management Host processes winrshost.exe and wsmprovhost.exe. The selected children include shells, scripting hosts, and administrative, discovery, and file-transfer utilities. This target-side process relationship can indicate remote execution, but it can also result from authorized WinRM administration.

T1021.006T1059

Written by: Drew ChurchAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Nov 4, 2026

InformationalSplunk security content

Linux Compiled C Source To Tmp

The following analytic detects a C/C++ compiler compiling a C source file with the output binary written to /tmp, executed as a non-root user. This is a compile-after-delivery privilege escalation pattern. Kernel exploit PoCs and local privilege escalation tools commonly drop a C source file use compilers at runtime to produce a platform-specific binary in /tmp. This avoids architecture mismatches and allows the exploit to adapt to the running kernel's symbol offsets.

T1027.004T1068

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Nov 4, 2026

MediumSplunk security content

Linux Auditd SOCK RAW EAFNOSUPPORT From User Writable Path

The following analytic detects a process executing from a user-writable directory calling socket() with SOCK_RAW (a1=3) and receiving EAFNOSUPPORT (exit=-97, errno 97). This is the kernel trigger for vhost-vsock class privilege escalation exploits. When socket() is called with an unregistered address family and SOCK_RAW, the kernel calls request_module() to attempt to load a matching protocol module.

T1068

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Nov 4, 2026

MediumSplunk security content

Linux Auditd Process Image Change Under Same PID

This analytic detects a successful Linux execve event where a PID changes executable image under the same parent after the prior image has been active for at least one second and no more than 60 seconds. A delayed image change in an existing process can indicate execution following exploitation and should be investigated with related endpoint and network activity.

T1106

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Nov 4, 2026

InformationalSplunk security content

Linux Auditd Inline PHP Code Execution

The following analytic detects PHP command-line interpreters executing code supplied directly on the command line with CLI code-execution options such as -r / --run and -B / -R / -E / -F, or PHP runtime INI overrides that can load code. It also detects code supplied to PHPDBG through the -s option and FrankenPHP php-cli execution. It covers common Linux CLI executable names, including php, versioned PHP binaries, phpdbg, and FrankenPHP.

T1059

Written by: Raven TaitAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Nov 4, 2026

MediumSplunk security content

WinRM Spawning a Process

The following analytic detects suspicious processes spawned by WinRM (wsmprovhost.exe). It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific child processes like cmd.exe, powershell.exe, and others. This activity is significant as it may indicate exploitation attempts of vulnerabilities like CVE-2021-31166, which could lead to system instability or compromise.

T1190

Written by: Drew ChurchAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Nov 4, 2026

MediumSplunk security content

Azure AD Temporary Access Pass Created

The following analytic detects the creation of a Temporary Access Pass (TAP) for an Azure AD user. It leverages Azure Active Directory AuditLogs to identify the "Create Temporary Access Pass method for user" operation. TAPs are time-limited passcodes that bypass all authentication requirements including MFA and FIDO2 - an attacker who creates a TAP for a compromised account can sign in from any location without any additional factor.

T1078.004T1556.006T1586.003

Written by: descambiadoAttributed by Splunk security content
Licence: Apache License 2.0
Published: Nov 4, 2026

InformationalSplunk security content

Azure AD Suspicious Device Registration

The following analytic detects suspicious Azure Active Directory device registrations by monitoring "Register device" audit events for device names matching specific DESKTOP patterns or the user agent "Dsreg/10.0 (Windows 10.0.19041.928)". This user agent may indicate device registration activity through ROADtools, an offensive security framework targeting EntraID deployments. Device registration can support persistence or provide a device identity that can be used to access internal resources.

T1098.005T1586.003

Written by: Jake EneaAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Nov 4, 2026

MediumSplunk security content

Azure AD Guest User Type Changed To Member

The following analytic detects when an Azure AD guest user account has its UserType property changed from Guest to Member. It leverages Azure Active Directory AuditLogs for the "Update user" operation and compares the UserType modifiedProperty old and new values. A legacy account whose UserType was null is not a guest promotion and does not match. Guest accounts carry inherent restrictions on tenant resource access; elevating to Member removes those restrictions.

T1078.004T1098T1586.003

Written by: descambiadoAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Nov 4, 2026

MediumSplunk security content

Azure AD Federated Identity Credential Added To Service Principal

The following analytic detects additions of federated identity credentials to Entra ID service principals. It leverages Azure Active Directory AuditLogs for the "Update service principal" or "Update application" operations and filters on the FederatedIdentityCredentials modifiedProperty. Workload identity federation allows external OIDC workloads such as GitHub Actions or Kubernetes to authenticate as the SP without a secret.

T1078.004T1098.001T1586.003

Written by: descambiadoAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Nov 4, 2026

Reference	Class	Cited by
attack.mitre.org/techniques/T1098/	Taxonomy	11from 2 sources
learn.microsoft.com/en-us/entra/fundamentals/users-default-permissions	Product documentation	Only this detection cites it
learn.microsoft.com/en-us/entra/identity/users/users-restrict-guest-permissions	Product documentation	Only this detection cites it

Detection rules

Description

Detection logic

Detection requirements

Known benign triggers

MITRE ATT&CK mappings

References

From the source

Licence

Authorship

Detection rules