Detection rules

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

11,578
detections

Search detections

Filters

Showing 30 of 11,578

Web Application Spawning Interpreted Script from Temporary Directory (Container Noexec Bypass)

Detects web server processes (php-fpm, apache2, httpd, caddy) spawning scripting interpreters (sh, bash, python, perl) with target scripts located in temporary or volatile memory directories (/tmp, /dev/shm, /var/tmp). This pattern bypasses filesystem noexec mount restrictions present in containerized environments during web RCE post-exploitation.

Written by: Good L.
Licence: MIT License
Published: Oct 22, 2026

High

PHP Worker Executing Shell Redirection Payload (PHP2Shell Constrained Execution)

Detects PHP worker processes (php-fpm, apache2, httpd) executing shell interpreters with input or output redirection syntax (e.g., sh</tmp/*, sh</dev/shm/*, sh<*). This pattern indicates exploit payloads operating under strict inline memory string constraints, such as the 14-byte zend_string carrier limit in php2shell (CVE-2026-109618 / CVE-2026-109619).

Written by: Good L.
Licence: MIT License
Published: Oct 22, 2026

High

Phantom Patched PHP-FPM Service Running Stale In-Memory Binary

Identifies hosts where php-fpm processes have been running continuously from memory despite package or binary updates on disk. Detects "phantom patching" where vulnerability scanners report systems as remediated while running processes remain vulnerable to CVE-2026-109618 and CVE-2026-109619.

Written by: Good L.
Licence: MIT License
Published: Oct 22, 2026

High

ClickFix Run Dialog Child Shell Execution (Win+R Clipboard Injection)

Detects interactive execution of command interpreters, download cradles, or encoded PowerShell commands directly spawned by Windows Explorer (Run Dialog). Detects initial access chains driven by ClickFix social engineering lures (fake CAPTCHA / browser updates abusing navigator.clipboard.writeText).

Written by: Good L.
Licence: MIT License
Published: Oct 22, 2026

High

PHP-FPM Worker Crash Thrashing (PHP2Shell Exploit Heap Grooming)

Detects abnormal velocity of PHP-FPM child worker respawns from the master process. Rapid worker recycling indicates repeated memory exhaustion (zend_bailout) or segmentation faults (SIGSEGV) characteristic of Use-After-Free heap grooming and exploitation attempts (CVE-2026-109618 / CVE-2026-109619).

Written by: Good L.
Licence: MIT License
Published: Oct 22, 2026

High

Vulnerable PHP Runtime Instances (CVE-2026-109618 / CVE-2026-109619 Exposure Assessment)

Discovers vulnerable PHP runtime instances across Linux (Ubuntu, Debian, RHEL) and Windows hosts using Defender Vulnerability Management (DeviceTvmSoftwareInventory). Assesses exposure to critical RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619 across supported and EOL branches, including instances located behind WAFs and ALBs.

Written by: Good L.
Licence: MIT License
Published: Oct 22, 2026

High

PHP Worker Spawning Suspicious Child Shell (PHP2Shell Post-Exploitation)

Detects command shell or reconnaissance process spawning from PHP worker processes following CVE-2026-109618 / CVE-2026-109619 exploitation.

Licence: MIT License
Published: Oct 22, 2026

LowElastic detection rules

Potential RMM Execution from a Commonly Abused Web Service

Identifies execution of software whose reported code-signature subject matches a known remote monitoring and management (RMM) publisher with a download origin on a commonly abused web service. Adversaries use these services to deliver remote-access software during social engineering and intrusion campaigns.

T1105T1219T1219.002

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

UnknownMicrosoft Sentinel analytics

Netcraft Takedown - Latest record inventory

Latest takedown record state per `subject` for the last 7 days via `NetcraftTakedown_Latest` (`EventType == "takedown"` rolled up by Subject).

T1566T1583

Licence: MIT License
Published: Oct 22, 2026

UnknownMicrosoft Sentinel analytics

Netcraft Social - Result inventory

7-day inventory of latest Social results with platform, social type, and risk. Collapses deliveries to one row per ResultUuid via NetcraftSocialResult_Latest.

T1585T1593

Licence: MIT License
Published: Oct 22, 2026

UnknownMicrosoft Sentinel analytics

Netcraft Domain Detection - Result inventory

7-day inventory of latest Domain Detection results with risk, tag display_name flags, and infrastructure fields. Collapses deliveries to one row per DomainResultId via NetcraftDomainDetection_Latest.

T1583T1590

Licence: MIT License
Published: Oct 22, 2026

UnknownMicrosoft Sentinel analytics

Netcraft DDW Intelligence - Match inventory

7-day inventory of latest Deep & Dark Web intelligence matches (`match.discovered`) with priority, type, and source fields. Collapses deliveries to one row per MatchUuid via NetcraftDdwIntelligence_Latest.

T1593T1597

Licence: MIT License
Published: Oct 22, 2026

UnknownMicrosoft Sentinel analytics

Netcraft App - Result inventory

7-day inventory of latest App results with platform, developer, and risk. Collapses deliveries to one row per ResultUuid via NetcraftAppResult_Latest.

T1583T1593

Licence: MIT License
Published: Oct 22, 2026

UnknownMicrosoft Sentinel analytics

Netcraft Advert - Result inventory

7-day inventory of latest Advert results with advertiser, title, and risk. Collapses deliveries to one row per ResultUuid via NetcraftAdvertResult_Latest. Payload title is stored as AdvertTitle.

T1583T1593

Licence: MIT License
Published: Oct 22, 2026

InformationalMicrosoft Sentinel analytics

Netcraft Takedown - Resolved

Identifies Netcraft Takedown records whose status is `resolved` (`EventType == "takedown"`). The gateway status enum is lowercase. Raises an alert only; no incident is created.

T1583

Licence: MIT License
Published: Oct 22, 2026

HighMicrosoft Sentinel analytics

Netcraft Takedown - New takedown

Identifies new Netcraft Takedown records from the Integration Gateway (`EventType == "takedown"` and `ChangeType == "new"`). Updates to an existing takedown do not alert; use the Takedown workbook to follow status changes. `IsAuthorized` and `IsEscalated` are booleans.

T1566T1583

Licence: MIT License
Published: Oct 22, 2026

MediumMicrosoft Sentinel analytics

Netcraft Takedown - Important note changed

Identifies important notes added, updated, or deleted on Netcraft takedowns or takedown groups.

T1583

Licence: MIT License
Published: Oct 22, 2026

HighMicrosoft Sentinel analytics

Netcraft Takedown - Waiting for customer

Identifies Netcraft Takedown records where action is waiting on the customer (`EventType == "takedown"` and `ActionRequired` is not `no`).

T1583

Licence: MIT License
Published: Oct 22, 2026

MediumMicrosoft Sentinel analytics

Netcraft Social - Pending client input

Identifies Social results that are waiting for client input. A result needs client input when any tag on the result (`data.tags`) has category `input_required`. Uses NetcraftSocialResult_Latest so one ResultUuid alerts from the latest social result in the window.

T1566T1585

Licence: MIT License
Published: Oct 22, 2026

HighMicrosoft Sentinel analytics

Netcraft Social - High risk result

Identifies newly reported Social results (`ChangeType == "new"`) with `Risk.category` of highest or high. Uses NetcraftSocialResult_Latest so updates for the same ResultUuid do not re-alert unless they appear as a new result in the window.

T1566T1585

Licence: MIT License
Published: Oct 22, 2026

MediumMicrosoft Sentinel analytics

Netcraft Domain Detection - Preemptive disruption

Identifies Domain Detection results whose tag `display_name` is `Preemptive Disruption`. Uses NetcraftDomainDetection_Latest so the same DomainResultId alerts once per window.

T1566T1583

Licence: MIT License
Published: Oct 22, 2026

HighMicrosoft Sentinel analytics

Netcraft Domain Detection - Newly registered high risk

Identifies Domain Detection results whose tag `display_name` is `Newly Registered (24h)` with `Risk.category` of highest or high. Uses NetcraftDomainDetection_Latest so the same DomainResultId alerts once per window.

T1566T1583

Licence: MIT License
Published: Oct 22, 2026

HighMicrosoft Sentinel analytics

Netcraft Domain Detection - High risk result

Identifies newly reported Domain Detection results (`ChangeType == "new"`) with `Risk.category` of highest or high. Uses NetcraftDomainDetection_Latest so updates for the same DomainResultId do not re-alert unless they appear as a new result in the window.

T1566T1583

Licence: MIT License
Published: Oct 22, 2026

HighMicrosoft Sentinel analytics

Netcraft DDW Intelligence - Unacknowledged high priority

Identifies high-priority Deep & Dark Web intelligence matches that are still unacknowledged (`Acknowledged == false`). Uses NetcraftDdwIntelligence_Latest so the same MatchUuid alerts once per window.

T1552T1597

Licence: MIT License
Published: Oct 22, 2026

MediumMicrosoft Sentinel analytics

Netcraft DDW Intelligence - Takedown eligible match

Identifies Deep & Dark Web intelligence matches that are takedown eligible. Uses NetcraftDdwIntelligence_Latest so the same MatchUuid alerts once per window.

T1583T1597

Licence: MIT License
Published: Oct 22, 2026

HighMicrosoft Sentinel analytics

Netcraft DDW Intelligence - High priority match

Identifies Deep & Dark Web intelligence matches with Priority of high. Uses NetcraftDdwIntelligence_Latest so the same MatchUuid alerts once per window.

T1552T1597

Licence: MIT License
Published: Oct 22, 2026

MediumMicrosoft Sentinel analytics

Netcraft App - Pending client input

Identifies App results that are waiting for client input. A result needs client input when any tag on the result (`data.tags`) has category `input_required`. Uses NetcraftAppResult_Latest so one ResultUuid alerts from the latest app result in the window.

T1566T1583

Licence: MIT License
Published: Oct 22, 2026

HighMicrosoft Sentinel analytics

Netcraft App - High risk result

Identifies newly reported App results (`ChangeType == "new"`) with `Risk.category` of highest or high. Uses NetcraftAppResult_Latest so updates for the same ResultUuid do not re-alert unless they appear as a new result in the window.

T1566T1583

Licence: MIT License
Published: Oct 22, 2026

MediumMicrosoft Sentinel analytics

Netcraft Advert - Pending client input

Identifies Advert results that are waiting for client input. A result needs client input when any tag on the result (`data.tags`) has category `input_required`. Uses NetcraftAdvertResult_Latest so one ResultUuid alerts from the latest advert result in the window.

T1566T1583

Licence: MIT License
Published: Oct 22, 2026

HighMicrosoft Sentinel analytics

Netcraft Advert - High risk result

Identifies newly reported Advert results (`ChangeType == "new"`) with `Risk.category` of highest or high. Uses NetcraftAdvertResult_Latest so updates for the same ResultUuid do not re-alert unless they appear as a new result in the window.

T1566T1583