Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61,046 detections
Filters
Last updated
All Time
Detection languages
23,955
16,903
4,364
4,342
3,270
Contributors
11,679
8,654
7,555
6,800
4,504
Categories
20,590
11,933
5,910
5,194
4,872
Platforms
40,154
7,369
6,547
3,915
3,692
Products / Services
10,809
9,795
6,757
4,421
3,771
MITRE Techniques
18,176
15,735
12,661
8,477
6,293
CVEs
71
71
64
58
49
IDS Classtypes
1,937
503
461
381
237
IDS Protocols
2,431
869
408
324
97
KQL Query from file: Defending against ARTEX and CyberStrikeAI
https://thehackernews.com/2026/11/openssh-issues-emergency-fix-for-flaw.html
Detects external consumer Microsoft Teams accounts (live: accounts) attempting to impersonate internal organization employees by matching display names or swapped first/last names against internal identity records.
Detects non-browser, user-writable or temporary path processes interacting with web browser credential, cookie, or session data files (e.g., Login Data, Cookies, logins.json, key4.db), which is a common technique used by credential stealers.
Detects successful SSH connections and logons from source IPs seen in SANS ISC honeypot data for the sshole OpenSSH password authentication bypass, and lists Alpine Linux hosts that may be exposed. Alpine is not an officially supported Defender for Endpoint platform, so an empty result does not prove absence, and the long password is not visible in telemetry.
Detects registry writes to browser extension policy keys (ExtensionInstallForcelist, ExtensionInstallAllowlist, ExtensionSettings) for Google Chrome or Microsoft Edge by processes not explicitly approved as standard management tools.
Detects non-browser processes connecting to rolimons.com along with other specified services (Discord, food delivery services, or Gmail), or creating a specific evidence file associated with order theft/infostealer behaviors (ubereats_orders.json).
CVE-2026-83844 is an out-of-bounds read remote code execution vulnerability in Windows Paint (mspaint.exe). This CrowdStrike Falcon CQL query works as both a detection and a threat hunting query. It surfaces suspicious mspaint.exe behavior that may indicate exploitation. Paint is an image editor and has little legitimate reason to launch programs, write executables or scripts, or connect to remote hosts.
How it detects
The query reads Windows endpoint telemetry from ProcessRollup2, NewExecutableWritten, NewScriptWritten, DnsRequest, NetworkConnectIP4 and NetworkConnectIP6 events. It matches four behaviors:
1. Process lineage (hunt): Any process where mspaint.exe is the parent (ParentBaseFileName). This includes scripting hosts such as cmd.exe, powershell.exe and wscript.exe, LOLBins, and network-capable binaries. Paint should not spawn child processes.
2. Executable or script written to disk (alert): mspaint.exe, as the context process, creating executable or script content (NewExecutableWritten, NewScriptWritten).
3. DNS lookups (alert): Domain resolution requests made by mspaint.exe (DnsRequest).
4. Outbound network connections (alert): IPv4 and IPv6 connections made by mspaint.exe (NetworkConnectIP4, NetworkConnectIP6). The two address fields are combined into one RemoteAddress field.
Known benign activity
mspaint.exe may contact "apsaiservices-a0fqcjc6bzbhgdcd.b02.azurefd.net" and "150.171.110.85" for telemetry. The query does not exclude these destinations, so they will appear as DNS and network events. Treat them as likely benign, but still check each hit in context. Other false positives may occur, such as legitimate Paint integrations and updates.
Triage guidance
Identify the file that opened Paint, such as an email attachment or a download. Review any child process command line and the hash of any dropped file. Check unfamiliar destinations and isolate the host if the activity is confirmed malicious.
How it detects
The query reads Windows endpoint telemetry from ProcessRollup2, NewExecutableWritten, NewScriptWritten, DnsRequest, NetworkConnectIP4 and NetworkConnectIP6 events. It matches four behaviors:
1. Process lineage (hunt): Any process where mspaint.exe is the parent (ParentBaseFileName). This includes scripting hosts such as cmd.exe, powershell.exe and wscript.exe, LOLBins, and network-capable binaries. Paint should not spawn child processes.
2. Executable or script written to disk (alert): mspaint.exe, as the context process, creating executable or script content (NewExecutableWritten, NewScriptWritten).
3. DNS lookups (alert): Domain resolution requests made by mspaint.exe (DnsRequest).
4. Outbound network connections (alert): IPv4 and IPv6 connections made by mspaint.exe (NetworkConnectIP4, NetworkConnectIP6). The two address fields are combined into one RemoteAddress field.
Known benign activity
mspaint.exe may contact "apsaiservices-a0fqcjc6bzbhgdcd.b02.azurefd.net" and "150.171.110.85" for telemetry. The query does not exclude these destinations, so they will appear as DNS and network events. Treat them as likely benign, but still check each hit in context. Other false positives may occur, such as legitimate Paint integrations and updates.
Triage guidance
Identify the file that opened Paint, such as an email attachment or a download. Review any child process command line and the hash of any dropped file. Check unfamiliar destinations and isolate the host if the activity is confirmed malicious.
Detects Microsoft Edge used as a hidden HTTP client by the HOOKEDGE backdoor (APT28 / Swallowtail) an inline data:text/html URL in a 1x1 or off-screen window, or a script-launched Edge with an inline data:text/html URL and --ignore-certificate-errors. In the observed intrusion HOOKEDGE was followed by hands-on-keyboard credential theft, an SSH reverse tunnel and a reflective loader (ld.exe), so a hit should be treated as a potential active compromise rather than an isolated alert.
Detects SleepyDuck evjawbreaker Go RAT Linux persistence: a systemd user unit solidity-langsupport-runner.service written under ~/.config/systemd/user and enabled via systemctl --user from a /bin/sh -lc shell, within a short window on the same host.
Detects a network relay pattern where a host accepts an inbound internal connection on the Adaptix BeaconTCP default bind port (9000) and correlates it with the same process subsequently establishing outbound connections to public IP addresses over standard web or DNS ports (80, 443, 53).
Detects executable files launched from mounted ISO, IMG, VHD, or VHDX images and correlates the activity with DLL side-loading, outbound public network connections, suspicious executable naming patterns, and the possible delivery source such as WhatsApp or Internet download.
Detects evidence of the Ethersphere bee-js 13.3.0 and Swarm Desktop 0.56.2 supply chain compromise (SleepyDuck) in Defender XDR. Matches 21 reported SHA256 hashes in file, process and network initiator telemetry, connections to api.frameworkmetrics.xyz, the eight reported hub and relay IPs, the reported webhook.site and pastebin.com paths in URLs and command lines, the ScreenConnect relay IP and service ID in command lines, persistence paths on Linux, macOS and Windows, and the rogue ScreenConnect Client service registry key. Network and process activity from the ~/.solidity implant folder is matched regardless of destination, which keeps the hunt useful after the attacker rotates the hub address through an Ethereum contract. Lookback is 30 days. Coverage depends on Defender for Endpoint telemetry per platform, and SHA256 values are not reliably populated for non-executable files such as tgz, cjs, deb and rpm packages.
Detects a behavioral pattern where a single source IP performs a password spray or brute-force attack against multiple accounts and tenants in Entra ID, followed by a successful login and subsequent OAuth application consent or creation by the affected user account.
This rule detects outbound SSH network connections (to ports 22, 2222) to external, non-private IP addresses.
It filters out internal IP addresses, local traffic, and allows for exclusions based on approved source processes, destination IPs, source hostnames, and destination domains.
It filters out internal IP addresses, local traffic, and allows for exclusions based on approved source processes, destination IPs, source hostnames, and destination domains.
Detects a successful sshd password login followed within 10 minutes on the same host by root escalation via doas/sudo, user creation, or authorized_keys modification by the same user. Targets post-exploitation of the OpenSSH musl/no-PAM password authentication bypass (*sshole, CVE-2026-123158).
KQL Query
where ActionType == "SecurityRiskInCallDetected"
where ActionType == "SecurityRiskInCallDetected"
Detects programs that connect to known malware callback ports based on threat intelligence reports.
Detects failed attempts to clear Windows event logs via the WMI NTEventLogFile ClearEventLog method.
Event 5858 in the WMI-Activity operational log is an error event, meaning it is only generated
when the WMI operation encounters an error (e.g. access denied, provider failure).
It could be an indication of an attacker attempting to clear event logs via WMI, but failing due to insufficient privileges or other issues.
Successful clearing operations will NOT produce this event; for those, correlate with
Security event 1102 or System event 104.
Event 5858 in the WMI-Activity operational log is an error event, meaning it is only generated
when the WMI operation encounters an error (e.g. access denied, provider failure).
It could be an indication of an attacker attempting to clear event logs via WMI, but failing due to insufficient privileges or other issues.
Successful clearing operations will NOT produce this event; for those, correlate with
Security event 1102 or System event 104.
Detects phishing campaigns leveraging AWS Lambda Function URLs with pre-filled target email parameters used for credential harvesting. The rule correlates email delivery events, URL click events from email protection/safelinks, endpoint network connections to lambda URLs, and cloud app activity referencing these infrastructure endpoints.
Audit query that finds enabled OAuth apps in Microsoft Entra ID holding permissions an attacker would want: reading or sending mail, accessing files and sites, planting credentials on other apps, assigning roles, or changing Conditional Access. App-only permissions (the app signs in as itself, with no user and no MFA) are split from delegated ones. High-privilege delegated grants are flagged only for external apps with no verified publisher, the typical consent-phishing shape. Output is one row per app with a plain-language ReviewReason, publisher, origin, admin consent, activity (Inactive 90d+ is the easiest to disable) and “(in use)” markers on permissions the app actually exercises, so a review team can decide to keep, reduce or disable.
This is an inventory of what apps can do, not a change detector. A verified publisher does not mean safe, as the ConnectWise/SkyKick credential abuse showed. Pair it with audit-log hunting for new secrets and role assignments. Requires OAuthAppInfo (app governance in Defender for Cloud Apps).
This is an inventory of what apps can do, not a change detector. A verified publisher does not mean safe, as the ConnectWise/SkyKick credential abuse showed. Pair it with audit-log hunting for new secrets and role assignments. Requires OAuthAppInfo (app governance in Defender for Cloud Apps).
Page 1 of 2907