Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,733 detections
Filters
Last updated
All Time
Detection languages
909
387
164
127
68
Contributors
479
417
201
177
61
Categories
20,440
11,814
5,871
5,145
4,864
1,733
Platforms
822
436
329
274
206
Products / Services
498
378
118
96
79
MITRE Techniques
433
327
225
196
196
CVEs
12
12
10
10
6
IDS Classtypes
1
1
IDS Protocols
2
This rule detects processes that exhibit behavior consistent with XWorm RAT's clipboard hijacking capabilities. It identifies processes making persistent OpenClipboard API calls or showing unusual access patterns to clipboard-related registry keys, specifically looking for modifications to the 'Run' registry key with data containing 'xworm', 'clipboard', or 'clip'. Common legitimate processes are excluded to reduce false positives.
Detects suspicious activity involving the upload of multiple unique packages to common CI/CD package repositories (like npmjs, pypi, Artifactory, Nexus, Maven) from a single device within a short timeframe. This could indicate a compromised build server or developer account attempting to inject malicious dependencies into the software supply chain.
This rule detects anomalous access to cloud services, specifically Salesforce, Drift, Salesloft, HubSpot, and Marketo, that may indicate OAuth token abuse. It identifies scenarios where a high volume of actions (8 or more) occur within a short timeframe (3 hours or less) from a single IP address but with multiple unique user agents (2 or more). The detection is further refined by looking for actions related to 'Add delegated permission grant' or 'Create service principal', which are indicative of an attacker attempting to establish persistence or escalate privileges after gaining access through a compromised OAuth token.
Detects the creation of the AsyncRAT specific mutex 'AsyncMutex_6SI8OkPnk'. This mutex is a unique identifier used by AsyncRAT to ensure only one instance of the malware is running on a system, making its creation a strong indicator of compromise.
This rule identifies potential data exfiltration or unusual data transfer activity by detecting a high volume of large data transfers (over 1MB per transfer) from or to an IIS web server. It aggregates these transfers hourly by client IP and alerts if 10 or more such transfers occur within that hour from a single IP.
Detects unauthorized access to webcam for video surveillance collection
This rule detects a high volume of server errors (HTTP status codes 500, 502, or 503) from IIS web servers within a 5-minute window. A count of 20 or more server errors in this timeframe triggers the alert, indicating potential issues with the web application, backend services, or a denial-of-service attempt.
This rule detects suspicious application consent activity in Azure AD. It identifies instances where a user successfully grants consent to three or more applications within a one-hour window. This behavior can indicate an adversary attempting to gain access to resources by tricking users into consenting to malicious applications.
This rule detects suspicious application consent activity in Azure AD. It identifies instances where a user successfully grants consent to three or more applications within a one-hour window. This behavior can indicate an adversary attempting to gain access to resources by tricking users into consenting to malicious applications.
7-Zip Spawns Suspicious Process (LOLBin)
Cortex XDR
Detects a 7-Zip process, the CLI binaries (7z.exe/7za.exe), the GUI worker (7zG.exe), or the File Manager (7zFM.exe) spawning a command interpreter, script host, proxy-execution LOLBin, or download/staging utility as a child. This pattern indicates archive-delivered payload execution, where adversaries use encrypted or password-protected archives to evade mail and AV inspection and the payload runs when the recipient extracts it, as well as scripted CLI abuse for tool execution or exfil staging. Logic is split by parent: the CLI and worker binaries fire unqualified since they have no legitimate reason to spawn these children, while the File Manager requires a suspicious command-line marker to suppress the benign baseline of users double-clicking files inside an archive.
This rule identifies a high volume of HTTP 5xx errors (server-side errors) within a 5-minute interval from IIS logs. A count of 10 or more errors within this timeframe could indicate a web server under attack, a denial-of-service condition, or a critical application failure.
ASP.NET ViewState Verification Failure
Cortex XDR
This rule detects ASP.NET ViewState verification failures, specifically looking for Event ID 1316 and event message containing 'Event code: 4009'. This can indicate an attempt to tamper with the ViewState, potentially leading to deserialization vulnerabilities or other web application attacks.
Detects when a browser navigates to or launches with a 'blob:https://' URL. This can indicate unusual browser activity, potentially related to data exfiltration, web-based attacks, or specific application behaviors that might warrant investigation.
Detects suspicious app installations, custom app creation, and bot additions in Microsoft Teams. This includes sideloaded apps, which can bypass Teams store vetting and be used for persistence, custom app creation outside of development teams, which may indicate C2 bots or data exfiltration, and the addition of bots with suspicious names. The rule also flags operations like AppShared and TabAdded as medium risk.
Detects the export of Microsoft Teams messages, transcripts, recordings, and chat retrieval activities, particularly when performed via the Graph API. This rule identifies suspicious activity by looking for specific operation names in SaaS audit logs from Microsoft Teams and flags user agents commonly associated with automation tools (e.g., python-requests, axios, go-http, curl, wget, powershell, httpx, aiohttp, node) which could indicate post-compromise attackers using stolen tokens to silently export chat history.
Detects when a browser navigates to or launches with a 'blob:https://' URL. This can indicate unusual browser activity, potentially related to data exfiltration, web-based attacks, or specific application behaviors that might warrant investigation.
Detects when an administrator grants consent to an application on behalf of all users in an Azure AD tenant. This can be a legitimate administrative action but can also be abused by attackers to gain broad access to resources and data within the organization.
Detects potential “HashJack” prompt injection attempts in AI tool activity. This technique, known as HashJack, attempts to manipulate AI models by hiding instructions after the '#' in a URL. The rule specifically looks for URLs within submitted prompts that contain fragments with suspicious keywords indicative of prompt injection, such as "ignore previous", "override instructions", "system prompt", etc.
https://www.microsoft.com/en-us/security/blog/2026/04/18/crosstenant-helpdesk-impersonation-data-exfiltration-human-operated-intrusion-playbook/
Detects the expiration of the grace period of Windows Defender. This means protection against viruses, spyware, and other potentially unwanted software is disabled.
Detects when events are deleted in Kubernetes.
An adversary may delete Kubernetes events in an attempt to evade detection.
An adversary may delete Kubernetes events in an attempt to evade detection.
Page 65 of 83