Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
38 detections
Filters
Last updated
All Time
Detection languages
28
4
2
2
1
Contributors
15
8
4
4
2
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
23
11
8
7
6
Products / Services
12
7
6
6
4
MITRE Techniques
9
7
7
6
6
CVEs
2
2
1
1
Detects the installation of Parallels Desktop on macOS endpoints. This rule identifies when the Parallels Desktop application is installed or updated, providing visibility into the deployment of virtualization software within the environment.
Detects the execution of specific web browsers (Chrome, Edge, Opera) to facilitate identification of vulnerable browser versions as indicated by CVE-2026-0628 and CVE-2026-55945. This rule does not perform version checking directly but serves as a telemetry trigger for external asset inventory correlation.
Detects a suspected EvilTokens attack sequence where a user clicks a phishing URL and subsequently initiates a browser session to the Microsoft device-code authorization page (devicelogin) within 15 minutes, with the phishing lure domain appearing in the browser context.
Detects malicious Android application installation or launch behavior consistent with the 'Corp MDM' implant. This rule specifically identifies instances where a package named 'com.corp.mdm' is installed or launched and rapidly requests a combination of high-risk permissions including SMS and telephony access (RECEIVE_SMS, READ_SMS, CALL_PHONE) alongside notification permissions, which is characteristic of the implant's initial setup phase.
This rule detects when an individual user on a single host launches three or more distinct AI or LLM-related tools (such as ChatGPT, Claude, Cursor, Copilot, Ollama, or LMStudio) within the observed timeframe. This may indicate developers or power users utilizing various AI-assisted coding and productivity tools, but could also indicate unauthorized use of generative AI tools for data processing or exfiltration.
This rule monitors the creation of new Azure Function Apps and identifies those that receive external, non-private network requests within 48 hours of their creation. This pattern may indicate the deployment of malicious or unauthorized serverless infrastructure for command-and-control, proxying, or automated tasks.
This rule detects suspicious audio capture activity associated with the APT36 Ghazwa spyware. It monitors for the execution of specific foreground services (MEATIER or ADSFEAM) from the package 'com.ghazwa.updates' simultaneously with the application requesting 'RECORD_AUDIO' permissions on the same device.
This rule monitors the creation of new Azure Function Apps and identifies those that receive external, non-private network requests within 48 hours of their creation. This pattern may indicate the deployment of malicious or unauthorized serverless infrastructure for command-and-control, proxying, or automated tasks.
Detects the execution of FTK Imager (FTKImager.exe), a forensic imaging tool that can be used by adversaries to perform data collection, including capturing physical memory, logical drives, or disk images from a local system.
This rule detects a multi-stage attack sequence where a user is subjected to a 'spam bomb' (large volume of inbound emails in a short time), followed by an external Microsoft Teams contact, and concluding with the execution of legitimate remote support tools (Quick Assist or MSRA) on the victim's endpoint, which is a common pattern for social engineering and technical support fraud.
This rule detects the execution of common security analysis, debugging, and forensic tools such as x64dbg, IDA Pro, Wireshark, and Process Hacker. These tools are often used by adversaries for reverse engineering, malware analysis, or to gain deeper insight into a compromised host environment.
This rule monitors the creation of new Azure Function Apps and identifies those that receive external, non-private network requests within 48 hours of their creation. This pattern may indicate the deployment of malicious or unauthorized serverless infrastructure for command-and-control, proxying, or automated tasks.
This rule detects the execution of common security analysis, reverse engineering, and debugging tools such as Process Hacker, IDA Pro, Wireshark, and various debuggers. While these tools are legitimate for development and troubleshooting, their presence in unexpected contexts may indicate reconnaissance or analysis activities by an adversary.
Detects potential installation or installation attempts of known malicious appx packages
This KQL query identifies file creation events within common Windows startup directories and enriches them with Windows Shell Link (shortcut) creation activity.
Startup folders are frequently abused by adversaries for persistence since files or shortcuts placed here automatically execute at user login. The query covers both system-wide and user-specific startup paths and can exclude known legitimate items via an exclusion list to reduce false positives.
Startup folders are frequently abused by adversaries for persistence since files or shortcuts placed here automatically execute at user login. The query covers both system-wide and user-specific startup paths and can exclude known legitimate items via an exclusion list to reduce false positives.
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.
This rule detects a potentially malicious Human Interface Device (HID) attack where a newly connected keyboard device (e.g., a USB Rubber Ducky) immediately triggers the execution of a script interpreter such as PowerShell, CMD, or MSHTA. The correlation occurs within 60 seconds of device insertion, which is characteristic of HID-based keystroke injection attacks.
Page 2 of 2