Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,439
11,829
5,873
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
This rule detects PRT token stealing on a device when exploiting the MicrosoftAccountTokenProvider.dll, leveraging a WDAC audit policy to ingest missing Microsoft Defender for Endpoint events. This addresses a blind spot in default Defender for Endpoint detection.
Detects suspicious downloads or fetches of common privilege-escalation tools such as winPEAS, linPEAS, PowerUp, Seatbelt, SharpUp, WinPwn, PrivescCheck, Sherlock, Watson, BeRoot, LinEnum, LSE/LES, Linux Exploit Suggester, pspy, or GTFObins. These tools are often used by adversaries after initial access to enumerate the environment and attempt local privilege escalation.
This might be one of the silliest detections I have created. But since there is a Beacon Object File out there which can be used to directly request Entra ID access tokens from an active beacon on a device using a specific User Agent, we can easily detect this beacon file by flagging the funny user agent and / or scope identifier that is used.
This detection flags any changes happening on the Connect Sync Application in Entra ID. Since this is a very interesting account for attackers to abuse when moving laterally between AD DS and Entra ID, any change to the account should be investigated. We try to exclude legitimate certificate renewal processes, and a new account onboarding in the detection rule.
This detection rule uses a WDAC audit policy to ingest missing DeviceImageLoad events in MDE, and check for suspicious processes using the ncrypt.dll and requesting an Entra ID Nonce. More information on the attack scenario this is detection is applicable for can be found in the references.
The analytic identifies the deletion or modification of registry keys that disable Local Security Authority (LSA) protection and Microsoft Defender Device Guard. This activity is significant because disabling these defenses can leave a system vulnerable to various attacks, including credential theft and unauthorized code execution. If confirmed malicious, this action could allow attackers to bypass critical security mechanisms, leading to potential system compromise and persistent access.
This detection rule tries to find multiple PRT tokens being used simultaneously for one device. This might indicate that an attacker was able to request a new PRT on a second device using exxported Windows Hello for Business keys. More information about the attack scenario can be found in the references.
This detection rule uses a WDAC audit policy to ingest missing DeviceImageLoad events in MDE, and check for suspicious processes using the ncrypt.dll. More information on the attack scenario this is detection is applicable for can be found in the references.
The following analytic detects a process attempting to duplicate the handle of winlogon.exe from an uncommon or public source path. This is identified using Sysmon EventCode 10, focusing on processes targeting winlogon.exe with specific access rights and excluding common system paths. This activity is significant because it may indicate an adversary trying to escalate privileges by leveraging the high-privilege tokens associated with winlogon.exe. If confirmed malicious, this could allow the attacker to gain elevated access, potentially leading to full system compromise and persistent control over the affected host.
Detects indicators of compromise (IOCs) and suspicious OAuth consent activity
linked to the Tycoon/ODx phishing kits. These campaigns impersonate Microsoft
OAuth apps to bypass MFA and harvest Microsoft 365 credentials.
linked to the Tycoon/ODx phishing kits. These campaigns impersonate Microsoft
OAuth apps to bypass MFA and harvest Microsoft 365 credentials.
Detects suspicious activities in Salesforce environments consistent with the TTPs of the ShinyHunters threat group (also tracked as UNC6040/UNC6240). The attack involves social engineering (vishing) to trick users into authorizing malicious OAuth applications that impersonate legitimate tools like 'Salesforce Data Loader'. This rule looks for key indicators such as the installation of unreviewed packages, creation of impersonating connected apps, elevation of permissions to 'full' API access, and large data exports.
Detects a variety of post-exploitation techniques observed in attacks leveraging SonicWall vulnerabilities (CVE-2024-40766). These techniques are associated with the Akira ransomware group and include defense evasion, credential access, and data staging.
Detects a successful NTLM network logon from a NULL SID (S-1-0-0). This pattern is a strong indicator of an NTLM relay attack, where an attacker intercepts an authentication attempt and relays it to a target service, such as LDAP on a Domain Controller, to perform actions on behalf of the relayed user. This is often used to modify Group Policy Objects (GPOs).
Detects the execution of an AppleScript, characteristic of the Odyssey Stealer, that displays a dialog box prompting the user for their password.
This rule detects attempts to disable Multi-Factor Authentication (MFA) within Microsoft 365 services. Specifically, it looks for audit log entries containing the operation 'Disable Strong Authentication.' This action could be performed by an attacker to maintain persistent access to compromised accounts by removing an important security layer.
Detects suspicious SMB/NTLM activity triggered by explorer.exe following recent .lnk file creation by script engines. This behavior aligns with the CVE-2025-50154 bypass of Microsoft’s NTLM credential leak patch (CVE-2025-24054), allowing zero-click NTLM hash disclosure and remote binary staging without execution.
Detects the simultaneous modification of 'msDS-ManagedAccountPrecededByLink' and 'msDS-DelegatedMSAState' attributes on a delegated Managed Service Account (dMSA) object. This activity is a strong indicator of the BadSuccessor privilege escalation technique, where an attacker simulates a dMSA migration to impersonate a target account.
This analytic detects a user account initiating an Active Directory replication request, indicative of a DCSync attack. It leverages EventCode 4662 from the Windows Security Event Log, focusing on specific object types and replication permissions. This activity is significant because it can allow an attacker with sufficient privileges to request password hashes for any or all users within the domain. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of the entire domain.
This rule detects the creation of a Volume Shadow Copy using PowerShell, specifically looking for the `Win32_ShadowCopy` WMI class and the `.Create()` method with the `ClientAccessible` parameter. Adversaries often use Volume Shadow Copies to access or copy the Active Directory domain database (NTDS.dit) to steal credential information, or other sensitive data from the local system.
The following analytic identifies unauthorized Active Directory replication requests initiated from non-domain controller locations. It leverages EventCode 4662 to detect when a computer account with replication permissions creates a handle to domainDNS, filtering out known domain controller IP addresses. This activity is significant as it may indicate a DCSync attack, where an attacker with privileged access can request password hashes for any or all users within the domain. If confirmed malicious, this could lead to unauthorized access to sensitive information and potential full domain compromise.
Detects the execution of remote access, tunneling, and credential access tools from suspicious directories. This rule specifically targets tools commonly abused by threat actors like Scattered Spider, such as AnyDesk, TeamViewer, ngrok, Teleport, Tailscale, and Mimikatz, when executed from user-writable or temporary folders. It excludes legitimate installations in standard Program Files directories to reduce false positives.
Page 170 of 206