Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
278 detections
Filters
Last updated
All Time
Detection languages
202
34
14
11
6
Contributors
86
73
31
29
11
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
257
19
18
13
7
Products / Services
190
63
33
19
19
MITRE Techniques
116
71
56
41
41
CVEs
5
5
5
5
5
Detects potential ransomware activity (specifically VILE) that utilizes direct NT system calls and specific API interactions (e.g., NtCreateWaitCompletionPacket) to bypass user-mode EDR hooks. The rule monitors for a combination of suspicious process activity, unexpected image loads of ntdll.dll, and specific API calls often associated with evasion techniques in Go-based binaries.
Detects a sequence of events where a Protected Process Light (PPL) security process attempts to load a DLL from a non-standard path and then terminates shortly after. This pattern is a strong indicator of the EDRStartupHinder technique, where a critical system DLL is redirected to an invalid copy, causing the PPL process to fail its integrity check and self-terminate.
This rule monitors for processes with suspicious file names (specifically identified as potential obfuscated binaries) that perform API calls to 'GetTickCount64' associated with sandbox evasion techniques such as environment detection, debugger checking, and memory inspection.
This rule detects sophisticated PowerShell activity involving reflective code loading and suspicious process interaction. It identifies three distinct patterns: malicious script execution using Invoke-Expression (IEX) on files within ProgramData, PowerShell script blocks utilizing low-level NT APIs (such as NtAllocateVirtualMemory and NtCreateThreadEx) often associated with reflective injection, and suspicious cross-process remote thread creation by PowerShell processes.
Detects attempts to bypass the Anti-Malware Scan Interface (AMSI) by identifying malicious memory modifications or reflective script patterns commonly used to patch AMSI in memory. This rule correlates process-level memory events (VirtualProtect) with PowerShell ScriptBlock logging (Event ID 4104) to identify tampering with amsi.dll or AmsiScanBuffer.
Detects potential cross-process memory injection activity by monitoring for a non-debugger process that performs both NtAllocateVirtualMemory and WriteProcessMemory operations against a sensitive GUI target process within a short 5-minute correlation window.
Detects the Windows Update Service (wusvc.exe) loading advapi32.dll or performing suspicious API calls like GetProcAddress to resolve GetUserNameA. This behavior is atypical for the legitimate Windows Update service and may indicate process injection, credential harvesting, or tampering attempts.
This rule detects potentially malicious Android applications masquerading as security updates that request 'Device Administrator' permissions. Such apps often attempt to gain elevated privileges to maintain persistence, prevent uninstallation, or perform unauthorized administrative actions on the device.
Detects browser processes exhibiting a pattern consistent with 'Browser-in-the-Middle' attacks, specifically the streaming of DOM content (e.g., using rrweb) over persistent WebSocket connections to external IP addresses. The rule identifies high-density connection events to the same remote IP on port 443 lasting for more than 120 seconds and correlates these events with a preceding phishing email click on the same device.
Identifies the EDR Killer successfully removing driver callbacks or notify routines in kernel memory by detecting a sudden cessation of telemetry following the driver load of 'EEDbg.sys'. This rule correlates driver load events with subsequent telemetry drops from the same device.
Detects sudden loss of telemetry from multiple EDR agents (specifically Microsoft Defender processes like msmpeng.exe and mssense.exe) while the OS remains active, indicating potential Quality of Service (QoS) throttling or other defense evasion techniques aimed at impairing EDR functionality.
This rule processes Microsoft Graph Security Alerts, aggregating evidence from various Microsoft Defender products (MDE, MDI, MDCA, MDO, Entra ID Protection). It extracts and normalizes detailed evidence related to devices, users, IP addresses, processes, files, URLs, emails, mailboxes, network connections, and Azure resources, providing a comprehensive view of security incidents across the Microsoft ecosystem.
This rule detects events generated by Microsoft Defender for Endpoint's Attack Surface Reduction (ASR) rules in either Audit or Block mode.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
This rule detects Attack Surface Reduction (ASR) block events where a file operation was prevented. It specifically filters out audit-only events and excludes operations on .dll and .tmp files to reduce noise. The rule aims to identify malicious activity that ASR has actively blocked, indicating a potential attempt to execute or modify files in a suspicious manner.
Identifies when Microsoft Defender for Endpoint blocks or quarantines a file, extracting the malicious SHA256 hash. This rule specifically looks for `DeviceEvents` and `DeviceFileEvents` where an action type indicates a block or quarantine, and then extracts additional details like `ThreatName` and `AvAction` to confirm the successful intervention. It also includes an exclusion list for known benign hashes like EICAR.
This KQL query hunts for repeated remote logon activity (via RDP or similar) from source devices that lack Microsoft Defender for Endpoint (MDE) telemetry to server-class devices over an extended period (default 60 days). It identifies patterns where a non-monitored endpoint consistently connects to a server daily or near-daily, which may indicate:
=> Compromised or unmanaged jump hosts
=> Lateral movement from external or BYOD devices
=> Unauthorized administrative access from unmonitored workstations
=> Potential living-off-the-land or persistence techniques
The detection focuses on initiating devices without MDE sensor data (HasTelemetry == false) targeting servers, with logons occurring on multiple distinct days, suggesting routine access rather than one-off events.
Cross validate via HasTelemetry == true (i.e with this changes it identifies source devices which are reporting with proper MDE.)
KQL for MDE.
=> Compromised or unmanaged jump hosts
=> Lateral movement from external or BYOD devices
=> Unauthorized administrative access from unmonitored workstations
=> Potential living-off-the-land or persistence techniques
The detection focuses on initiating devices without MDE sensor data (HasTelemetry == false) targeting servers, with logons occurring on multiple distinct days, suggesting routine access rather than one-off events.
Cross validate via HasTelemetry == true (i.e with this changes it identifies source devices which are reporting with proper MDE.)
KQL for MDE.
Detects attempts to suspend or terminate Endpoint Detection and Response (EDR) agent processes by targeting their Process IDs (PIDs). The rule identifies suspicious command-line arguments and tools (e.g., procdump, WerFault) used to interact with processes, specifically looking for these actions against a predefined list of common EDR agent executable names. It correlates process creation events with process ID resolution to identify the targeted EDR agent.
Detection for shai-hulud supply chain attack. All npm packages. [Why not externaldata()? 'cause it is computationally expensive, and it may not run)
This rule detects the execution of DLLs that exhibit signs of advanced code obfuscation, such as dynamic jumps (e.g., JMP RAX) or indirect function calls (e.g., CALL RAX). This technique is used by malware like SLOW#TEMPEST to hinder static and dynamic analysis. The rule specifically looks for indicators from an advanced EDR, sandbox, or memory analysis tool.
This analytic processes and enriches alerts from CrowdStrike Falcon Event Stream, specifically `DetectionSummaryEvent` and `IdpDetectionSummaryEvent`. It normalizes fields such as user, destination, severity, and MITRE ATT&CK information. The rule dynamically generates drilldown links and constructs a descriptive title and message for each alert. It is designed to provide a standardized view of various CrowdStrike detections, including NGAV, Intel Detection, and Identity Protection alerts, ensuring proper risk scoring and analyst queue population.
KQL Query from file: NEW Real-time Anomalous Token Detection
Page 11 of 14