Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,155 detections
Filters
Last updated
All Time
Detection languages
2,301
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
2,858
2,017
816
524
213
Products / Services
1,336
1,144
831
576
366
MITRE Techniques
1,822
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects a specific, outdated Internet Explorer user-agent string used by the UpCrypter malware for C2 communications. This User-Agent string is highly specific and outdated, making legitimate use extremely unlikely in modern environments.
Detects when a single Autonomous System Number (ASN) is associated with multiple organization names within a short time frame. This could indicate a rebranding or transfer of network blocks to evade sanctions or scrutiny, as seen with the Stark Industries threat activity enabler.
Detects various techniques, procedures, and indicators associated with the RustyPages macOS malware dropper, including persistence, defense evasion, payload download, and known IOCs. This rule specifically looks for the use of `curl` to download a hidden file, `launchctl` to establish persistence, `chmod` to make the payload executable, `xattr` to clear extended attributes, `pgrep` to discover security tools, shell commands to silence notifications, C2 domain/IP connections, and known malware file hashes.
The following analytic detects processes attempting to connect to known IP check web services. This behavior is identified using Sysmon EventCode 22 logs, specifically monitoring DNS queries to services like "wtfismyip.com" and "ipinfo.io". This activity is significant as it is commonly used by malware, such as Trickbot, for reconnaissance to determine the infected machine's IP address. If confirmed malicious, this could allow attackers to gather network information, aiding in further attacks or lateral movement within the network.
The following analytic detects the execution of a DNS query by a process to the associated Telegram API domain, which could indicate access via a Telegram bot commonly used by malware for command and control (C2) communications. By monitoring DNS queries related to Telegram's infrastructure, the detection identifies potential attempts to establish covert communication channels between a compromised system and external malicious actors. This behavior is often observed in cyberattacks where Telegram bots are used to receive commands or exfiltrate data, making it a key indicator of suspicious or malicious activity within a network.
This KQL query detects network traffic to or from suspicious ports by joining firewall logs (CommonSecurityLog) with an external, regularly updated list of known suspicious ports. It specifically looks for accepted or passed connections to these ports, indicating potential exploitation attempts or unauthorized communication channels used by threat actors.
This rule detects suspicious activities related to Remote Monitoring and Management (RMM) tools by querying various data sources. It identifies processes, file signatures, network connections, and firewall logs associated with known RMM tools and domains, helping to uncover potential security threats. The rule leverages an external IOC list for RMM tool names, file signatures, and associated domains.
This rule detects an unusually high volume of DNS queries originating from a single device within a one-hour window. This behavior can be indicative of various malicious activities such as DNS tunneling for command and control, data exfiltration, or extensive reconnaissance.
This rule detects successful Remote Desktop Protocol (RDP) connections by monitoring network events where the remote port is 3389 and the connection action type is 'ConnectionSuccess'. It aims to identify potential unauthorized access, lateral movement, or audit remote administration practices.
This Logic detects the presence of the malicious Chrome extension FreeVPN.One by identifying its unique extension ID across installed browsers. The logic further correlates this presence with network communications initiated by the extension to suspicious or untrusted domains. By combining extension enumeration with traffic analysis, the detection ensures high fidelity with minimal false positives. This layered approach strengthens visibility into malicious browser add-ons masquerading as VPN tools.
This rule detects communication with known malicious domains and IP addresses, as well as the presence or execution of files with known malicious MD5 or SHA256 hashes. It correlates threat intelligence with network and endpoint telemetry to identify compromised devices or accounts.
Detects defense evasion tactics used by UpCrypter, such as checking for forensic tools or sandbox environments.
This rule detects DNS queries to known malicious domains by joining IdentityQueryEvents with ThreatIntelligenceIndicator data. It specifically looks for matches between the queried domain (QueryTarget) and known malicious domains (DomainName) from threat intelligence feeds.
This rule detects attempts to exploit known CVEs on the network where the targeted device is identified as vulnerable to that specific CVE. It correlates network inspection signatures with vulnerability management data to identify high-confidence exploitation attempts.
This rule detects Tycoon and ODx AiTM phishing activity that bypasses MFA. It matches:
🔹 Network connections to known malicious domains, IP addresses, and URLs.
🔹 Email-URL clicks and Azure AD sign-in events involving those domains or specific malicious application IDs.
🔹 Sign-ins originating from suspect IP addresses or user-agent strings.
🔹 Network connections to known malicious domains, IP addresses, and URLs.
🔹 Email-URL clicks and Azure AD sign-in events involving those domains or specific malicious application IDs.
🔹 Sign-ins originating from suspect IP addresses or user-agent strings.
This rule detects RDP sessions initiated from managed devices to unmanaged devices or devices that do not have a Trusted Platform Module (TPM) enabled or supported. This can pose a security risk, especially when Windows Hello for Business credentials are used, as the keys might not be adequately protected on the destination device.
This detection rule identifies potential exploitation attempts of CVE-2024-36401, a JXPath injection vulnerability in GeoServer. Attackers can send malicious WFS, WMS, or WPS requests to achieve remote code execution. The rule looks for common GeoServer service paths and request types combined with Java code execution strings in web server or network logs.
This detection rule uses a WDAC audit policy to ingest missing DeviceImageLoad events in MDE, and check for suspicious processes using the ncrypt.dll and requesting an Entra ID Nonce. More information on the attack scenario this is detection is applicable for can be found in the references.
This rule detects activities associated with the RomCom threat group, including exploitation of CVE-2025-8088 (WinRAR path traversal), COM hijacking for persistence, anti-analysis techniques (RecentDocs check), C2 communication, and suspicious WMIC execution, potentially linked to a Mythic agent.
Detects suspicious activities related to CVE-2025-8088 WinRAR exploitation, including malicious file creation, COM hijacking, C2 communication, and anti-analysis techniques. Enhanced with ADS detection, command-line analysis, and refined false positive handling. This threat is now attributed to RomCom.
Detects potential Command and Control (C2) communication patterns based on ASIM-normalized network session data in Microsoft Sentinel. This detection covers three primary patterns:
1) Periodic beaconing with low jitter
2) Long-lived HTTP(S) long-polling sessions
3) Network traffic with very consistent payload sizes
Such patterns can indicate covert communication with compromised systems or malware infections.
1) Periodic beaconing with low jitter
2) Long-lived HTTP(S) long-polling sessions
3) Network traffic with very consistent payload sizes
Such patterns can indicate covert communication with compromised systems or malware infections.
Page 212 of 246