Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
743 detections
Filters
Last updated
All Time
Detection languages
319
311
30
25
23
Contributors
208
198
121
84
25
Categories
20,440
11,814
5,871
5,145
4,864
743
Platforms
416
262
181
51
41
Products / Services
328
230
136
84
55
MITRE Techniques
204
124
121
111
109
CVEs
15
10
8
7
7
IDS Classtypes
124
84
26
23
12
IDS Protocols
168
91
30
11
4
This KQL Query focuses on summarising the number of devices attempting to connect to exposed servers, categorised by vendor, by decoding their MAC addresses. This information can help you to identify unexpected devices vendors, detect virtual devices or correlate specific manufacturers with known threats.
This hunting rule searches for incoming ADWS connections on Domain Controllers from IP Addresses that cannot be linked to Microsoft Defender for Endpoint (MDE) onboarded devices. It aims to detect enumeration activities using ADWS from unmanaged or unknown devices, which might bypass typical monitoring tools.
Identifies devices that have been observed as being directly exposed to the public internet. This is based on Microsoft Defender for Endpoint's device discovery capabilities. Such devices may be at higher risk of attack and should be reviewed to ensure the exposure is intentional and properly secured.
This detection identifies network traffic to or from IP addresses known to be associated with command and control (C2) infrastructure or active exploitation in recent SharePoint vulnerability campaigns. Communication with these IPs is a strong indicator of either an attempted attack or an existing compromise.
Microsoft Releases Guidance on Exploitation of SharePoint Vulnerability (CVE-2025-53770)
KQL Query from file: Hunting Exposed JDWP
KQL Query
KQL Query from file: Sniffing Out UNC3944 on Teams
KQL Query
KQL Query from file: External Attack Surface Monitoring KQL
KQL Query
KQL Query from file: Mitigating security risks in MCP implementations
KQL Query from file: DefenderXDR Medusa Ransomware Detection
KQL Query from file: Endpoint SMB exposed on Public Internet
KQL Query from file: Enhanced Cloudflare Phishing Email Detections
KQL Query
KQL Query
The analytic identifies anomalous inbound network traffic volumes from processes within containerized workloads. It leverages Network Performance Monitoring metrics collected via an OTEL collector and pulled from Splunk Observability Cloud. The detection compares recent metrics (tcp.bytes, tcp.new_sockets, tcp.packets, udp.bytes, udp.packets) over the last hour with the average over the past 30 days. This activity is significant as it may indicate unauthorized data reception, potential breaches, vulnerability exploitation, or malware propagation. If confirmed malicious, it could lead to command and control installation, data integrity damage, container escape, and further environment compromise.
'Discover all critical ports from a list having rules like 'Any' for sourceIp, which means that they are opened to everyone. Critial ports should not be opened to everyone, and should be filtered.'
This query helps you design client firewall rules based on data stored within DeviceNetworkEvents. Folder paths are alias'ed to help represent the
files making or receiving network connections without dealing with duplication from path variance due to different root drive letter or user profile
association.
To make the report easy to read, inbound remote IP addresses are not calculated by default (this can be changed by setting the value of IncludeInboundRemoteIPs to true).
Also, the ephemeral range is defaulted to 49152 to help eliminate false detections.
files making or receiving network connections without dealing with duplication from path variance due to different root drive letter or user profile
association.
To make the report easy to read, inbound remote IP addresses are not calculated by default (this can be changed by setting the value of IncludeInboundRemoteIPs to true).
Also, the ephemeral range is defaulted to 49152 to help eliminate false detections.
RDP Nesting
KQL
'Query detects potential lateral movement within a network by identifying when an RDP connection (EventID 4624, LogonType 10) is made to an initial system, followed by a subsequent RDP connection from that system to another, using the same account within a 60-minute window.
To reduce false positives, it excludes scenarios where the same account has made 5 or more connections to the same set of computers in the previous 7 days. This approach focuses on highlighting unusual RDP behaviour that suggests lateral movement, which is often associated with attacker tactics during a network breach.'
To reduce false positives, it excludes scenarios where the same account has made 5 or more connections to the same set of computers in the previous 7 days. This approach focuses on highlighting unusual RDP behaviour that suggests lateral movement, which is often associated with attacker tactics during a network breach.'
Page 34 of 36