Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,480 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,166
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,480
11,863
5,881
5,162
4,867
Platforms
18,083
3,046
1,506
124
104
Products / Services
5,723
4,293
3,713
1,173
958
MITRE Techniques
9,480
7,573
3,458
2,848
2,702
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects malicious file hashes, suspicious process executions involving Node.js/Bun running setup scripts, schtasks/powershell persistence monitoring tasks, and connections to known domains/RPC endpoints associated with threat activity. The query ran without errors in a live tenant.
Detects execution of Mimikatz or LSASS process memory credential theft techniques that are preceded by common discovery tools (such as nltest, net, adcmd, netexec, or kerbrute) on the same device within a 24-hour window.
Detects the execution of an application named avscan.exe from suspicious writable directories such as Users Public, ProgramData, or AppData Local, followed by an outbound public network connection within a one-hour window.
Detects the Inisafe CrossWeb EX service (INISAFECrossWebEXSvc.exe) launching fsquirt.exe, which can indicate potential abuse of built-in Windows utilities following a malicious lure or script execution.
Detects potential staging and execution of files from the Microsoft Vault directory within AppData, often associated with adversary tooling or credential theft.
Detects cmd.exe launching curl.exe with TLS verification disabled, redirect following, an output file, and forced hostname-to-IP resolution, or the PowerShell Invoke-WebRequest with a certificate-check bypass switch, often associated with malicious trojan droppers.
Detects web server worker processes or PHP interpreters spawning suspicious child processes associated with reverse shells, network sockets, or reconnaissance commands.
Detects behavioral artifacts associated with Impacket remote execution tools (such as wmiexec, smbexec, and atexec) on target hosts using Microsoft Defender XDR process telemetry. It identifies command-line signatures spawned by system processes like WmiPrvSE.exe, services.exe, and svchost.exe.
Detects unauthorized modifications to the runit SSH service run script or execution of loader processes and injectors referencing SD-WAN components (such as conf_sshd, rsshd, system-vdaemon, or libdssl.so) on Linux devices using Microsoft Defender for Endpoint telemetry.
Detects reconnaissance commands (whoami, systeminfo) and PowerShell execution spawned as children of remote-access tools (such as AnyDesk, ScreenConnect, TeamViewer/QuickAssist variants, etc.), followed shortly by an outbound network connection to a .top domain from the same device.
Detects a sequence of suspicious behaviors on a single device within a 4-hour window: web shell file creation by a web server process, subsequent credential extraction or dumping tooling execution (such as accessing LSASS, NTDS, or SAM), and enumeration of installed security software or endpoint sensors.
Detects when the Internet Information Services (IIS) worker process (w3wp.exe) spawns suspicious child processes, command interpreters, or reconnaissance utilities, which may indicate web shell activity, remote code execution (RCE) via ViewState deserialization, or other web application exploitation.
Detects enumeration of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.
Detects usage of system utilities to discover system network connections
Detects correlation between an external Microsoft Teams chat creation and the subsequent launch of a remote access or monitoring (RMM) tool on the same user's device within a 30-minute window, which is indicative of potential social engineering or tech support scam initial access campaigns.
Detects process command lines containing C2 operator start flags or strings alongside reconnaissance tools or platforms like fofa or skynet.
Detects the correlation of a file creation event in the user Temp folder (such as t.vbs) originating from browser cache or download patterns, followed shortly by the execution of the script via wscript.exe or cscript.exe.
Detects AnyDesk being silently installed with the --install and --silent flags or having an unattended-access password configured via the --set-password and _unattended_access parameters, typically piped via stdin from a batch dropper using cmd.exe.
Detects when typical discovery commands (whoami, id, uname, ipconfig) are executed under a web server or PHP process parent, potentially indicating post-exploitation activity following a web application compromise. The rule aggregates distinct commands within a 15-minute window to reduce false positives.
The following analytic detects cmd.exe being used to write a Windows Scheduled Task XML definition to disk through the echo command.
This analytic focuses on command lines that combine echo with the Task Scheduler XML namespace. This is a significant activity because legitimate
software rarely assembles a task definition on the fly from the console. Browser hijackers and adware droppers do this to create a scheduled task,
through schtasks.exe and the generated XML file, that periodically relaunches a copy of themselves, and then delete the XML file to hinder forensic analysis.
If confirmed malicious, this could allow an attacker to establish persistence, repeatedly execute a payload and maintain control over the victim's browser.
This analytic focuses on command lines that combine echo with the Task Scheduler XML namespace. This is a significant activity because legitimate
software rarely assembles a task definition on the fly from the console. Browser hijackers and adware droppers do this to create a scheduled task,
through schtasks.exe and the generated XML file, that periodically relaunches a copy of themselves, and then delete the XML file to hinder forensic analysis.
If confirmed malicious, this could allow an attacker to establish persistence, repeatedly execute a payload and maintain control over the victim's browser.
Detects a sequence where an Apache HTTP server spawns a shell (sh, bash, dash) followed within a 6-hour window by network connections to internal ports (LDAP, SMB, Kerberos) from the same device, indicative of web shell activity and potential internal reconnaissance or relay attempts.
Page 3 of 976