Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
Detects the execution of mshta.exe with a URL containing a hex-encoded second octet in an IP address. This is a specific pattern observed in the initial access stage of the ClickFix malware campaign.
Detects when a user account is added to a local privileged group (sudo or wheel) on a Linux endpoint using the 'usermod' utility. This action grants the user administrative privileges and could be indicative of privilege escalation.
Detects process masquerading and resource abuse techniques used in the ShadowRay 2.0 campaign. This includes processes renamed to mimic legitimate system components (e.g., kworker, dns-filter) and the execution of known cryptominers from unusual locations.
Detects when a user account is added to a local privileged group (sudo or wheel) on a Linux endpoint using the 'usermod' utility. This action grants the user administrative privileges and could be indicative of privilege escalation.
This query detects execution of processes related to Visual Studio Code extension signing or caching that involve known Glassworm-compromised extensions. Based on indicators published by KOI (October 20, 2025), it identifies suspicious .vsix package operations potentially associated with self-propagating malicious VSCode extensions observed in OpenVSX and Microsoft VSCode marketplaces.
To extract vscode extension version I used this the https://detections.ai/rules/924f7b5f-d8df-4eed-ba06-08c657f65891.
To extract vscode extension version I used this the https://detections.ai/rules/924f7b5f-d8df-4eed-ba06-08c657f65891.
This rule identifies and summarizes the usage of various Remote Monitoring and Management (RMM) tools across an environment. It correlates process execution events (based on executable and process names) and network connection events (based on remote URLs/domains) with a predefined list of known RMM tools. The output provides a count of unique devices using each RMM tool, grouped by machine group, allowing for an overview of RMM tool prevalence and distribution.
This detection identifies command-line activity consistent with attempts to stop, uninstall, or otherwise tamper with the CrowdStrike Falcon agent. It looks for specific commands and utilities (sc.exe, net.exe, powershell.exe, falconctl.exe, taskkill) used in conjunction with CrowdStrike-related keywords to detect attempts to disable, uninstall, or terminate the agent's processes or services.
A critical remote code execution vulnerability, CVE-2025-59287, affects Windows Server Update Services (WSUS), enabling unauthenticated attackers to execute arbitrary code via unsafe deserialization in the AuthorizationCookie.
Actively exploited since October 2025, this flaw targets WSUS servers on ports 8530/8531, often leaving forensic artifacts like modified SoftwareDistribution.log files and suspicious process chains involving w3wp.exe or wsusservice.exe spawning cmd.exe, powershell.exe, or net.exe.
The provided KQL query for Microsoft Defender XDR correlates network, file, and process events to detect exploitation attempts.
Actively exploited since October 2025, this flaw targets WSUS servers on ports 8530/8531, often leaving forensic artifacts like modified SoftwareDistribution.log files and suspicious process chains involving w3wp.exe or wsusservice.exe spawning cmd.exe, powershell.exe, or net.exe.
The provided KQL query for Microsoft Defender XDR correlates network, file, and process events to detect exploitation attempts.
Detects processes with names used by Qilin malware (`hosts.exe`, `dato.exe`) that are launched without a visible window and subsequently make an outbound network connection. This pattern is indicative of a hidden C2 beacon, a technique used by Qilin to evade user detection.
Detects the use of PowerShell to add exclusions to Microsoft Defender, which can be an attempt by an adversary to impair defenses and prevent detection of malicious activities.
Detects attempts to discover files with setuid/setgid capabilities using the 'getcap' command. This activity is often a precursor to privilege escalation on Linux systems, as adversaries search for binaries that can be abused to gain higher privileges.
KQL Query
The analytic detects instances of `searchprotocolhost.exe` running without command line arguments but with an active network connection. This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on process execution and network traffic data. It is significant because `searchprotocolhost.exe` typically runs with specific command line arguments, and deviations from this norm can indicate malicious activity, such as Cobalt Strike usage. If confirmed malicious, this activity could allow attackers to establish network connections for command and control, potentially leading to data exfiltration or further system compromise.
The analytic detects a process creating a `.lnk` file in suspicious locations such as `C:\Users\*` or `*\Local\Temp\*`. This activity is significant because creating `.lnk` files in these directories is a common tactic used by spear phishing tools to establish persistence or execute malicious payloads. If confirmed malicious, this could allow an attacker to maintain persistence, execute arbitrary code, or further compromise the system.
The following analytic identifies the execution of `outlook.exe` writing a `.zip` file to the disk. It leverages data from the Endpoint data model, specifically monitoring process and filesystem activities. This behavior is significant as it may indicate the use of Outlook to deliver malicious payloads or exfiltrate data via compressed files. If confirmed malicious, this activity could lead to unauthorized data access, data exfiltration, or the delivery of malware, potentially compromising the security of the affected system and network.
The following analytic detects processes on macOS systems that are tapping keyboard events, potentially monitoring all keystrokes made by a user. It leverages data from osquery results within the Alerts data model, focusing on specific process names and command lines. This activity is significant as it is a common technique used by Remote Access Trojans (RATs) to log keystrokes, posing a serious security risk. If confirmed malicious, this could lead to unauthorized access to sensitive information, including passwords and personal data, compromising the integrity and confidentiality of the system.
Detects PowerShell commands that attempt to modify Windows Defender preferences to add exclusions for paths, extensions, or processes. This activity is often indicative of an adversary attempting to disable or bypass security controls. Also seen by XWorm Malware.
This specialized KQL query is designed to hunt for a particularly dangerous class of malicious activity: the deliberate disabling of Endpoint Detection and Response (EDR) security controls. It specifically targets the use of tools like EDR Silencer, which attackers deploy to "blind" security tools and operate stealthily on a compromised host. The logic focuses on high-confidence indicators, searching for the tool's executable itself or its distinctive command-line flags (blockedr, unblockall, etc.) when launched by common system interpreters like PowerShell or CMD. By filtering out noisy, legitimate activity related to document processing, this query provides security analysts with a prioritized list of potential EDR tampering incidents, enabling rapid investigation and response to this critical threat.
When two accounts from the same Entra tenant are signed into the same browser app, the device authentication (the PRT) belonging to the primary account is implicitly applied to the second account. That means the second account can inherit device-based Conditional Access, effectively bypassing intended device checks and weakening protection for privileged accounts.
Based on this behavior, I created a KQL query that detects any account assigned a privileged role signing in with private/incognito browser sessions on a device where potentially another account is already signed in — a pattern that helps to detect the mentioned PRT/device-trust bypass. Even lower-privileged accounts are concerning when they browse in private mode so I am not filtering by just admin ones. However, to target specific roles, add:
| 𝘸𝘩𝘦𝘳𝘦 𝘵𝘰𝘴𝘵𝘳𝘪𝘯𝘨(𝘈𝘴𝘴𝘪𝘨𝘯𝘦𝘥𝘙𝘰𝘭𝘦𝘴) 𝘤𝘰𝘯𝘵𝘢𝘪𝘯𝘴 "𝘢𝘥𝘮𝘪𝘯"
Based on this behavior, I created a KQL query that detects any account assigned a privileged role signing in with private/incognito browser sessions on a device where potentially another account is already signed in — a pattern that helps to detect the mentioned PRT/device-trust bypass. Even lower-privileged accounts are concerning when they browse in private mode so I am not filtering by just admin ones. However, to target specific roles, add:
| 𝘸𝘩𝘦𝘳𝘦 𝘵𝘰𝘴𝘵𝘳𝘪𝘯𝘨(𝘈𝘴𝘴𝘪𝘨𝘯𝘦𝘥𝘙𝘰𝘭𝘦𝘴) 𝘤𝘰𝘯𝘵𝘢𝘪𝘯𝘴 "𝘢𝘥𝘮𝘪𝘯"
Detects potential exploitation of VMware CVE-2025-41244, where a privileged VMware service discovery script executes a binary from a world-writable directory like /tmp. This behavior is consistent with the local privilege escalation technique used by UNC5174.
Detects when a legitimate Windows binary, MSBuild.exe or mtstocom.exe, initiates an outbound network connection. This behavior is not typical for these processes and is a technique used by malware like DarkCloud to evade defenses by process hollowing.
Page 75 of 84