Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
This KQL query hunts for suspicious activities in Microsoft Defender for Endpoint that may indicate attempts to disable or manipulate Windows Event Logging, such as clearing logs, stopping the Event Log service, or modifying audit policies. It targets processes and commands associated with MITRE ATT&CK technique T1562.002 to identify potential defense evasion tactics.
The following analytic detects the creation or connection of anonymous pipes for inter-process communication (IPC) within a Windows environment. Anonymous pipes are commonly used by legitimate system processes, services, and applications to transfer data between related processes. However, adversaries frequently abuse anonymous pipes to facilitate stealthy process injection, command-and-control (C2) communication, credential theft, or privilege escalation. This detection monitors for unusual anonymous pipe activity, particularly involving non-system processes, unsigned executables, or unexpected parent-child process relationships. While legitimate use cases exist—such as Windows services, software installers, or security tools—unusual or high-frequency anonymous pipe activity should be investigated for potential malware, persistence mechanisms, or lateral movement techniques.
This rule detects processes that are taking an unusually high number of screenshots within a defined timeframe. It identifies screenshot activity by looking for specific action types like "ScreenshotTaken", file creations with common image extensions (.png, .jpg, .jpeg, .bmp, .gif, .tiff), and process command lines containing common Windows API calls related to screen capturing (e.g., BitBlt, GetDC, PrintWindow, CopyFromScreen). The rule aggregates these events per device and triggers an alert if the total number of screenshots exceeds a configurable threshold.
This rule detects attempts by scripting language interpreters (Node.js, Python, PowerShell) to access sensitive browser credential files such as 'Login Data', 'Web Data', and 'Cookies' from Chrome and Brave browser user data directories. It also includes specific file paths that might be associated with known browser extensions or malware that target these files. This activity is indicative of credential dumping or information stealing.
This rule detects files associated with Qilin (aka Agenda) ransomware based on known malicious file hashes. It monitors for file creation or process execution events where the SHA1, SHA256, or MD5 hash matches a predefined list of Qilin ransomware hashes.
This detection identifies processes that have executed on a host in the last 7 days but were not observed in the previous 30 days. This is useful for detecting potentially malicious or anomalous activity, such as new software installations, LOLBins, or attacker tools introduced during a compromise.
This rule detects potential data exfiltration attempts using the built-in Windows `ping.exe` utility. Specifically, it looks for `ping.exe` executions where a large payload size (greater than 1024 bytes) is specified using the -L command-line argument. This technique can be used to tunnel data over ICMP, which might bypass some network defenses.
Detects potential_APT-style process hollowing on Linux using syscall stubs and string camouflage
This rule detects the execution of known Remote Monitoring and Management (RMM) tool processes or network connections to domains associated with RMM tools. It leverages an external CSV file containing a list of RMM tool executable names and their associated domains to identify suspicious activity. The rule aims to identify the presence and use of legitimate RMM software, which can be abused by adversaries for remote access and control.
This detection identifies known malicious file hashes associated with SharePoint exploitation campaigns. These hashes correspond to web shells and post-exploitation tools observed in attacks by threat actors like Storm-2603.
This detection rule identifies processes that call the 'GlobalMemoryStatusEx' Windows API. This behavior is a known sandbox evasion technique used by malware, including SLOW#TEMPEST, to check the system's physical memory size before executing a malicious payload. The rule is tuned to focus on unsigned processes or those running from non-standard locations and with low host prevalence.
This rule detects a specific DLL hash (3d3837eb69c3b072fdfc915468cbc8a83bb0db7babd5f7863bdf81213045023c) associated with the SLOW#TEMPEST campaign. This file is the loader DLL responsible for executing the malware's payload. The rule looks for this hash in both executed processes and files on disk.
This rule detects a specific DLL hash (3583cc881cb077f97422b9729075c9465f0f8f94647b746ee7fa049c4970a978) associated with the SLOW#TEMPEST campaign. This file is a DLL that contains an encrypted payload. The rule searches for this hash in both executed processes and files on disk.
This rule detects suspicious activity where a file is first downloaded to the 'Downloads' folder and subsequently executed from the 'Public' folder on the same device within a 24-hour timeframe. This behavior can indicate an attempt to bypass security controls or stage malicious payloads in a commonly accessible location.
Looking for processes executing chrome / edge with a remote debugging port, this is typically seen being leverage by info stealer malware to steal credentials.
The remote debugging functionality can be used to obtain cookies without requiring keychain access.
The remote debugging functionality can be used to obtain cookies without requiring keychain access.
This rule detects the presence of specific file hashes (MD5, SHA1, SHA256) across device file events, device process events, and email attachment information. It is designed to identify known malicious files or indicators of compromise (IOCs) within an environment.
SMBExec was Used
S1QL
Detects potential attempts to access administrative shares using cmd.exe or powershell.exe, which could indicate lateral movement or unauthorized access attempts.
KQL Query from file: PowerShell-Based Event Log Clearing
KQL Query from file: DefenderXDR - Devman Ransomware Detection
KQL Query
KQL Query from file: Global Admin Entra Cookie with Chrome ZeroDay
Page 77 of 84