Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
881 detections
Filters
Last updated
All Time
Detection languages
442
92
80
78
55
Contributors
228
168
138
43
37
Categories
20,440
11,814
5,871
5,145
4,864
881
Platforms
595
135
115
71
51
Products / Services
204
150
139
78
67
MITRE Techniques
314
263
221
214
207
CVEs
15
12
4
4
3
IDS Classtypes
20
13
10
8
3
IDS Protocols
24
14
12
1
Identifies ScreenConnect client service execution initiated by trusted system processes (dfsvc.exe, services.exe) while referencing suspicious top-level domains (.top, .info, .site, .tk, .xyz, .pw, .ml, .club, .cf, ws) in the command line. This activity may indicate unauthorized remote access deployment or abuse of legitimate remote access tools.
This rule detects potential lateral movement activities using `wmic.exe`, `psexec.exe`, or `wmiprvse.exe`. It specifically looks for these executables being run with command-line arguments indicative of remote execution or specific PsExec usage (e.g., containing backslashes for paths, `/accepteula`, or `-s`). The rule then aggregates these events and flags instances where the same process command line is observed multiple times on a device, and there are distinct remote targets involved, suggesting coordinated lateral movement.
This rule detects the use of Azure Managed Identity tokens originating from non-Azure IP spaces. This scenario is indicative of token theft, likely via the Instance Metadata Service (IMDS) endpoint (169.254.169.254), followed by an external replay of the stolen token from an attacker's infrastructure. Legitimate Managed Identity calls are expected to originate from Azure infrastructure IPs. The rule filters out legitimate Microsoft/Azure ASNs and RFC1918 private IP ranges to reduce false positives. It also categorizes the potential attack stage based on the operation name, including Key Vault access, Storage access, VM Code Execution, Privilege Escalation, and Directory Enumeration.
KQL Query
Detects possible Adversary-in-the-Middle (AiTM) attacks, session cookie replay, MFA session hijacking, token theft, and stolen cloud session reuse by identifying abnormal SessionId reuse across multiple IPs, browsers, and devices. This detection compares current session activity against a 14-day historical user behavior baseline to identify new or abnormal behavior. It includes risk scoring and account classification, while reducing false positives from token refresh activity and common Microsoft Teams noise.
This rule detects suspicious child processes spawned by the BeyondTrust Remote Support client (bomgar-scc), which could indicate post-exploitation activity following a compromise via vulnerabilities like CVE-2026-1731. It looks for high-risk command line patterns and suspicious child processes commonly used for reconnaissance and payload execution.
Detects successful network connections over FTP (port 21) or SSH (port 22) initiated by common file transfer applications such as WinSCP, FileZilla, psftp, or scp. This activity could indicate data exfiltration, unauthorized access, or command and control.
Detects when the same SessionId is used to sign in from more than one location across interactive and non-interactive sign-ins.
Detects AdaptixC2 framework behaviors by correlating DNS over HTTPS (DoH) lookups to known providers (dns.google, dns.quad9) with subsequent Beacon Object File (BOF) activities. It specifically looks for the same process performing the DoH lookup and subsequently executing LSASS dumping commands, spawning sacrificial BOF processes, or initiating SMB/WinRM lateral movement.
Detects AdaptixC2 framework behaviors by correlating DNS over HTTPS (DoH) lookups to known providers (dns.google, dns.quad9) with subsequent Beacon Object File (BOF) activities. It specifically looks for the same process performing the DoH lookup and subsequently executing LSASS dumping commands, spawning sacrificial BOF processes, or initiating SMB/WinRM lateral movement.
Detects AdaptixC2 framework behaviors by correlating DNS over HTTPS (DoH) lookups to known providers (dns.google, dns.quad9) with subsequent Beacon Object File (BOF) activities. It specifically looks for the same process performing the DoH lookup and subsequently executing LSASS dumping commands, spawning sacrificial BOF processes, or initiating SMB/WinRM lateral movement.
Detects successful sign-ins using the axios/1.7.9 user agent. Storm-2755 uses this to replay stolen session tokens and maintain persistence via automated sign-ins approximately every 30 minutes. The rule filters for successful authentications and requires at least two authentications from the same user, IP, and user agent within the time window to identify the repeated automated persistence loop.
Detects potentially suspicious events involving "GetSigninToken".
An adversary using the "aws_consoler" tool can leverage this console API to create temporary federated credential that help obfuscate which AWS credential is compromised (the original access key) and enables the adversary to pivot from the AWS CLI to console sessions without the need for MFA using the new access key issued in this request.
An adversary using the "aws_consoler" tool can leverage this console API to create temporary federated credential that help obfuscate which AWS credential is compromised (the original access key) and enables the adversary to pivot from the AWS CLI to console sessions without the need for MFA using the new access key issued in this request.
This rule detects the execution of AnyDesk from suspicious file paths that are not typically used for legitimate installations of remote access software. It identifies attempts to masquerade AnyDesk by placing it in system-like directories (e.g., Themes, Startup folders, Temp, or AppData subfolders with masquerading names) and also flags elevated executions (SYSTEM account) or service installations from these suspicious locations. The rule specifically excludes legitimate AnyDesk per-user installation paths to reduce false positives.
Detects the execution of Remote Desktop Protocol (RDP) client (mstsc.exe) with an .rdp configuration file, specifically when the .rdp file is launched from common Outlook attachment or temporary internet file directories. This behavior can indicate a user being tricked into opening a malicious RDP file delivered via email, potentially leading to remote access to an attacker-controlled system or a compromised internal host.
This rule detects the execution of processes related to 'Netbird', a peer-to-peer VPN solution that can also be used for remote access and management. It specifically looks for 'netbird' in the image file name, original file name, or parent base file name of a process on Windows platforms. Detection of this activity could indicate the legitimate use of Netbird for remote access or, in a malicious context, the deployment of a remote monitoring and management (RMM) tool by an adversary.
This rule detects impossible travel scenarios for Azure logins by calculating the speed required to travel between two consecutive login locations for the same user. It flags logins where the calculated speed exceeds the maximum speed of a commercial passenger aircraft (900 km/h) and the logins originate from different countries. Mobile device logins are excluded to reduce false positives related to VPN usage.
This rule detects impossible travel scenarios for Azure logins by calculating the speed required to travel between two consecutive login locations for the same user. It flags logins where the calculated speed exceeds the maximum speed of a commercial passenger aircraft (900 km/h) and the logins originate from different countries. Mobile device logins are excluded to reduce false positives related to VPN usage.
This rule detects successful SSH login attempts from external IP addresses (not within common private IP ranges). It specifically looks for 'Accepted' messages in syslog from the 'sshd' process and filters out internal source IPs.
This rule detects suspicious command-line activity indicative of SSH tunneling, external IP checks, and reconnaissance commands. It looks for specific IP addresses associated with known C2 or SSH tunnel infrastructure, SSH command-line options like 'StrictHostKeyChecking=no' and reverse tunnel flags ('-R', '-N'), the use of 'ifconfig.me' for external IP discovery, and various 'whoami' and 'groups' commands for system reconnaissance. It also flags activity related to 'FMAPP.exe' or 'FMAPP.dll'.
This rule detects successful SSH authentications using the GSSAPI-with-MIC mechanism. This can indicate legitimate user logins or, in some cases, an adversary using valid credentials to access a system via SSH.
Page 34 of 42