Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20 detections
Filters
Last updated
All Time
Detection languages
19
1
Contributors
15
4
1
Categories
10
10
5
5
3
Platforms
14
4
4
3
2
Products / Services
11
3
2
2
2
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
CVEs
1
KQL Query from file: Fortigate Belsen Leak KQL Check
KQL Query from file: Global Admin Entra Cookie with Chrome ZeroDay
KQL Query from file: Detecting Commvault Exploitation in Azure
KQL Query
KQL Query
KQL Query
KQL Query
KQL Query from file: Vulnerability Profile: CVE-2024-30040 (Zero-day)
KQL Query from file: DefenderXDR Exposure Management for CVE-2024-3094
KQL Query
KQL Query
KQL Query from file: CVE-2025-24054 NTLM Exploit in the Wild Detection
KQL Query from file: CVE-2025-4664 Chrome flaw with public exploit
KQL Query
KQL Query from file: glibc critical vulnerability (CVSS 9.8)
Microsoft has observed threat actors exploiting vulnerabilities associated with Log4J.
First query digs in print spooler drivers folder for any file creations,
MANY OF THE FILES THAT SHOULD COME UP HERE MAY BE LEGIT. Unsigned files
or ones that don't have any relations to printers that you are using are
suspicious.
Second query that can be used for finding client machines that
could be operating print servers or file servers is also included here.
As additional mitigation for the exploit you might want to block the
incoming traffic to the SMB or EPMAP Ports (445) if you need to keep the
spooler service running to print from clients.
MANY OF THE FILES THAT SHOULD COME UP HERE MAY BE LEGIT. Unsigned files
or ones that don't have any relations to printers that you are using are
suspicious.
Second query that can be used for finding client machines that
could be operating print servers or file servers is also included here.
As additional mitigation for the exploit you might want to block the
incoming traffic to the SMB or EPMAP Ports (445) if you need to keep the
spooler service running to print from clients.
The following query surface network activity associated with exploitation of CVE-2022-22965.
This query provides the commonality of operating systems seen in the inventory
Detects HTTP GET requests for specific file paths associated with the RomCom threat actor, potentially exploiting CVE-2023-36884. These file paths include various file types such as .url, .search-ms, .vbs, .mht, and .asp, which are likely used for initial access or further stages of the attack.
