Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
22 detections
Filters
Last updated
All Time
Detection languages
13
3
3
2
1
Contributors
5
3
2
2
2
Categories
5
5
4
3
3
Platforms
12
7
4
2
1
Products / Services
7
3
3
2
1
MITRE Techniques
18,110
15,622
12,575
8,387
6,208
Detects a mail bombing pattern where a recipient receives a burst of inbound emails from many distinct senders within a short time window, followed by a Microsoft Teams message or chat creation from the same user context shortly after.
Detects the execution of known remote access and support tools on a host shortly after an email bombing or spam flood alert has been generated for the same user. This pattern is commonly associated with social engineering campaigns where attackers overwhelm a user's inbox to distract them while coercing them into running remote support software to 'resolve' the issue.
Detects the creation of an encryption scope within an Azure Storage account. Attackers may use this to encrypt victim blobs with their own keys, as observed with threat actors like STORM-0501, to demand ransom.
Detects Self-Service Password Reset (SSPR) activity followed by the deletion of authentication methods within a 1-hour window. This sequence of events can indicate an attacker attempting to maintain access or bypass multi-factor authentication after gaining initial access to an account, potentially executed by threat groups like Storm-2949.
Detects Quick Assist spawning command interpreters (cmd.exe, powershell.exe, pwsh.exe) that execute common discovery and reconnaissance commands. This pattern is associated with hands-on-keyboard activity, as documented in campaigns like Nimbus RAT, and broader kill chains used by groups such as Storm-1811, Black Basta affiliates, and 3AM ransomware operators. The rule specifically looks for commands like 'whoami', 'ipconfig', 'systeminfo', 'hostname', 'net time', 'net user', 'net group', 'net localgroup', 'net view', 'nltest', 'qwinsta', 'tasklist', 'arp', 'route', 'netstat', '/domain', 'dsquery', and 'gpresult'.
Storm-2561 Network IOC Detection
Cortex XDR
Detects outbound network connections from Windows endpoints to known Storm-2561 Command and Control (C2) infrastructure, including a specific C2 IP address and various domains used for credential exfiltration and initial access via spoofed VPN services.
Storm-2561 Malicious File Hash Detection
Cortex XDR
This rule detects the presence of malicious files associated with the Storm-2561 threat actor by matching their SHA-256 hashes. The rule specifically targets files on Windows operating systems and also filters for files signed by "Taiyuan Lihua Near Information Technology Co., Ltd.", which is known to be associated with these malicious activities. The detected files include ZIP archives, MSI installers, DLLs, and fake VPN executables.
Detects the creation of registry Run or RunOnce keys that point to executables mimicking popular VPN clients. This technique is used by threat actors like Storm-2561 to establish persistence for their malicious payloads, which are often fake VPN clients designed for credential theft. The rule specifically looks for these executables being run from non-standard locations, such as user profiles, instead of the legitimate 'Program Files' directory.
Detects when the legitimate SentinelAgentWorker.exe process loads 'SentinelAgentCore.dll' from a non-standard, user-writable directory like AppData\Roaming. This behavior is indicative of DLL sideloading (T1574.002), a technique used by threat actors like Storm-0249 to execute malicious code under a trusted process. The rule specifically checks for the SentinelOne agent process running from its expected installation path to increase fidelity.
Detects the execution of legitimate or dual-use tools commonly used by the CL-CRI-1040/Storm-2603 actor for post-exploitation activities like credential dumping, reconnaissance, and lateral movement. The rule attempts to reduce false positives by looking for execution from unusual paths or by suspicious parent processes.
Detects multiple TTPs associated with the exploitation of SharePoint ToolShell vulnerabilities (e.g., CVE-2025-53770) by the threat actor Storm-2603. This includes the initial exploit attempt, webshell creation, defense evasion using a vulnerable driver, and C2 communication.
Detects internal phishing emails with subject lines mimicking IT service notifications, such as from ServiceNow. This is a tactic used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539) for lateral movement within a compromised organization.
Detects changes to payment or bank account information in Workday. This activity is associated with 'payroll pirate' attacks by threat actor Storm-2657, who modify payroll details to divert salary payments after compromising an account.
Detects PowerShell being used to modify Group Policy Objects (GPOs) to disable Windows Defender security features. This technique is used by threat actors like Storm-2603 for defense evasion.
Detects a user password change synced from on-premises Active Directory, immediately followed by the same user registering a new MFA method. This sequence is highly suspicious for existing privileged accounts and was used by the threat actor Storm-0501 to compromise a Global Administrator account that previously lacked MFA.
Detects modifications to Group Policy Objects (GPOs) that enable script processing. Threat actors, such as Storm-2603, abuse GPOs to deploy ransomware (like Warlock) by adding malicious startup or logon scripts. This detection identifies when the "Group Policy Scripts" client-side extension is added to a GPO, which is a key step in this attack chain. This activity is logged under Event ID 5136 on Domain Controllers.
KQL Query from file: Detecting External Microsoft Teams Spray
KQL Query
KQL Query
KQL Query from file: Hunting Rockstar 2FA
KQL Query from file: One-Click ANY RUN Storm-1747 KQL Scan
Page 1 of 2