Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
64 detections
Filters
Last updated
All Time
Detection languages
38
15
6
2
1
Contributors
10
8
7
6
5
Categories
34
19
12
12
10
Platforms
54
11
7
3
1
Products / Services
15
9
8
6
6
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
1
IDS Protocols
1
Detects the GitLab Runner process (gitlab-runner-windows-amd64.exe) spawning PowerShell with command-line arguments indicative of a C2 framework or manual operator interaction, such as '-NoProfile', '-NonInteractive', '-ExecutionPolicy Bypass', and '-Command'. The rule specifically targets instances where these processes are executed under the SYSTEM account, a behavior commonly associated with exploiting CI/CD runners for persistent command execution.
Detects RemotePC RMM software (REMOTEPCSERVICE.EXE / RPCCMDHOST.EXE) spawning PowerShell with hidden window and IEX download cradle, consistent with Prinz Eugen ransomware group using RemotePC as a persistence and C2 channel.
Identifies dfsvc.exe bypassing DNS to check for manifest updates directly from raw external IP addresses. This behavior can indicate an attempt to evade network monitoring or connect to a hardcoded malicious update server.
Monitors dfsvc.exe making outbound connections to non-standard, external URLs, representing malicious auto-update polling.
Detects the automated installation of the malicious 'google-update-support' VSIX extension, which has been associated with the UNK_DeadDrop phishing campaign targeting developers.
Detects the creation of generic executable files (e.g., me.exe, update.exe, monitor.exe, service.exe) within the Hola browser installation path. This rule aims to identify potentially malicious executables delivered by a compromised updater or supply chain attack targeting Hola browser users. The rule also captures the principal process responsible for the file creation for correlation.
Detects the creation of a new deviceManagementScript or deviceShellScript object in Intune, indicating a PowerShell (Windows) or Shell (macOS/Linux) script has been uploaded to the Intune management platform. This is considered a high-fidelity indicator of script-based abuse as these scripts execute as SYSTEM on targeted endpoints and leave minimal forensic traces. The rule also identifies script creation initiated by service principals that might bypass human-UPN-based monitoring.
Detects malicious executables dropped to shared network folders
Detects the creation of generic executable files (e.g., me.exe, update.exe, monitor.exe, service.exe) within the Hola browser installation path. This rule aims to identify potentially malicious executables delivered by a compromised updater or supply chain attack targeting Hola browser users. The rule also captures the principal process responsible for the file creation for correlation.
This rule detects repeated execution of 'maven' or 'gradle' commands on a system within a one-hour window. A high count (5 or more) of these commands from the same account on the same computer within an hour could indicate unusual development activity, automated build processes, or potentially malicious activity related to software supply chain compromise or development environment abuse.
This rule detects an unusual number of file creations or modifications (5 or more within an hour) of executable (.exe) or dynamic link library (.dll) files within folders containing 'build' or 'release' in their path. This activity could indicate software deployment, compilation, or potentially malicious activity such as the staging of malicious executables or libraries.
This rule identifies suspicious activity within Microsoft Intune by focusing on sensitive operations, broad assignments, and actions performed by API actors (Service Principals) without an associated human User Principal Name (UPN). It specifically looks for operations like creating, adding, assigning, or updating DeviceManagementScripts, DeviceShellScripts, Win32LobApp, DeviceConfiguration, DeviceCompliancePolicy, EndpointSecurity, SecurityBaseline, ConfigurationPolicies, or GroupPolicyConfigurations. The rule also flags broad assignments targeting 'All Devices', 'All Users', 'allDevices', or 'allLicensedUsers'. The primary goal is to detect potential abuse of over-permissioned Graph API applications by attackers to bypass MFA and deploy malicious Mobile Device Management (MDM) commands or configurations.
Detects assignments of Intune objects (such as policies, scripts, or applications) to high-impact default groups like 'All Devices' or 'All Users'. Adversaries leverage these broad assignments to maximize the blast radius of malicious payloads or destructive wipe commands.
Detects process command lines executing an `_index.js` payload using the Bun runtime, which is characteristic of the Hades stealer's execution chain where a Python loader downloads Bun to execute an obfuscated JavaScript payload.
This rule detects a high frequency of process creations (Event ID 4688) with command-line arguments containing keywords indicative of software publishing or deployment, such as 'publish', 'deploy', 'artifact', or 'release'. A count of 3 or more such events within a one-hour window from the same computer and account is considered suspicious. This pattern could indicate legitimate CI/CD activities, but also potential abuse of software deployment tools or a software supply chain compromise by an adversary.
This rule detects a high frequency of process creations (Event ID 4688) with command-line arguments containing keywords indicative of software publishing or deployment, such as 'publish', 'deploy', 'artifact', or 'release'. A count of 3 or more such events within a one-hour window from the same computer and account is considered suspicious. This pattern could indicate legitimate CI/CD activities, but also potential abuse of software deployment tools or a software supply chain compromise by an adversary.
This rule detects an unusual number of file creations or modifications (5 or more within an hour) of executable (.exe) or dynamic link library (.dll) files within folders containing 'build' or 'release' in their path. This activity could indicate software deployment, compilation, or potentially malicious activity such as the staging of malicious executables or libraries.
This rule detects network connections to port 9090 on the home network. The rule is specifically tagged with MITRE ATT&CK technique T1072 (System Configuration Discovery) and mentions 'Ansible/Remote Deploy', suggesting it aims to identify potential remote management or deployment activities that might use this port. It triggers on TCP SYN packets (flags:S) and uses a threshold of 5 connections from the same source within 60 seconds to reduce noise.
This rule detects anomalous mass device wipe or deletion activity in Microsoft Intune by comparing current activity against an actor's historical behavior. It identifies four patterns: first-time wipers with high volume, known actors statistically far above their norm (Z-score), thin-history actors exceeding their personal peak, and time-compressed bursts of wipes. The rule calculates a severity based on the volume and rate of wipes.
Detects the usage of the Windows Package Manager (WinGet) to install the Deno runtime environment. Threat actors (e.g., the operators behind the DinDoor backdoor) abuse native package managers to silently install runtimes required for their payloads without triggering alerts.
This rule detects anomalous mass device wipe or deletion activity in Microsoft Intune by comparing current activity against an actor's historical behavior. It identifies four patterns: first-time wipers with high volume, known actors statistically far above their norm (Z-score), thin-history actors exceeding their personal peak, and time-compressed bursts of wipes. The rule calculates a severity based on the volume and rate of wipes.
Page 2 of 4