Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
175 detections
Filters
Last updated
All Time
Detection languages
81
61
8
7
5
Contributors
29
26
22
20
14
Categories
51
33
31
25
23
Platforms
149
16
12
5
2
Products / Services
51
39
14
13
12
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
2
1
1
IDS Classtypes
2
1
IDS Protocols
3
KQL Query
KQL Query from file: Monitor Azure API Secrets Extraction
KQL Query from file: Hunting fasthttp Bruteforce Campaign
KQL Query
KQL Query
KQL Query from file: OAuth app using the OD file picker permission
KQL Query from file: Sentinel All-In-One UPN ThreatHunt
KQL Query from file: Detecting EXO MS Graph Enumeration Attacks
KQL Query from file: glibc critical vulnerability (CVSS 9.8)
Detects suspicious mshta process execution patterns
Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec
'This detection identifies high-severity alerts across various Microsoft security products, including Microsoft Defender XDR and Microsoft Entra ID, and correlates them with instances of Google Cloud VM creation. It focuses on instances where VMs were created within a short timeframe of high-severity alerts, potentially indicating suspicious activity.'
Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Detects mshta loaded by wmiprvse as parent as used by TA505 malicious documents
Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec
Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Detects mshta loaded by wmiprvse as parent as used by TA505 malicious documents
Detects a named pipe used by Turla group samples
Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Detects a typical pattern of a CobaltStrike BOF which inject into other processes
This query looks for anomalies in mail item access events made by Graph API. It uses standard deviation to determine if the number of events is anomalous. The query returns all clientIDs where the amount of mail sent per day was larger than value given by the formula, 'average + STDThreshold(2.5)*(standard deviation)'.
See The MailItemsAccessed mailbox auditing action.
Reference - https://docs.microsoft.com/microsoft-365/compliance/mailitemsaccessed-forensics-investigations?view=o365-worldwide#the-mailitemsaccessed-mailbox-auditing-action
See The MailItemsAccessed mailbox auditing action.
Reference - https://docs.microsoft.com/microsoft-365/compliance/mailitemsaccessed-forensics-investigations?view=o365-worldwide#the-mailitemsaccessed-mailbox-auditing-action
Page 7 of 9