Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
292 detections
Filters
Last updated
All Time
Detection languages
131
68
27
24
14
Contributors
66
57
36
28
15
Categories
89
80
43
42
41
Platforms
103
90
45
42
29
Products / Services
69
46
31
25
25
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
10
8
5
5
5
IDS Classtypes
16
6
2
1
IDS Protocols
12
7
4
1
This detection identifies potential exploitation attempts of CVE-2025-5777 (CitrixBleed 2), a memory disclosure vulnerability in Citrix NetScaler ADC and Gateway. The vulnerability is triggered by sending POST requests with incomplete form data to the /p/u/doAuthentication.do endpoint, causing the device to leak memory contents including session tokens and authentication materials. This search looks for POST requests to the vulnerable endpoint that may indicate scanning or exploitation attempts.
KQL Query from file: Threat Hunt: Potential Password Spray Attacks
KQL Query from file: Hunting Exposed JDWP
Detects suspicious script download attempts initiated by a Java process, indicative of potential JDWP exploitation leading to Remote Code Execution (RCE). Attackers often leverage exposed JDWP interfaces to execute commands like downloading and running malicious scripts.
Generic rule content from file: Initial Access - Probable Rogue ScreenConnect Session
KQL Query
KQL Query from file: Detecting Commvault Exploitation in Azure
KQL Query from file: Threat Hunting - MDE Network Intrusion Discovery
KQL Query
KQL Query from file: CVE-2024-10443 Hunting: RISK:STATION
KQL Query
Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember".
Detects ScreenConnect program starts that establish a remote access to a system.
Detects an unexpected process spawning from dns.exe which may indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)
Running Chrome VPN Extensions via the Registry install 2 vpn extension
'Identifies a list of IP addresses with a minimum number (default of 5) of failed logon attempts to Microsoft Entra ID.
Uses that list to identify any successful remote logons to hosts from these IPs within the same timeframe.'
Uses that list to identify any successful remote logons to hosts from these IPs within the same timeframe.'
Running Chrome VPN Extensions via the Registry install 2 vpn extension
Detects the command line executed when TeamViewer starts a session started by a remote host.
Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.
Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.
Detects an unexpected file being modified by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)
'Azure AD Connect (AAD Connect) is a critical service that handles connections between on-premise Active Directory and Azure AD.
Due to the critical nature of AAD Connect threat actors may attempt to compromise the service in order to access credentials.
This query looks for SSH connections to host that appear to run AAD Connect. The results should be reviewed to determine if the
SSH connection is legitimate.'
Due to the critical nature of AAD Connect threat actors may attempt to compromise the service in order to access credentials.
This query looks for SSH connections to host that appear to run AAD Connect. The results should be reviewed to determine if the
SSH connection is legitimate.'
Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.
Page 13 of 14