Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,132 detections
Filters
Last updated
All Time
Detection languages
761
532
431
179
94
Contributors
499
335
285
191
168
Categories
1,525
1,087
390
369
240
Platforms
934
681
611
142
99
Products / Services
552
383
359
337
293
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
2,132
CVEs
51
50
44
42
29
IDS Classtypes
320
140
29
13
5
IDS Protocols
454
34
13
5
4
'This query will dynamically identify Exchange servers using common web paths used by the application in the csUriStem. The query
will then collect MDE alerts from the SecurityAlert table using the identified Exchange Server hostnames.'
will then collect MDE alerts from the SecurityAlert table using the identified Exchange Server hostnames.'
Detects suspicious file type dropped by an Exchange component in IIS
'This query dynamically identifies Exchange servers and then looks for instances where the IIS worker process initiates a call out to a remote URL using either cmd.exe or powershell.exe.
This behaviour was described as post-compromise behaviour following exploitation of CVE-2022-41040 and CVE-2022-41082, this pattern of activity was use to download additional tools to the server. This suspicious activity is generic.'
This behaviour was described as post-compromise behaviour following exploitation of CVE-2022-41040 and CVE-2022-41082, this pattern of activity was use to download additional tools to the server. This suspicious activity is generic.'
'This query looks for Microsoft Defender for Endpoint detections related to the remote command execution attempts on Azure IR with Managed VNet or SHIR.
In Microsoft Sentinel, the SecurityAlerts table includes the name of the impacted device. Additionally, this query joins the DeviceInfo table to connect other information such as device group, IP address, signed in users, and others allowing analysts using Microsoft Sentinel to have more context related to the alert.
Reference: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29972 ,
https://msrc-blog.microsoft.com/2022/05/09/vulnerability-mitigated-in-the-third-party-data-connector-used-in-azure-synapse-pipelines-and-azure-data-factory-cve-2022-29972'
In Microsoft Sentinel, the SecurityAlerts table includes the name of the impacted device. Additionally, this query joins the DeviceInfo table to connect other information such as device group, IP address, signed in users, and others allowing analysts using Microsoft Sentinel to have more context related to the alert.
Reference: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29972 ,
https://msrc-blog.microsoft.com/2022/05/09/vulnerability-mitigated-in-the-third-party-data-connector-used-in-azure-synapse-pipelines-and-azure-data-factory-cve-2022-29972'
First query digs in print spooler drivers folder for any file creations,
MANY OF THE FILES THAT SHOULD COME UP HERE MAY BE LEGIT. Unsigned files
or ones that don't have any relations to printers that you are using are
suspicious.
Second query that can be used for finding client machines that
could be operating print servers or file servers is also included here.
As additional mitigation for the exploit you might want to block the
incoming traffic to the SMB or EPMAP Ports (445) if you need to keep the
spooler service running to print from clients.
MANY OF THE FILES THAT SHOULD COME UP HERE MAY BE LEGIT. Unsigned files
or ones that don't have any relations to printers that you are using are
suspicious.
Second query that can be used for finding client machines that
could be operating print servers or file servers is also included here.
As additional mitigation for the exploit you might want to block the
incoming traffic to the SMB or EPMAP Ports (445) if you need to keep the
spooler service running to print from clients.
Following the September 14th, 2021 release of three Elevation of Privilege (EoP) vulnerabilities (CVE-2021-38645, CVE-2021-38649, CVE-2021-38648) and one unauthenticated Remote Code Execution (RCE) vulnerability (CVE-2021-38647) in the Open Management Infrastructure (OMI) Framework.
This detection validates that any OMS-agent that is reporting to the Microsoft Sentinel workspace is updated with the patch. The detection will go over the heartbeats received from all agents over the last day and will create alert for those agents who are not updated.
This detection validates that any OMS-agent that is reporting to the Microsoft Sentinel workspace is updated with the patch. The detection will go over the heartbeats received from all agents over the last day and will create alert for those agents who are not updated.
Detects exploitation of DNS RCE bug reported in CVE-2020-1350 by the detection of suspicious sub process
Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability reported as CVE-2020-10189
'Identifies connection attempts (success or fail) from clients with very short or very long User Agent strings and with less than 100 connection attempts.'
Detects suspicious child processes spawned by the CrushFTP service that may indicate exploitation of remote code execution vulnerabilities such as
CVE-2025-31161, where attackers can achieve RCE through crafted HTTP requests.
The detection focuses on commonly abused Windows executables (like powershell.exe, cmd.exe etc.) that attackers typically use post-exploitation to execute malicious commands.
CVE-2025-31161, where attackers can achieve RCE through crafted HTTP requests.
The detection focuses on commonly abused Windows executables (like powershell.exe, cmd.exe etc.) that attackers typically use post-exploitation to execute malicious commands.
Detects exploitation of DNS RCE bug reported in CVE-2020-1350 by the detection of suspicious sub process
Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2021-26084
Microsoft has observed threat actors exploiting vulnerabilities associated with Log4J.
Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.
Detects file indicators of potential exploitation of MOVEit CVE-2023-34362.
Detects potential exploitation attempt of undocumented Windows Server Pre Auth Remote Code Execution (RCE)
Detects suspicious child processes spawned by the CrushFTP service that may indicate exploitation of remote code execution vulnerabilities such as
CVE-2025-31161, where attackers can achieve RCE through crafted HTTP requests.
The detection focuses on commonly abused Windows executables (like powershell.exe, cmd.exe etc.) that attackers typically use post-exploitation to execute malicious commands.
CVE-2025-31161, where attackers can achieve RCE through crafted HTTP requests.
The detection focuses on commonly abused Windows executables (like powershell.exe, cmd.exe etc.) that attackers typically use post-exploitation to execute malicious commands.
Detects potential exploitation attempt of CVE-2022-22954, a remote code execution vulnerability in VMware Workspace ONE Access and Identity Manager.
As reported by Morphisec, part of the attack chain, threat actors used PowerShell commands that executed as a child processes of the legitimate Tomcat "prunsrv.exe" process application.
As reported by Morphisec, part of the attack chain, threat actors used PowerShell commands that executed as a child processes of the legitimate Tomcat "prunsrv.exe" process application.
Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation
Detects suspicious processes including shells spawnd from WinRM host process
This query was originally published in the threat analytics report, Confluence and WebLogic abuse.
2019 has seen several seemingly related campaigns targeting Atlassian Confluence Server and Oracle WebLogic Server. Although these campaigns use different implants and delivery methods, they consistently use the same infrastructure, and exploit the same vulnerabilities.
The campaigns have specifically targeted:
1. CVE-2019-3396 - Software update
2. CVE-2019-2725 - Software update
The following query detects activity broadly associated with these campaigns.
2019 has seen several seemingly related campaigns targeting Atlassian Confluence Server and Oracle WebLogic Server. Although these campaigns use different implants and delivery methods, they consistently use the same infrastructure, and exploit the same vulnerabilities.
The campaigns have specifically targeted:
1. CVE-2019-3396 - Software update
2. CVE-2019-2725 - Software update
The following query detects activity broadly associated with these campaigns.
Page 89 of 102