Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
536 detections
Filters
Last updated
All Time
Detection languages
304
112
24
22
22
Contributors
99
95
78
31
27
Categories
292
129
106
95
67
Platforms
445
61
45
34
21
Products / Services
212
86
43
43
27
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
3
2
1
1
1
IDS Classtypes
13
IDS Protocols
7
4
1
1
This rule monitors for scenarios where multiple common GUI applications (such as browsers, explorer, or notepad) are executed in rapid succession (within 2 minutes) from suspicious directories commonly associated with malware staging (e.g., Temp, AppData, or Downloads). This pattern is often indicative of an adversary executing a malicious payload, such as a multi-stage dropper or a file-based installer masquerading as legitimate software.
Detects instances of PowerShell being launched directly by explorer.exe with command-line arguments indicative of malicious activity, specifically the 'ClickFix' pattern where users are social-engineered to copy/paste malicious commands into the Windows Run dialog.
This rule detects suspicious file downloads initiated by common browsers from a specific remote domain ('reficon.pro') associated with '/vizio.com/'. It enriches this activity by checking for prior beaconing activity to 'stats.us3.org' (often used for Matomo analytics), which may indicate a multi-stage attack where an initial profiling beacon precedes a malicious payload download.
Correlates email delivery, URL click telemetry, endpoint network connections, and process execution evidence for one or more suspicious URLs or domains.
This query helps analysts identify who received an email containing a target URL, who clicked it, whether the URL was observed on managed endpoints, which devices were involved, and what processes initiated related network or command-line activity.
It is useful for phishing investigations, malicious URL exposure reviews, post-delivery impact checks, campaign scoping, and confirming whether a user interaction led to endpoint activity.
The query uses Microsoft Defender XDR advanced hunting tables including EmailUrlInfo, EmailEvents, UrlClickEvents, DeviceNetworkEvents, and DeviceProcessEvents. Microsoft documents UrlClickEvents as containing Safe Links click information from email messages, Teams, and Office apps, populated by Defender for Office 365.
This query helps analysts identify who received an email containing a target URL, who clicked it, whether the URL was observed on managed endpoints, which devices were involved, and what processes initiated related network or command-line activity.
It is useful for phishing investigations, malicious URL exposure reviews, post-delivery impact checks, campaign scoping, and confirming whether a user interaction led to endpoint activity.
The query uses Microsoft Defender XDR advanced hunting tables including EmailUrlInfo, EmailEvents, UrlClickEvents, DeviceNetworkEvents, and DeviceProcessEvents. Microsoft documents UrlClickEvents as containing Safe Links click information from email messages, Teams, and Office apps, populated by Defender for Office 365.
Detects a spoofed 'Installer wants to make changes' password prompt dispatched from an unsigned or ad-hoc-signed process, used by AmnesiaStealer to phish the victim's macOS login/keychain password.
Detects a browser-triggered 'Allow this website to open Script Editor?' permission prompt, the initial step AmnesiaStealer uses to enable AppleScript-based execution outside the browser sandbox.
Detects the execution of Windows processes where the file's web-origin metadata (Mark-of-the-Web) contains a referrer URL pointing to the public GitHub Desktop repository. This rule serves as a provenance and threat hunting signal to track the origin of binaries executed in the environment, identifying software potentially derived from this specific source repository.
Detects high-risk or uncategorized events involving the 'Isolate' action or Remote Browser Isolation (RBI) as logged by Microsoft Defender for Endpoint.
Detects high-risk or uncategorized events involving the 'Isolate' action or Remote Browser Isolation (RBI) as logged by Microsoft Defender for Endpoint.
Detection for reported campaign delivering a trojanized, non-digitally signed TrueConf client installer to users connecting to a compromised TrueConf server.
This rule detects potentially malicious child processes spawned by LOLBins (Living Off the Land Binaries) like mshta.exe, wscript.exe, cscript.exe, rundll32.exe, or regsvr32.exe, which were themselves initiated by document applications (e.g., Office, Acrobat) or common shell interpreters. It specifically identifies downstream payloads that are either unsigned or signed by non-trusted publishers, filtering out Microsoft and common third-party software signers.
This KQL identifies inbound emails that were not blocked and have subject lines commonly associated with phishing or social engineering lures along with a URL and/or attachment
Detects the creation of suspicious file types (.txt, .esd) within Windows Update (WSUS) content or download directories, specifically when initiated by standard Windows update-related processes (wuauclt.exe, TrustedInstaller.exe, or svchost.exe). This pattern may indicate an attempt to blend malicious activity with legitimate update mechanisms or an abuse of update file paths for payload delivery.
Detects the creation of suspicious file types (.txt, .esd) within Windows Update (WSUS) content or download directories, specifically when initiated by standard Windows update-related processes (wuauclt.exe, TrustedInstaller.exe, or svchost.exe). This pattern may indicate an attempt to blend malicious activity with legitimate update mechanisms or an abuse of update file paths for payload delivery.
Detects an inbound Microsoft Teams call or chat using a known STAC4749 helpdesk-impersonation persona display name, a caller UPN on a known STAC4749 .top IT-themed domain, or a source IP previously observed originating STAC4749 vishing calls.
Detects an inbound Microsoft Teams call or chat using a known STAC4749 helpdesk-impersonation persona display name, a caller UPN on a known STAC4749 .top IT-themed domain, or a source IP previously observed originating STAC4749 vishing calls.
Summarizes Zscaler NSSWeblog transactions where DeviceAction was Allowed but Zscaler still recorded a malware/threat verdict (ClickFix, MalURL, Trojan.Gen families), broken down by user, threat name, and malware category for triage.
Detects creation of a .lnk file on a removable/non-system drive letter (D: through Z:) whose launching process command line references mshta.exe, consistent with CountLoader's USB-worming propagation technique observed in the DOUBLECUP LaaS campaigns.
Detects a browser process (chrome.exe, msedge.exe, firefox.exe, brave.exe) writing a new, previously-unseen executable to a Downloads/Temp/Cache path and then launching that same executable within minutes — the terminal behavior of SourTrade's in-browser malware assembly pipeline, consistent with local execution of the JSCEAL (WeevilProxy) stealer payload.
Summarizes Zscaler NSSWeblog transactions where DeviceAction was Allowed but Zscaler still recorded a malware/threat verdict (ClickFix, MalURL, Trojan.Gen families), broken down by user, threat name, and malware category for triage.
Detects an inbound Microsoft Teams call or chat using a known STAC4749 helpdesk-impersonation persona display name, a caller UPN on a known STAC4749 .top IT-themed domain, or a source IP previously observed originating STAC4749 vishing calls.
Page 11 of 26