Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
536 detections
Filters
Last updated
All Time
Detection languages
304
112
24
22
22
Contributors
99
95
78
31
27
Categories
292
129
106
95
67
Platforms
445
61
45
34
21
Products / Services
212
86
43
43
27
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
3
2
1
1
1
IDS Classtypes
13
IDS Protocols
7
4
1
1
Detects mshta.exe (or renamed instances) being spawned by winword.exe, a common technique used in phishing attacks.
KQL Query from file: M365 Copilot Gone Rouge
KQL Query from file: Exposure Management + Defender for Office 365
KQL Query
KQL Query
KQL Query
Detects suspicious process creation where a web browser spawns a command interpreter or scripting host. This behavior is indicative of the "FileFix" attack, where users are socially engineered to paste malicious commands into the File Explorer address bar opened by a browser's file upload functionality.
Detects suspicious process creation where a web browser spawns a command interpreter or scripting host. This behavior is indicative of the "FileFix" attack, where users are socially engineered to paste malicious commands into the File Explorer address bar opened by a browser's file upload functionality.
Detects potential malicious JavaScript obfuscated using the JSFireTruck technique, characterized by the repeated use of characters like [], (), !, and +. This rule looks for the presence of multiple distinct characters from the core JSFireTruck set within web response bodies.
Detects potential malicious JavaScript obfuscated using the JSFireTruck technique, specifically looking for the combination of core JSFireTruck characters and checks for document.referrer, often used to target traffic from search engines.
Detects potential malicious JavaScript obfuscated using the JSFireTruck technique, specifically looking for the combination of core JSFireTruck characters and checks for document.referrer, often used to target traffic from search engines.
Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL.
This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.
This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.
Detects DarkSide Ransomware and helpers
Detects static QMS 810 and mimikatz driver name used by Mimikatz as exploited in CVE-2021-1675 and CVE-2021-34527
In this query, we are looking for emails containing malware accessed on a unmanaged device
In this query, we hunt for inbound emails having URLs from QR codes and suspicious keywords in subject
Query for SmartScreen application blocks on files with "Malicious" reputation, where the user has decided to run the malware nontheless.
Read more about SmartScreen here: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.
Data availability: These events are available only on Windows 10 version 1703 and onwards.
Tags: #SmartScreen.
Read more about SmartScreen here: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.
Data availability: These events are available only on Windows 10 version 1703 and onwards.
Tags: #SmartScreen.
Detects possible execution via LNK file accessed on a WebDAV server.
This query will hunt for files matching the current abuse.ch recent threat feed based on Sha256. Currently the query is set up to analyze the last day worth of events, but this is configurable using the MaxAge variable.
Page 22 of 26