Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
55 detections
Filters
Last updated
All Time
Detection languages
25
20
3
2
2
Contributors
15
10
5
4
3
Categories
16
13
10
8
6
Platforms
44
4
3
2
2
Products / Services
15
11
9
7
6
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
2
1
1
1
1
IDS Classtypes
1
IDS Protocols
1
Detects non-browser processes that spawn the WebView2 process (msedgewebview2.exe) which subsequently makes network connections to known AI platforms like copilot.microsoft.com or grok.com. This behavior is indicative of malware using an embedded browser for covert Command and Control (C2) communications, as described by Check Point Research.
Detects EDR suspension attacks using WerFaultSecure.exe to freeze security agents via Windows Error Reporting service, creating detection blind spots for credential dumping or lateral movement
Detects when the Landlock Linux Security Module (LSM) denies an access request from a sandboxed application. This indicates that a process is attempting to perform an action that violates its predefined security policy, which can be a sign of misconfiguration or malicious activity such as exploitation.
KQL Query
This rule detects the creation of new files within the Microsoft Windows Defender program data folder. It specifically looks for file creation events where the initiating process is not a known, whitelisted Defender process. This behavior could indicate an attempt to tamper with or exploit Windows Defender, potentially to impair its defensive capabilities or to hide malicious activity.
Detection of unusual child processes (PowerShell or Command Prompt) spawned by critical system processes (winlogon.exe, services.exe, lsass.exe, csrss.exe, smss.exe, wininit.exe, spoolsv.exe, searchindexer.exe) running under an authorized user context. This behavior can indicate privilege escalation or defense evasion, especially if the spawned process is not related to legitimate network routing commands.
KQL Query from file: defendnot detection
KQL Query
Audit CVE Event
Sigma
Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.
'Identifies a match for SQL Injection attack in the Application gateway WAF logs. The Threshold value in the query can be changed as per your infrastructure's requirement.
References: https://owasp.org/Top10/A03_2021-Injection/'
References: https://owasp.org/Top10/A03_2021-Injection/'
This rule detects a suspicious crash of the Microsoft Malware Protection Engine
Query for Microsoft Defender Antivirus detections.
Query #1: Query for Antivirus detection events.
Query #1: Query for Antivirus detection events.
Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin privillege to be written and executed from.
This query will identify the Microsoft Defender Antivirus Engine version and Microsoft Defender Antivirus Security Intelligence version (and timestamp), Product update version (aka Platform Update version) as well as the Microsoft Defender Antivirus Mode on the endpoint (Active, Passive, etc.).
Query for Microsoft Defender Antivirus detections.
Query #1: Query for Antivirus detection events.
Query #1: Query for Antivirus detection events.
This rule detects a suspicious crash of the Microsoft Malware Protection Engine
Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin privillege to be written and executed from.
'Identifies if an AV scan fails in Azure App Services.'
This query shows the source of the AV detections (e.g., the website the file was downloaded from etc.).
Get the list of AV detections.
Get the list of AV detections.
This query searches for not onboarded devices with a specific Suffix
List alerts flagging attempts to delete backup files.
Page 2 of 3