Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
119 detections
Filters
Last updated
All Time
Detection languages
59
31
19
2
2
Contributors
20
16
12
11
10
Categories
57
54
14
14
11
Platforms
94
34
26
4
2
Products / Services
28
27
13
6
6
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
3
1
1
1
1
IDS Classtypes
1
1
IDS Protocols
1
1
This query identifies devices with specific versions of installed software that are considered vulnerable. It is a template that can be easily adapted to track any software by changing the placeholder variables. It enriches the findings with device and user information for easier investigation.
These YARA rules are designed to identify executables compiled with specific programming languages: Rust, Golang, and Nim. They achieve this by looking for unique strings, section names, and other artifacts left by the respective compilers and runtime environments within PE (Windows) and ELF (Linux) files. The rules are primarily for file identification and profiling, rather than detecting malicious behavior directly. They help in understanding the technology stack of an executable, which can be useful in malware analysis, threat intelligence, and software inventory.
On October 14, 2025, less than one month from now, Exchange Server 2016 and Exchange Server 2019 will reach end of support. It’s critical to upgrade now to remain supported and secure. This query check for all possible builds of Exchange Server 2016 and Exchange Server 2019.
This analytic identifies the execution of the PowerShell cmdlet `Get-WebGlobalModule`, which lists all IIS Modules installed on a system. It leverages PowerShell input data to detect this activity by capturing the module names and the image paths of the DLLs. This activity is significant for a SOC because it can indicate an attempt to enumerate installed IIS modules, which could be a precursor to exploiting vulnerabilities or misconfigurations. If confirmed malicious, this could allow an attacker to gain insights into the web server's configuration, potentially leading to further exploitation or privilege escalation.
Detects suspicious downloads or fetches of common privilege-escalation tools such as winPEAS, linPEAS, PowerUp, Seatbelt, SharpUp, WinPwn, PrivescCheck, Sherlock, Watson, BeRoot, LinEnum, LSE/LES, Linux Exploit Suggester, pspy, or GTFObins. These tools are often used by adversaries after initial access to enumerate the environment and attempt local privilege escalation.
This rule identifies devices that have software installed which has reached its End-Of-Support (EOS) status. This is crucial for identifying potential security vulnerabilities due to unpatched software and for maintaining compliance with organizational security policies. The rule summarizes the count of such software instances per device, along with the software name and its End-Of-Support date.
This rule identifies software installed on devices that has reached its End of Support (EOS) version. It provides details such as the device name, software name, vendor, version, EOS status, and EOS date, which is crucial for identifying potential security risks due to unpatched or unsupported software.
This rule identifies software installed on devices that is approaching its end-of-support (EOS) date. It queries the DeviceTvmSoftwareInventory table to find software with an 'Upcoming EOS Version' status, providing details such as device name, software name, vendor, version, EOS status, and EOS date. This can help in proactive patch management and identifying potential security risks associated with outdated software.
(no description)
KQL Query
Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
'Any Alerts that fired related to a given IpAddress during the range of +6h and -3d'
Detect Active Directory LDAP queries that try to find operating systems that are vulnerable to specific vulnerabilities
This LDAP query cover MetaSploit - enum_ad_computers tool
This LDAP query cover MetaSploit - enum_ad_computers tool
This query uncovers seen IPAddressV4 network subnets
StrRAT is a Java-based remote access tool which steals browser credentials, logs keystrokes and take remote control of infected systems. It also has a module to download additional payload onto to the infected machine based on C2 server command. Additionally, this threat also has a ransomware encryption/decryption module which appends .crimson extension.
Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.
Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.
Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.
Query #1 - Find the machines on which this file was seen.
TODO - set file hash to be a SHA1 hash of your choice...
TODO - set file hash to be a SHA1 hash of your choice...
Page 5 of 6