Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
38 detections
Filters
Last updated
All Time
Detection languages
17
7
4
4
3
Contributors
11
8
7
2
2
Categories
9
8
7
5
5
Platforms
12
11
7
5
4
Products / Services
6
5
4
3
3
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
1
1
IDS Classtypes
1
1
1
IDS Protocols
3
This rule detects attempts to query system geographic location information by monitoring HTTP requests to known IP lookup services such as ip-api.com, ipinfo.io, and freegeoip. The rule triggers an alert if five or more such requests are observed from the same source within a 30-second window, indicating potential reconnaissance or network scanning activity.
Detects attempts by the Grixba ransomware to query a specific custom locale registry key (en-US) for geofencing purposes. This activity is indicative of the ransomware checking the system's locale settings, potentially to avoid encrypting systems in certain geographical regions.
Detects Node.js processes querying public IP-address and geolocation lookup services. This automated reconnaissance behavior is the standard "where am I" primitive used by an enormous range of Node-based malware and supply chain campaigns including PhantomRaven (npm), Shai-Hulud, the Bitwarden CLI compromise, Ultralytics-style attacks, and countless commodity Node-based stealers and droppers. Legitimate Node applications rarely query public IP services from developer endpoints — when they do, it is most often during malicious package install lifecycle hooks or within fileless droppers fetched from attacker-controlled C2 servers.
This rule detects PowerShell commands that are used to enumerate locale-related system information. Specifically, it looks for PowerShell or pwsh.exe processes executing commands containing keywords like 'InstalledUICulture', 'Get-UICulture', 'CurrentUICulture', 'CurrentThread.CurrentUICulture', 'DefaultThreadCurrentUICulture', 'OSLanguage', or 'MUILanguages'. This activity can be indicative of an adversary attempting to gather system configuration details, potentially for environmental awareness or to tailor subsequent actions.
Detects command line executions from non-standard applications attempting to query the local Azure Arc metadata endpoints (ports 40341/40342), which may indicate an attacker enumerating or exploiting the HIMDS token service (CVE-2026-26117).
This rule detects network connection events and Entra ID sign-in events originating from Iran. It aggregates these events hourly to identify potential suspicious activity from a geo-restricted or high-risk country.
Detects attempts to query system information directly from the Windows Registry using 'reg.exe' or PowerShell cmdlets like 'Get-ItemPropertyValue' or 'gpv'. The rule specifically looks for queries related to time zone, network configuration, operating system details, installed programs, Windows Defender status, existing services, and scheduled tasks.
'Highlights accounts associated with multiple authentications from different geographical locations in a short period of time.'
'This query examines Microsoft Entra ID sign-ins and identifies anomalous changes in a user's location profile. A variation joins results back onto the original sign-in data to review the location set with each identified user in tabular form.'
'This query searches for successful user logins from different countries within 3 hours.
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimAuthentication)'
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimAuthentication)'
'This query over Microsoft Entra ID sign-in activity highlights Microsoft Entra ID apps with
an unusually high ratio of distinct geolocations versus total number of authentications'
an unusually high ratio of distinct geolocations versus total number of authentications'
Detects when there is a login attempt from a country that has not seen a successful login in the previous 14 days.
Threat actors may attempt to authenticate with credentials from compromised accounts - monitoring attempts from anomalous locations may help identify these attempts.
Authentication attempts should be investigated to ensure the activity was legitimate and if there is other similar activity.
Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-for-failed-unusual-sign-ins
Threat actors may attempt to authenticate with credentials from compromised accounts - monitoring attempts from anomalous locations may help identify these attempts.
Authentication attempts should be investigated to ensure the activity was legitimate and if there is other similar activity.
Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-for-failed-unusual-sign-ins
This rule identifies 'improbable travel' scenarios where a user successfully logs in from two geographically distant locations within a short time frame, suggesting potential account compromise or abuse, possibly related to Remote Employment Fraud (REF). It calculates the speed of travel required between consecutive login locations and flags events where the speed and distance exceed predefined thresholds. It also checks if the login country differs from the user's known work country.
'The alert shows users that join a Zoom meeting from a time zone other than the one the meeting was created in.
You can also whitelist known good time zones in the tz_whitelist value using the tz database name format https://en.wikipedia.org/wiki/List_of_tz_database_time_zones'
You can also whitelist known good time zones in the tz_whitelist value using the tz database name format https://en.wikipedia.org/wiki/List_of_tz_database_time_zones'
'This hunting query identifies users joining a meeting from a time zone that a user has not been observed from in the last 30 days.'
One of the challenges in making an AppLocker policy is knowing where applications
launch from. This query normalizes process launch paths through aliasing, then
counts the number of processes launched from that path, how many distinct machines it
was launched on, and how many distinct file names \ hashes these processes had. The
path is broken into subfolders to help simplify analysis.
launch from. This query normalizes process launch paths through aliasing, then
counts the number of processes launched from that path, how many distinct machines it
was launched on, and how many distinct file names \ hashes these processes had. The
path is broken into subfolders to help simplify analysis.
This rule detects the installation or modification of keyboard preload settings in the Windows Registry, specifically looking for suspicious keyboard layouts such as Persian (Iran) or Vietnamese. This activity is considered suspicious in environments where such layouts are not expected, particularly in systems maintained by US staff. The detection focuses on changes to the 'Keyboard Layout\Preload' and 'Keyboard Layout\Substitutes' registry keys.
Page 2 of 2