Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Detects network connections, process executions, file creations, and image loads associated with the UNC7017 AOMEI supply chain campaign IOC sweep, including specific malicious URLs, domains, IPs, file paths, and hashes.
A privileged SAP account attempted logons across multiple systems or clients from a single source IP address within a 6-hour window, potentially indicating credential compromise or lateral movement.
The following analytic detects Zeek HTTP requests using methods outside a configurable allowlist of standard and commonly used HTTP methods.
Unusual methods can indicate protocol abuse, exploitation attempts, or command-and-control traffic.
Review the method, source, destination, and URI to assess the activity.
Unusual methods can indicate protocol abuse, exploitation attempts, or command-and-control traffic.
Review the method, source, destination, and URI to assess the activity.
Hunts for NetScaler Pitboss packet engine messages where the text after NSPPE carries shell syntax such as separators, command substitution or ${IFS}. Security vendors observed this pattern during exploitation of the NetScaler pre authentication command injection flaw patched in September 2026.
The query reads Syslog and CommonSecurityLog and decodes URL encoding. It checks only the text after NSPPE, so plain heartbeat lines without shell syntax do not match. The matching logic was checked on sample strings only, not on real appliance logs.
Triage: Check the source, the appliance version and whether it was patched at that time. A match on an unpatched appliance points to an exploitation attempt, not proof of success. Preserve logs and a snapshot before upgrading. Hunting query, not an alert.
Limitations: Needs NetScaler syslog forwarded to Sentinel. Empty results do not prove an appliance is clean. Attackers can remove traces and other techniques are not covered. Field names depend on the syslog format and connector. Bare separators and short words can match legitimate messages, so tune the regex after reviewing real results.
The query reads Syslog and CommonSecurityLog and decodes URL encoding. It checks only the text after NSPPE, so plain heartbeat lines without shell syntax do not match. The matching logic was checked on sample strings only, not on real appliance logs.
Triage: Check the source, the appliance version and whether it was patched at that time. A match on an unpatched appliance points to an exploitation attempt, not proof of success. Preserve logs and a snapshot before upgrading. Hunting query, not an alert.
Limitations: Needs NetScaler syslog forwarded to Sentinel. Empty results do not prove an appliance is clean. Attackers can remove traces and other techniques are not covered. Field names depend on the syslog format and connector. Bare separators and short words can match legitimate messages, so tune the regex after reviewing real results.
Behavioral hunt for accounts whose non-interactive sign-ins over 30 days are dominated (>=95%) by a single IP using a scripted client (python/aiohttp/httpx/urllib) with no browser. Scripted now requires BOTH no browser AND a scripted user agent, and Microsoft ASN egress is excluded.
Behavioral hunt for accounts whose non-interactive sign-ins over 30 days are dominated (>=95%) by a single IP using a scripted client (python/aiohttp/httpx/urllib) with no browser. Scripted now requires BOTH no browser AND a scripted user agent, and Microsoft ASN egress is excluded.
Detects the Mir0Auth phishing kit sequence within a single HTTP flow: POST /task_queue.cs beacon followed by POST /context.go device-code request, both with application/octet-stream bodies. Requires both requests (flowbits) and exact path endings to limit false positives. SIDs made unique.
Azure AD Device Code Flow Token Phishing
Cortex XDR
Detects potential device code phishing attacks by identifying OAuth token requests associated with the device code flow that originate from unmanaged or non-compliant devices. The rule specifically monitors for suspicious Cmsi (Client Managed Service Identity) activity or the use of unbound sign-in tokens within the device code flow for targeted Microsoft productivity and management applications.
Detects network, file, process, and email interactions associated with known IOCs related to Power BI phishing and rogue ScreenConnect campaigns over a 30-day lookback period.
Hunts for NetScaler Pitboss packet engine messages where the text after NSPPE carries shell syntax such as separators, command substitution or ${IFS}. Security vendors observed this pattern during exploitation of the NetScaler pre authentication command injection flaw patched in September 2026.
The query reads Syslog and CommonSecurityLog and decodes URL encoding. It checks only the text after NSPPE, so plain heartbeat lines without shell syntax do not match. The matching logic was checked on sample strings only, not on real appliance logs.
Triage: Check the source, the appliance version and whether it was patched at that time. A match on an unpatched appliance points to an exploitation attempt, not proof of success. Preserve logs and a snapshot before upgrading. Hunting query, not an alert.
Limitations: Needs NetScaler syslog forwarded to Sentinel. Empty results do not prove an appliance is clean. Attackers can remove traces and other techniques are not covered. Field names depend on the syslog format and connector. Bare separators and short words can match legitimate messages, so tune the regex after reviewing real results.
The query reads Syslog and CommonSecurityLog and decodes URL encoding. It checks only the text after NSPPE, so plain heartbeat lines without shell syntax do not match. The matching logic was checked on sample strings only, not on real appliance logs.
Triage: Check the source, the appliance version and whether it was patched at that time. A match on an unpatched appliance points to an exploitation attempt, not proof of success. Preserve logs and a snapshot before upgrading. Hunting query, not an alert.
Limitations: Needs NetScaler syslog forwarded to Sentinel. Empty results do not prove an appliance is clean. Attackers can remove traces and other techniques are not covered. Field names depend on the syslog format and connector. Bare separators and short words can match legitimate messages, so tune the regex after reviewing real results.
Behavioral hunt for accounts whose non-interactive sign-ins over 30 days are dominated (>=95%) by a single IP using a scripted client (python/aiohttp/httpx/urllib) with no browser. Scripted now requires BOTH no browser AND a scripted user agent, and Microsoft ASN egress is excluded.
Behavioral hunt for accounts whose non-interactive sign-ins over 30 days are dominated (>=95%) by a single IP using a scripted client (python/aiohttp/httpx/urllib) with no browser. Scripted now requires BOTH no browser AND a scripted user agent, and Microsoft ASN egress is excluded.
Correlates a delivered PDF attachment with the same user's browser visiting Mir0Auth C2-style paths within 4 hours. Restricted to browser processes and successful connections, excludes dev/code-hosting domains, and matches users by mailbox alias (DeviceInfo LoggedOnUsers holds UserName, not full email).
Correlates a delivered PDF attachment with the same user's browser visiting Mir0Auth C2-style paths within 4 hours. Restricted to browser processes and successful connections, excludes dev/code-hosting domains, and matches users by mailbox alias (DeviceInfo LoggedOnUsers holds UserName, not full email).
Detects the Mir0Auth phishing kit sequence within a single HTTP flow: POST /task_queue.cs beacon followed by POST /context.go device-code request, both with application/octet-stream bodies. Requires both requests (flowbits) and exact path endings to limit false positives. SIDs made unique.
Detects a successful device-code sign-in whose session is replayed successfully within 60 minutes from a different IP and ASN. Only successful replays count (interrupt codes removed) and Microsoft first-party ASN egress is excluded.
Lists accounts that still sign in successfully with Authenticated SMTP over the last 30 days. Microsoft plans to disable Basic auth for SMTP AUTH by default for existing tenants at the end of December 2026.
Rows come from SigninLogs and AADNonInteractiveUserSignInLogs, grouped per account with source IP count, apps and first and last seen.
Triage: Find the owner of each account, then move the sender to OAuth or a mail relay before the change. Inventory query, not an alert.
Limitations: Covers only sign-ins that reach the logs. Cross check with the Exchange admin center SMTP AUTH Clients Submission Report, which keeps 90 days.
Rows come from SigninLogs and AADNonInteractiveUserSignInLogs, grouped per account with source IP count, apps and first and last seen.
Triage: Find the owner of each account, then move the sender to OAuth or a mail relay before the change. Inventory query, not an alert.
Limitations: Covers only sign-ins that reach the logs. Cross check with the Exchange admin center SMTP AUTH Clients Submission Report, which keeps 90 days.
Lists accounts that still sign in successfully with Authenticated SMTP over the last 30 days. Microsoft plans to disable Basic auth for SMTP AUTH by default for existing tenants at the end of December 2026.
Rows come from SigninLogs and AADNonInteractiveUserSignInLogs, grouped per account with source IP count, apps and first and last seen.
Triage: Find the owner of each account, then move the sender to OAuth or a mail relay before the change. Inventory query, not an alert.
Limitations: Covers only sign-ins that reach the logs. Cross check with the Exchange admin center SMTP AUTH Clients Submission Report, which keeps 90 days.
Rows come from SigninLogs and AADNonInteractiveUserSignInLogs, grouped per account with source IP count, apps and first and last seen.
Triage: Find the owner of each account, then move the sender to OAuth or a mail relay before the change. Inventory query, not an alert.
Limitations: Covers only sign-ins that reach the logs. Cross check with the Exchange admin center SMTP AUTH Clients Submission Report, which keeps 90 days.
Sweeps Defender XDR telemetry for known NEBULA / KNTRAT indicators (SHA256 hashes, C2 IP, decoy domain and URLs, burner publisher emails). Hash matching is scoped per table (execution hash only in process events), noisy tooling is excluded from command-line matches, network hits are limited to connection events, and results are aggregated per device and IOC.
Detects an unauthenticated remote code execution attempt against AhsayCBS via the UpdateReceivers.do endpoint using the checkSysPwd parameter, associated with CVE-2026-105133 and CVE-2026-105134.
This rule detects when an SAP user generates audit records exceeding a configured hourly threshold (200 for high severity or 4000 for medium severity events) on their system. This behavior may indicate automated scanning, mass data extraction, or anomalous user activity within SAP environments.
Page 10 of 235