Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,917 detections
Filters
Last updated
All Time
Detection languages
2,237
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
806
765
576
Platforms
1,843
1,022
856
814
657
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,636
12,582
8,393
6,221
4,917
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
This detection identifies instances where the ESXi UI is accessed using the root account from an external IP address. Direct root access to the UI bypasses role-based access controls and auditing practices, and may indicate risky behavior, misconfiguration, or unauthorized activity by a malicious actor using compromised credentials.
Detects Microsoft Entra ID sign-in events where a user principal authenticates using a refresh token issued to the Microsoft Authentication Broker (MAB) client, targeting the Device Registration Service (DRS) with the "adrs_access" OAuth scope. This pattern may indicate token-based access to DRS following an initial authorization code phishing or as a precursor to malicious device registration using tools like ROADtx.
This detection looks for activity associated with the Redirection ad-jacking campaign. It detects network connections to known malicious C2 domains and the installation of malicious browser extensions identified by their extension IDs.
This detection identifies when a file is created or modified on a host within a short time window after a USB storage device was inserted. This behavior can be indicative of malware spreading via removable media, where a payload is automatically dropped onto the system.
This detection monitors for signs of a shared or potentially compromised root account on ESXi hosts by tracking the number of unique IP addresses logging in as root within a short time window. Multiple logins from different IPs in a brief period may indicate credential misuse, lateral movement, or account compromise.
This detection identifies when a user is granted the Administrator role on an ESXi host. Assigning elevated privileges is a critical action that can indicate potential malicious behavior if performed unexpectedly. Adversaries who gain access may use this to escalate privileges, maintain persistence, or disable security controls.
This rule detects potentially malicious sign-in attempts that occur shortly after a user clicks on a URL, especially when the sign-in originates from a different IP address or subnet than the URL click. It specifically looks for risky sign-ins to Microsoft first-party applications. The logic aims to identify scenarios where a user might be phished (e.g., via a malicious link) and then their credentials are used to sign in from an attacker-controlled location.
This rule detects attempts at Local File Inclusion (LFI) or Remote File Inclusion (RFI) vulnerabilities by analyzing web server logs for specific patterns in the request URI. It looks for directory traversal sequences ('../'), attempts to access common sensitive files like '/etc/passwd', or patterns indicating file inclusion via HTTP or file:// protocols.
This rule detects potential spearphishing attempts where the sender's email address is from Gmail, there are no attachments or URLs, and the subject line of the email matches the recipient's first name. This pattern is often used in highly targeted social engineering attacks to appear legitimate and bypass traditional email security controls.
This search will find all inbound emails with attachments with filenames ending .lnk, indicative of a Windows Shortcut file.
This has been observed in the Serpentin#Cloud campaign
This has been observed in the Serpentin#Cloud campaign
This package searches for evidence of Windows Shortcut (.lnk) files executing code to download a .wsf file from a remote WebDAV share hosted on a trycloudflare[.]com subdomain. This package searches in both web logs and endpoint process logs.
An ongoing malware campaign tracked as SERPENTINE#CLOUD has been identified as leveraging the Cloudflare Tunnel infrastructure and Python-based loaders to deliver memory-injected payloads through a chain of shortcut files and obfuscated scripts.
For initial access, the threat actors are luring users to execute malicious .lnk files (shortcut files) disguised as documents to silently fetch and execute remote code.
These payloads use cmd.exe to silently retrieve additional stages over WebDAV (via Cloudflare Tunnel subdomains) and invoke WSF or batch-based droppers.
trycloudflare[.]com allows a threat actor to expose a tunnel to the internet using legitimate infrastructure that will likely blend into benign traffic. trycloudflare dynamically generates subdomains formed of random words and so it's not enough to just look for such connections since they are also used by developers in testing. Therefore this search looks for further procedures attributed to the campaign.
An ongoing malware campaign tracked as SERPENTINE#CLOUD has been identified as leveraging the Cloudflare Tunnel infrastructure and Python-based loaders to deliver memory-injected payloads through a chain of shortcut files and obfuscated scripts.
For initial access, the threat actors are luring users to execute malicious .lnk files (shortcut files) disguised as documents to silently fetch and execute remote code.
These payloads use cmd.exe to silently retrieve additional stages over WebDAV (via Cloudflare Tunnel subdomains) and invoke WSF or batch-based droppers.
trycloudflare[.]com allows a threat actor to expose a tunnel to the internet using legitimate infrastructure that will likely blend into benign traffic. trycloudflare dynamically generates subdomains formed of random words and so it's not enough to just look for such connections since they are also used by developers in testing. Therefore this search looks for further procedures attributed to the campaign.
Detects HTTP POST requests containing suspicious parameters or headers used by GoldMelody's in-memory IIS modules. Attackers leverage ASP.NET ViewState deserialization to execute payloads in memory, often passing commands and data via non-standard HTTP parameters and headers within POST requests.
Detects the creation of files with suspicious file extensions in the temporary directory that Outlook uses when opening attachments.
This can be used to detect spear-phishing campaigns that use suspicious files as attachments, which may contain malicious code.
This can be used to detect spear-phishing campaigns that use suspicious files as attachments, which may contain malicious code.
Detects a sequence of events indicative of a new device being registered using a refresh token, a TTP associated with the ROADtools framework following an OAuth phishing attack. This sequence involves the Device Registration Service adding a device with a specific hardcoded OS version, followed by user and owner assignments, all within a short timeframe and sharing the same correlation ID.
This query visualises total emails with Spam detections summarizing the data by email sender IP address (SenderIPv4, SenderIPv6).
This rule detects emails containing a URL to a suspicious domain. It also checks if any of these suspicious URLs were subsequently clicked by a user, indicating potential compromise or successful phishing.
Detects network connections to domains matching patterns commonly used by the Scattered Spider threat group for phishing campaigns.
The group often registers domains that mimic legitimate corporate services by appending suffixes like "-sso", "-servicedesk", "-okta", "-vpn", or "-helpdesk" to a target's name (e.g., victim-sso.com).
The group often registers domains that mimic legitimate corporate services by appending suffixes like "-sso", "-servicedesk", "-okta", "-vpn", or "-helpdesk" to a target's name (e.g., victim-sso.com).
This rule detects phishing attempts that leverage Google redirect links. It identifies emails where the URL contains 'google.' and '/url?' and the URL domain is 'google', but the extracted domain is not 'com'. This indicates a potential malicious redirect through Google's services, often used to obscure the final malicious destination. The rule then joins this URL information with email event data to provide context such as sender, recipient, subject, and delivery location, focusing on emails delivered to the Inbox or Junk folder but not quarantined.
This rule detects attempts to phish user credentials by identifying Base64 encoded User Principal Names (UPNs) or their domains within URLs clicked by users. Adversaries often encode sensitive information like UPNs in malicious URLs to bypass security controls or to make the links appear less suspicious. The rule specifically looks for partial Base64 encoded strings of the user's UPN or domain within the 'UrlChain' field of URL click events.
Hunting query to monitor downloads through popular browsers
KQL Query from file: Threat Hunt: Potential Password Spray Attacks
Page 171 of 235