Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,917 detections
Filters
Last updated
All Time
Detection languages
2,237
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
806
765
576
Platforms
1,843
1,022
856
814
657
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,636
12,582
8,393
6,221
4,917
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Detects HTTP requests with URL patterns associated with various malicious Traffic Distribution Systems (TDS) as identified in the Infoblox report on VexTrio and related adtech cabals. These TDS are used to redirect users to malicious content, including scams and malware.
This query helps calculate overall efficacy of MDO based on threats blocked pre-delivery, post-delivery cleanups, or were uncaught.
KQL Query from file: Potential MFASweep (tool) activity has been detected.
Detects network connections to domains and IP addresses associated with the HelloTDS Traffic Direction System (TDS) infrastructure. This TDS is known for delivering FakeCaptcha, tech scams, and other malware by fingerprinting visitors and redirecting them to malicious landing pages.
Detects when a Global Administrator elevates access to all subscriptions and management groups in a tenant. When a Global Administrator elevates access they are assigned the User Access Administrator role at root scope. This Sentinel analytics rule monitors who has elevated access in your tenant so that admins can take appropriate action.
KQL Query
KQL Query from file: Hunting Exposed JDWP
This detection identifies when Microsoft Copilot Studio agents are created in your organization's tenant. This activity is significant as the default behavior in Copilot agent creation is to configure a new service principal with cloud app administrator role.
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
Generic rule content from file: LOLBAS - Execution - Outbound Traffic to Suspicious TLD
KQL Query from file: Direct Send Abuse Detection
Detects TTPs and IOC´s associated with a cryptomining campaign that exploits exposed Java Debug Wire Protocol (JDWP) services. Attackers gain remote code execution to download and execute a dropper script (`logservice.sh`), which in turn deploys a modified XMRig miner disguised as `logrotate`. The malware establishes persistence through multiple methods, including systemd services, cron jobs, and shell startup scripts.
Detects suspicious script download attempts initiated by a Java process, indicative of potential JDWP exploitation leading to Remote Code Execution (RCE). Attackers often leverage exposed JDWP interfaces to execute commands like downloading and running malicious scripts.
Detects exploitation attempts of CVE-2025-0108 via crafted path traversal requests targeting PAN-OS web management interface.
KQL Query
KQL Query
This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious .SVG file has been delivered into an Inbox.
KQL Query
Generic rule content from file: Initial Access - Probable Rogue ScreenConnect Session
KQL Query
KQL Query from file: Malicious NPM Package post install script
KQL Query from file: GraphRunner Recon Detection & Response
Page 172 of 235