Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
This rule detects the execution of suspicious file types (exe, dll, bat, cmd, vbs, js, ps1) originating from common extraction or user-writable locations like Downloads, Temp, or Roaming AppData directories. The rule specifically flags processes spawned by common archive utilities (winrar.exe, 7zFM.exe, 7zG.exe) or Windows Explorer, with an additional risk assessment if the command line arguments suggest recruitment or financial lure themes.
Detects execution of Azure Automation runbook jobs by managed identities that have recently been assigned high-privilege roles (Owner, Contributor, or User Access Administrator). This behavior is indicative of potential privilege escalation or abuse of existing high-privilege identities to execute unauthorized automation tasks.
This rule detects potentially compromised accounts by correlating successful device code authentication events that exhibit anomalous characteristics (such as first-time usage, high/medium risk scores, or non-compliant/unmanaged device status) with highly sensitive Azure AD/Graph API administrative operations occurring within 30 minutes of the sign-in.
Detects instances where npm or node processes execute potentially malicious scripts (such as 'tools/setup' or '.github/scripts/precheck') during the package installation lifecycle, specifically when operating within a 'node_modules' context. This is indicative of supply chain attacks where malicious actors inject code into project dependencies.
Detects execution of Azure Automation runbook jobs by managed identities that have recently been assigned high-privilege roles (Owner, Contributor, or User Access Administrator). This behavior is indicative of potential privilege escalation or abuse of existing high-privilege identities to execute unauthorized automation tasks.
Detects the execution of non-JavaScript ELF binaries (e.g., Rust-compiled binaries) from within npm package directories or specific setup paths, typically during 'preinstall' or 'postinstall' npm lifecycle hooks. This behavior is indicative of potential supply-chain attacks where malicious code is executed during dependency installation.
Detects behavior associated with the IronWorm threat, including Tor-based command and control communication by unsigned binaries or Node.js processes, unauthorized DNS resolution of .onion domains, automated npm package management operations by Node.js, and git configuration modifications attempting to impersonate common developer automation identities.
Commodity .NET keylogger and remote access trojan
Commodity .NET keylogger and remote access trojan
This rule detects potentially compromised accounts by correlating successful device code authentication events that exhibit anomalous characteristics (such as first-time usage, high/medium risk scores, or non-compliant/unmanaged device status) with highly sensitive Azure AD/Graph API administrative operations occurring within 30 minutes of the sign-in.
Detects Entra ID guest (B2B) users performing a sign-in from a previously unseen IP address or country (observed over the last 30 days), followed within a 4-hour window by sensitive file operations in SharePoint, OneDrive, or Teams (e.g., file downloads, exports, or sensitivity label changes). This pattern is indicative of potential account takeover or unauthorized access to sensitive corporate data.
Detects successful sign-ins using legacy authentication protocols (e.g., IMAP, POP3, SMTP AUTH, ROPC) for user accounts that are in scope of a Conditional Access policy requiring multi-factor authentication (MFA). Legacy protocols do not support modern authentication flows, effectively bypassing configured MFA requirements and increasing the risk of credential-based attacks.
Detects node.exe copying browser history files to temporary directories, associated with the protocal.cjs backdoor.
Detects instances where npm or node processes spawn child processes associated with common software supply chain attack patterns, specifically targeting 'preinstall' or setup lifecycle hooks as seen in IronWorm-like activity. The rule monitors for child processes executing in 'tools/setup', '.github/scripts/precheck', or within 'node_modules/.bin' directories while filtering out legitimate node-gyp build operations.
This rule monitors for suspicious child processes spawned by Node.js or npm-related processes (e.g., node, npm, node-gyp). It identifies potentially malicious activity such as shells, Python scripts, or custom scripts executing within the context of 'preinstall', 'postinstall', or 'binding.gyp' phases, which are common vectors for software supply chain compromises via malicious npm packages.
This rule detects the execution of RMM (Remote Monitoring and Management) installers (Atera or SimpleHelp) via msiexec.exe or setup.exe when launched from directories commonly used for downloads (Temp/Downloads) and originating from web browsers or Microsoft Office applications. This behavior is indicative of a potential drive-by download or phishing attack aimed at installing unauthorized remote access software.
Detects a sequence of events within a 30-minute window for a single user, specifically capturing MFA configuration changes (reset/enrollment), authentication, and device registration, occurring outside of typical business hours (20:00 - 06:00). This behavioral pattern is often indicative of an adversary establishing persistence or account takeover after gaining access to a valid account.
This rule detects authentication events for service accounts (matching patterns like 'svc', 'sa', 'service') originating from at least two different countries within a short time window (30 minutes or less), indicating potential credential compromise and anomalous geographic movement.
Detects potential supply chain attacks where a suspicious Python package is installed via 'pip' followed by execution of suspicious commands or network activity from 'python.exe' within a short timeframe. This rule correlates process creation events involving pip installations with subsequent suspicious command-line activity or external network connections from Python processes.
This rule monitors for inbound email messages containing SVG file attachments. SVG files can contain embedded scripts that may be leveraged for malicious purposes, such as SVG smuggling to deliver secondary payloads or perform credential harvesting.
Detects the execution of VS Code Tunnel processes (code-tunnel.exe or code.exe with tunnel arguments) initiated by processes other than standard development-related parent processes (e.g., explorer, terminal, IDEs). This behavior may indicate an adversary attempting to establish persistent unauthorized remote access to a compromised host using the VS Code Tunnel functionality.
Page 54 of 235