Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the creation of scheduled tasks using schtasks.exe or PowerShell that execute SysMon.py from the non-standard C:\Windows\SystemHealth\Update\ directory, or the corresponding scheduled task creation events.
Detects potential abuse of Tailscale SSH Unix socket forwarding where the tailscaled daemon touches sensitive files/sockets (such as docker.sock or /etc/shadow) or creates/replaces Unix sockets following an SSH session.
Detects a VS Code-family editor or extension host modifying ~/.ssh/authorized_keys, or shell commands appending the svc-telemetry label / embedded Ed25519 key, as used by the trojanized anthropic.claude-code extension.
Detects a VS Code-family editor or extension host modifying ~/.ssh/authorized_keys, or shell commands appending the svc-telemetry label / embedded Ed25519 key, as used by the trojanized anthropic.claude-code extension.
Detects a VS Code-family editor or extension host modifying ~/.ssh/authorized_keys, or shell commands appending the svc-telemetry label / embedded Ed25519 key, as used by the trojanized anthropic.claude-code extension.
Detects five or more Entra ID device registrations by a single account where device names match microsoft-* or WINDOWS-* patterns, occurring shortly after a device code flow sign-in by the same account. This behavior is indicative of device registration abuse or persistent access attempts.
Detects execution of GoldenDMSA hacktool used for Directory Service Account manipulation.
Browser sign-ins and MFA prompts with medium or high sign-in risk from devices that have no Entra device identity and are not managed or compliant. Hunting query, not an alert.
Correlates a high-risk or compromised Microsoft Entra sign-in event with a subsequent device registration (Add device or Register device) performed by the same user account within a 3-hour window.
Detects an executable running from the C:\Windows\ directory (excluding known benign applications) that establishes two or more distinct persistence mechanisms within a short timeframe, such as scheduled tasks, registry run keys, or startup folder shortcuts.
Detects potential persistence establishment where an AOMEI-related process writes a DLL file to disk, followed by the creation or modification of a Windows service pointing to that same DLL within a 15-minute window.
Detects a user account that performs a device code sign-in flow followed by the registration of five or more devices with deceptive names (matching patterns like microsoft- or windows-) within a one day timeframe. This behavior can indicate an adversary establishing persistence or attempting tenant resource exhaustion using compromised accounts.
Detects the creation of application-specific passwords followed by their initial use from unknown or new IP addresses using legacy authentication clients, which may indicate account compromise or persistence establishment.
Detects Azure AD service principal sign-ins utilizing suspicious scripting-related user agents such as curl, python-requests, Wget, or Postman, which may indicate automated scripting, custom tooling, or potential abuse of cloud service accounts.
Detects a potential app-only tenant-takeover sequence associated with Storm-3119 (YAM Store), where a single service principal performs an administrative password reset, a license assignment, and a privileged role grant within a one-hour window.
Detects non-interactive service principal sign-ins originating from an IP address and location never seen for that specific principal over a prior 30-day baseline period, approximating potential misuse of stolen cloud credentials exposed via environment variables.
Detects when a domain user account is renamed (Event ID 4781) where the old account name ends with a dollar sign (indicating a computer account) but the new name does not, or vice-versa, specifically checking if the new name matches a Domain Controller. This behavior can be indicative of account manipulation or exploitation attempts such as golden ticket or related attacks.
Detects the creation of a Windows scheduled task with the name or command containing 'WinRTCS' correlated with WMI permanent event subscription activities or execution of the 'own_lib.ps1' watchdog script within a 1-hour window on the same device, using Microsoft Defender XDR tables.
Detects when the same initiating process stops or deletes Windows services and subsequently deletes scheduled tasks or WMI event subscriptions within a 15-minute window on a single device, potentially indicating defense evasion or clean-up actions.
Detects virtualization management monitor (VMM) processes such as QEMU or Firecracker directly spawning an interactive shell, script interpreter, or network utility as the root user. This behavior is highly anomalous and may indicate a guest-to-host escape leading to remote code execution on the host.
Detects new client secrets or certificates added to any service principal in Azure AD, specifically identifying activities linked to the ConnectWise supply-chain attack or suspicious user agents.
Page 4 of 401