Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Hunts for sqlservr.exe spawning command shells or system utilities, a pattern consistent with xp_cmdshell abuse. It also flags later steps from a public intrusion write-up: certutil decoding, SAM, SYSTEM or SECURITY hive saves and local account or group changes.
Results are grouped per device and day and ranked by stage count. Rows can also appear without a SQL parent when two later stages occur on the same device and day.
Triage: Some jobs use xp_cmdshell legitimately. Review the command line and the account. Hunting query, not an alert.
Limitations: Activity inside the SQL process with no child process is not visible. Renamed tools, obfuscation and privilege escalation tools are not covered. Needs Defender for Endpoint on the SQL servers.
Results are grouped per device and day and ranked by stage count. Rows can also appear without a SQL parent when two later stages occur on the same device and day.
Triage: Some jobs use xp_cmdshell legitimately. Review the command line and the account. Hunting query, not an alert.
Limitations: Activity inside the SQL process with no child process is not visible. Renamed tools, obfuscation and privilege escalation tools are not covered. Needs Defender for Endpoint on the SQL servers.
Behavioral hunt for accounts whose non-interactive sign-ins over 30 days are dominated (>=95%) by a single IP using a scripted client (python/aiohttp/httpx/urllib) with no browser. Scripted now requires BOTH no browser AND a scripted user agent, and Microsoft ASN egress is excluded.
Detects a successful device-code sign-in whose session is replayed successfully within 60 minutes from a different IP and ASN. Only successful replays count (interrupt codes removed) and Microsoft first-party ASN egress is excluded.
Detects a process other than XBootMgr.exe spawned by XBootMgrSleep.exe.
XBootMgrSleep.exe is a Microsoft-signed Windows Performance Toolkit binary that can execute an arbitrary executable after a delay.
XBootMgrSleep.exe is a Microsoft-signed Windows Performance Toolkit binary that can execute an arbitrary executable after a delay.
Detects obfuscated PowerShell scripts that enumerate Microsoft.PowerShell.Utility exported commands
and invoke cmdlets indirectly by array index. This can be used to evade detections
that look for explicit strings such as Invoke-RestMethod or Invoke-Expression.
and invoke cmdlets indirectly by array index. This can be used to evade detections
that look for explicit strings such as Invoke-RestMethod or Invoke-Expression.
Detects payload staging activity associated with threat actor UAC-0099, correlating the creation or modification of executable/DLL files in disguised LocalAppData directories with decoy images or library configuration files within a one-hour window.
Detects the usage of command-line flags in AI coding assistant CLIs (such as Claude Code, Amazon Q CLI, and others) that intentionally skip security permissions, bypass approvals, or disable sandbox protections. The rule identifies potential developer activity that may inadvertently reduce the security posture of the development environment.
Detects a setx.exe process launched by python.exe or pip.exe with a command line referencing the PYTHONPATH environment variable. This matches setup.py build-time tampering that persistently rewrites the user's PYTHONPATH, redirecting future module resolution for the affected user to an attacker-controlled directory across all subsequent Python invocations.
Detects agentic AI jailbreak attempts that try to establish persistent control over M365 Copilot through rule injection, universal triggers, response automation, system overrides, and persona establishment techniques. The detection analyzes the PromptText field for keywords like "from now on," "always respond," "ignore previous," "new rule," "override," and role-playing commands (e.g., "act as," "you are now") that attempt to inject persistent instructions. The search computes risk by counting distinct jailbreak indicators per user session, flagging coordinated manipulation attempts.
Lists accounts that still sign in successfully with Authenticated SMTP over the last 30 days. Microsoft plans to disable Basic auth for SMTP AUTH by default for existing tenants at the end of December 2026.
Rows come from SigninLogs and AADNonInteractiveUserSignInLogs, grouped per account with source IP count, apps and first and last seen.
Triage: Find the owner of each account, then move the sender to OAuth or a mail relay before the change. Inventory query, not an alert.
Limitations: Covers only sign-ins that reach the logs. Cross check with the Exchange admin center SMTP AUTH Clients Submission Report, which keeps 90 days.
Rows come from SigninLogs and AADNonInteractiveUserSignInLogs, grouped per account with source IP count, apps and first and last seen.
Triage: Find the owner of each account, then move the sender to OAuth or a mail relay before the change. Inventory query, not an alert.
Limitations: Covers only sign-ins that reach the logs. Cross check with the Exchange admin center SMTP AUTH Clients Submission Report, which keeps 90 days.
This rule detects a classic port knocking sequence followed by a connection to sensitive services (SSH, Telnet, RDP, VNC, WinRM). The rule identifies devices performing rapid connections to multiple different ports within a short window, which is indicative of a port knocking attempt used to trigger service exposure, followed by an immediate attempt to connect to that exposed service.
The following analytic identifies potential DLL search order hijacking or DLL sideloading by detecting known Windows libraries loaded from non-standard directories. It leverages Sysmon EventCode 7 to monitor DLL loads and cross-references them with a lookup of known hijackable libraries. This activity is significant as it may indicate an attempt to execute malicious code by exploiting DLL search order vulnerabilities. If confirmed malicious, this could allow attackers to gain code execution, escalate privileges, or maintain persistence within the environment.
The following analytic identifies the use of protocol handlers executed via the command line. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. This activity is significant because protocol handlers can be exploited to execute arbitrary commands or launch applications, potentially leading to unauthorized actions. If confirmed malicious, an attacker could use this technique to gain code execution, escalate privileges, or maintain persistence within the environment, posing a significant security risk.
The following analytic detects the use of Microsoft HTML Application Host (mshta.exe) to make remote HTTP or HTTPS connections. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line arguments containing URLs. This activity is significant because adversaries often use mshta.exe to download and execute remote .hta files, bypassing security controls. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further network infiltration.
Detects usage of expand.exe to extract Microsoft Cabinet (CAB) archives, with
emphasis on extractions into `C:\\ProgramData` or similar staging locations. In
recent APT37 activity, a CAB payload (e.g., wonder.cab) was expanded into
ProgramData prior to persistence and execution. This behavior is a strong signal
for ingress tool transfer and staging of payloads.
emphasis on extractions into `C:\\ProgramData` or similar staging locations. In
recent APT37 activity, a CAB payload (e.g., wonder.cab) was expanded into
ProgramData prior to persistence and execution. This behavior is a strong signal
for ingress tool transfer and staging of payloads.
This analytic detects the usage of the Azure CLI to interact with user accounts such as creating or deleting a user.
Adversaries create new users so that their malicious activity does not interrupt the normal functions of the compromised users and can remain undetected.
While legitimate administrative use is expected, anomalous execution patterns, unexpected users, or unusual parent processes should be treated as potential indicators of compromise and investigated promptly.
Adversaries create new users so that their malicious activity does not interrupt the normal functions of the compromised users and can remain undetected.
While legitimate administrative use is expected, anomalous execution patterns, unexpected users, or unusual parent processes should be treated as potential indicators of compromise and investigated promptly.
The following analytic detects modifications to the BootExecute registry key, which manages applications and services executed during system boot. It leverages data from the Endpoint.Registry data model, focusing on changes to the registry path "HKLM\\System\\CurrentControlSet\\Control\\Session Manager\\BootExecute". This activity is significant because unauthorized changes to this key can indicate attempts to achieve persistence, load malicious code, or tamper with the boot process. If confirmed malicious, this could allow an attacker to maintain persistence, execute arbitrary code at boot, or disrupt system operations.
The following analytic identifies a LOLBAS process being executed where it's process name does not match it's original file name attribute.
Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code.
The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code.
Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code.
The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code.
This rule detects when an SAP user generates audit records exceeding a configured hourly threshold (200 for high severity or 4000 for medium severity events) on their system. This behavior may indicate automated scanning, mass data extraction, or anomalous user activity within SAP environments.
Detects users authenticating to SAP via Dialog Logons from IP addresses that are outside of approved network ranges and RFC1918 internal networks, potentially indicating unauthorized or external access.
The SAP FTP server allowlist was empty or populated with wildcard entries
Page 10 of 864