Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
The following analytic identifies the abuse of Regsvr32.exe to proxy execution of malicious code, specifically detecting the loading of "scrobj.dll" by Regsvr32.exe. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events and command-line executions. This activity is significant because Regsvr32.exe is a trusted, signed Microsoft binary, often used in "Squiblydoo" attacks to bypass application control mechanisms. If confirmed malicious, this technique could allow an attacker to execute arbitrary code, potentially leading to system compromise and persistent access.
The following analytic detects the behavior of decoding base64-encoded data and passing it to a Linux shell. Additionally, it mitigates the potential damage and protects the organization's systems and data.The detection is made by searching for specific commands in the Splunk query, namely "base64 -d" and "base64 --decode", within the Endpoint.Processes data model. The analytic also includes a filter for Linux shells. The detection is important because it indicates the presence of malicious activity since Base64 encoding is commonly used to obfuscate malicious commands or payloads, and decoding it can be a step in running those commands. It suggests that an attacker is attempting to run malicious commands on a Linux system to gain unauthorized access, for data exfiltration, or perform other malicious actions.
The following analytic identifies the use of the 'kmod' process to list kernel modules on a Linux system. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. While listing kernel modules is not inherently malicious, it can be a precursor to loading unauthorized modules using 'insmod'. If confirmed malicious, this activity could allow an attacker to load kernel modules, potentially leading to privilege escalation, persistence, or other malicious actions within the system.
The following analytic detects the use of the EncodedCommand parameter in PowerShell processes.
It leverages Endpoint Detection and Response (EDR) data to identify variations of the EncodedCommand parameter, including shortened forms and different command switch types.
This activity can be significant because adversaries often use encoded commands to obfuscate malicious scripts, making detection harder.
If confirmed malicious, this behavior could allow attackers to execute hidden code, potentially leading to unauthorized access, privilege escalation, or persistent threats within the environment.
Review parallel events to determine legitimacy and tune based on known administrative scripts.
It leverages Endpoint Detection and Response (EDR) data to identify variations of the EncodedCommand parameter, including shortened forms and different command switch types.
This activity can be significant because adversaries often use encoded commands to obfuscate malicious scripts, making detection harder.
If confirmed malicious, this behavior could allow attackers to execute hidden code, potentially leading to unauthorized access, privilege escalation, or persistent threats within the environment.
Review parallel events to determine legitimacy and tune based on known administrative scripts.
The following analytic identifies the usage of microsoft.workflow.compiler.exe, a rarely utilized executable typically found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution telemetry. The significance of this activity lies in its uncommon usage, which may indicate malicious intent such as code execution or persistence mechanisms. If confirmed malicious, an attacker could leverage this process to execute arbitrary code, potentially leading to unauthorized access or further compromise of the system.
The following analytic identifies the execution of rundll32.exe with the DLL function names "Start" and "StartW," commonly associated with Cobalt Strike payloads. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process metadata. This activity is significant as it often indicates the presence of malicious payloads, such as Cobalt Strike, which can lead to unauthorized code execution. If confirmed malicious, this activity could allow attackers to inject shellcode, escalate privileges, and maintain persistence within the environment.
The following analytic detects the use of msiexec.exe with an HTTP or
HTTPS URL in the command line, indicating a remote file download attempt. This detection
leverages data from Endpoint Detection and Response (EDR) agents, focusing on process
execution logs that include command-line details. This activity is significant as
it may indicate an attempt to download and execute potentially malicious software
from a remote server. If confirmed malicious, this could lead to unauthorized code
execution, system compromise, or further malware deployment within the network.
HTTPS URL in the command line, indicating a remote file download attempt. This detection
leverages data from Endpoint Detection and Response (EDR) agents, focusing on process
execution logs that include command-line details. This activity is significant as
it may indicate an attempt to download and execute potentially malicious software
from a remote server. If confirmed malicious, this could lead to unauthorized code
execution, system compromise, or further malware deployment within the network.
The following analytic identifies a suspicious `explorer.exe` process with the `/root` command-line parameter. This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process and command-line data. The presence of `/root` in `explorer.exe` is significant as it may indicate parent process spoofing, a technique used by malware to evade detection. If confirmed malicious, this activity could allow an attacker to operate undetected, potentially leading to unauthorized access, privilege escalation, or persistent threats within the environment.
The following analytic identifies the creation of a .crmlog file within the %windows%\Registration directory, typically with a format of <RANDOM_GUID>.<RANDOM_GUID>.crmlog. This detection leverages the Endpoint.Filesystem datamodel to monitor file creation events in the specified directory. This activity is significant as it is associated with the Snake malware, which uses this file for its operations. If confirmed malicious, this could indicate the presence of Snake malware, leading to potential data exfiltration, system compromise, and further malicious activities. Immediate investigation is required to mitigate the threat.
The following analytic detects the use of the decompile parameter with the HTML Help application (HH.exe). This behavior is identified through Endpoint Detection and Response (EDR) telemetry, focusing on command-line executions involving the decompile parameter. This activity is significant because it is an uncommon command and has been associated with APT41 campaigns, where it was used to unpack HTML help files for further malicious actions. If confirmed malicious, this technique could allow attackers to execute arbitrary commands, potentially leading to further compromise and persistence within the environment.
The following analytic detects the execution of Syncappvpublishingserver.vbs via wscript.exe or cscript.exe, which may indicate an attempt to download remote files or perform privilege escalation. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. Monitoring this activity is crucial as it can signify malicious use of a native Windows script for unauthorized actions. If confirmed malicious, this behavior could lead to unauthorized file downloads or elevated privileges, posing a significant security risk.
Detects obfuscated shell command execution on VMware ESXi as hunted by CrowdStrike, where attackers hide esxcli commands (e.g. syslog config reset for log evasion, vm process list for recon) behind decode-and-execute wrappers such as printf hex/octal escapes, awk BEGIN blocks (chr/ord/xor/zero-width-unicode/morse/binary decoders), python -c chr() reconstruction, sed/od character-reversal ciphers, and $TERM/$SHELL substring reassembly, frequently invoking /usr/lib/vmware/busybox/bin/busybox or staging output in hidden /vmfs/volumes//.sys files before piping the reconstructed command into sh.
This is a living-off-the-land technique used to evade detection and hinder forensic reconstruction of attacker activity on ESXi hosts, and has been observed enabling syslog exfil-log evasion and VM/hypervisor reconnaissance.
This is a living-off-the-land technique used to evade detection and hinder forensic reconstruction of attacker activity on ESXi hosts, and has been observed enabling syslog exfil-log evasion and VM/hypervisor reconnaissance.
Detects a Chrome/Edge WebDriver process launched with headless and
automation-hiding command-line flags (--headless combined with --disable-infobars
or excludeSwitches enable-automation/test-type). Astaroth's spambot component uses
this exact flag combination to drive a hidden browser instance against an active
WhatsApp Web session, sending spam to every Brazil-based contact without ever
displaying a window to the victim.
automation-hiding command-line flags (--headless combined with --disable-infobars
or excludeSwitches enable-automation/test-type). Astaroth's spambot component uses
this exact flag combination to drive a hidden browser instance against an active
WhatsApp Web session, sending spam to every Brazil-based contact without ever
displaying a window to the victim.
This rule monitors Entra ID Sign-in logs for authentication events flagged by risk detections related to anonymizing infrastructure, such as VPNs, TOR exit nodes, or proxies. It identifies successful logins and aggregate sign-in volume from these IP addresses, flagging successful logins as critical due to the potential for valid account abuse through multi-hop proxy chains.
This rule monitors Entra ID Sign-in logs for authentication events flagged by risk detections related to anonymizing infrastructure, such as VPNs, TOR exit nodes, or proxies. It identifies successful logins and aggregate sign-in volume from these IP addresses, flagging successful logins as critical due to the potential for valid account abuse through multi-hop proxy chains.
Detects outbound network traffic matching XMRig Monero cryptocurrency miner stratum login behavior originating from an internal host.
Detects outbound network traffic matching XMRig Monero cryptocurrency miner stratum login behavior originating from an internal host.
Detects outbound network traffic matching XMRig Monero cryptocurrency miner stratum login behavior originating from an internal host.
Builds a per-account baseline of the devices that each enabled service account has made a successful network logon to over the previous 30 days, then alerts when one makes a successful network logon to a device outside that baseline within the latest window.
Service accounts are identified from IdentityInfo using each account’s most recent recorded type and enabled status, and are matched to logon events by their on-premises SID, so local accounts or accounts in other domains that share the same name are not mistaken for them. Accounts with no logon history in the baseline period are still evaluated, so a dormant service account that suddenly begins making network logons will alert on every device it reaches.
Service accounts tend to touch a small, fixed set of hosts, so a per-entity first-seen check is a strong lateral movement signal with less noise than the same logic applied to users.
Each result is enriched with the number of times the destination device’s sensor reporting restarted during the alert window, along with the times of those restarts in UTC, as restarts close to the new logons often indicate maintenance activity such as patching, although they should prompt a check to confirm rather than closure of the alert.
The rule runs every 24 hours, as this is the only Defender custom detection frequency with a 30-day lookback, and the alert window covers the last 25 hours so that a slightly delayed run does not leave a gap.
The baseline and alert windows are separated by ingestion time rather than event time, so events that arrive late are still evaluated.
Service accounts are identified from IdentityInfo using each account’s most recent recorded type and enabled status, and are matched to logon events by their on-premises SID, so local accounts or accounts in other domains that share the same name are not mistaken for them. Accounts with no logon history in the baseline period are still evaluated, so a dormant service account that suddenly begins making network logons will alert on every device it reaches.
Service accounts tend to touch a small, fixed set of hosts, so a per-entity first-seen check is a strong lateral movement signal with less noise than the same logic applied to users.
Each result is enriched with the number of times the destination device’s sensor reporting restarted during the alert window, along with the times of those restarts in UTC, as restarts close to the new logons often indicate maintenance activity such as patching, although they should prompt a check to confirm rather than closure of the alert.
The rule runs every 24 hours, as this is the only Defender custom detection frequency with a 30-day lookback, and the alert window covers the last 25 hours so that a slightly delayed run does not leave a gap.
The baseline and alert windows are separated by ingestion time rather than event time, so events that arrive late are still evaluated.
The following analytic identifies a Python process being executed where it's process name does not match
it's original file name attribute. Processes that have been renamed and executed may be an indicator that
an adversary is attempting to evade defenses or execute malicious code.
it's original file name attribute. Processes that have been renamed and executed may be an indicator that
an adversary is attempting to evade defenses or execute malicious code.
Detects HTTP traffic associated with the Wazza phishing kit anti-bot mechanism, including token minting requests, signed token responses, and validation checks.
Page 12 of 864