Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,660
12,605
8,416
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the execution of the CRPx0 ransomware Stage 2 stager DLL via rundll32.exe. The attack leverages ordinal-based invocation (exporting crypto globals rather than named functions) and masquerades the malicious DLL as a system file named 'WindowsUpdate.log'.
Detects the execution of base64 encoded PowerShell commands used by CRPx0 to stage a DLL payload, specifically saving it as 'WindowsUpdate.log' followed by the execution of that payload using rundll32.exe.
Detects the use of vulnerable kernel drivers, specifically TrueSight.sys and rentdrv2.sys, as part of a Bring Your Own Vulnerable Driver (BYOVD) technique. This activity, associated with DragonForce ransomware, involves registering or accessing these drivers and sending specific IOCTL codes (0x22E044 or 0x22E010) to terminate security software processes.
Detects the silent installation of remote monitoring and management (RMM) software using 'msiexec.exe' initiated by scripting engines (powershell.exe, wscript.exe, or cscript.exe). The rule targets installations occurring in user-writable directories, such as Temp or Downloads, which are common staging locations for malicious droppers, while excluding known legitimate software deployment paths.
Detects the silent installation of remote monitoring and management (RMM) software using 'msiexec.exe' initiated by scripting engines (powershell.exe, wscript.exe, or cscript.exe). The rule targets installations occurring in user-writable directories, such as Temp or Downloads, which are common staging locations for malicious droppers, while excluding known legitimate software deployment paths.
This rule detects instances where a process named 'wsc_updata.exe' executing from a Temp directory loads a library named 'wsc.dll'. This behavior is characteristic of DLL side-loading or DLL hijacking, where a malicious or potentially unwanted executable attempts to load a library from a user-writable directory to execute arbitrary code.
This rule detects email-based business fraud (BEC) targeting the organization, specifically looking for executive impersonation paired with financial lure terminology and sender domain mismatches. It utilizes both a blocklist of known fraudulent sender indicators (domains and addresses) and a heuristic approach analyzing discrepancies between the envelope sender domain and the header sender domain combined with executive titles in display names and invoice-related keywords.
Detects high-volume or multi-mailbox activity in Exchange Online, indicative of automated mailbox collection or unauthorized bulk data access via Graph or REST APIs. The rule monitors for a threshold of operations across multiple mailboxes or high event counts originating from specific API clients.
Detects potential lateral phishing attempts within Microsoft Teams by identifying a single user account sending messages containing common credential-harvesting lures (e.g., 'passkey', 'SSO', 'MFA', 'security update') to multiple internal recipients in a short timeframe.
This rule detects successful sign-in attempts to Azure AD (Entra ID) using the Device Code authentication protocol. Device Code flow allows users to sign in to input-constrained devices by using a browser on another device. While legitimate for smart TVs, IoT devices, or CLI tools, this flow is frequently abused by attackers to perform phishing or bypass MFA by tricking users into authorizing an application.
This rule aggregates Azure AD sign-in logs for a specific application, grouping by user principal name, IP address, location, and device ID. It provides a baseline view of user authentication patterns to identify unusual sign-in activity such as anomalous login locations or device usage.
This rule detects suspicious cloud user activity by identifying a single user account engaging in diverse, multi-stage actions (Authentication, MFA updates, Reconnaissance, and Exfiltration) originating from a high number of distinct source IP addresses. This behavioral pattern is indicative of a compromised account where an adversary is rotating IPs while performing a coordinated, multi-stage attack sequence.
This rule detects a suspicious Azure sign-in sequence, identified by error code 50074 (User failed MFA) followed by 50140 (This error occurred due to 'Keep me signed in' interrupt when the user was authenticating). This pattern is indicative of an Adversary-in-the-Middle (AiTM) phishing attack where the attacker is attempting to bypass MFA or manipulate session persistence after capturing initial credentials.
Detects sign-in activity to the 'Office Home' portal from an unmanaged, non-compliant device, followed by authentication to sensitive cloud services like SharePoint Online, OneDrive, or Microsoft Graph. This pattern often indicates a potential session hijacking or post-compromise activity where an attacker uses an unmanaged device to access enterprise data via cloud application discovery.
This rule identifies instances where a user successfully authenticates using a phone app OTP MFA method that was registered between 1 and 30 days prior. The rule specifically flags logins associated with potentially automated or non-browser user agents, or logins flagged with risk, suggesting potential account takeover or persistence mechanisms involving MFA re-registration.
Detects instances where the 'msedge.exe' binary is executed from the non-standard path 'C:\ProgramData\Microsoft\Windows\Telemetry\', excluding instances initiated by the legitimate Microsoft Edge Update process. This pattern often indicates masquerading, where an adversary places a malicious file with a legitimate name in an attempt to evade detection.
Detects instances where the 'msedge.exe' binary is executed from the non-standard path 'C:\ProgramData\Microsoft\Windows\Telemetry\', excluding instances initiated by the legitimate Microsoft Edge Update process. This pattern often indicates masquerading, where an adversary places a malicious file with a legitimate name in an attempt to evade detection.
Detects instances where the 'msedge.exe' binary is executed from the non-standard path 'C:\ProgramData\Microsoft\Windows\Telemetry\', excluding instances initiated by the legitimate Microsoft Edge Update process. This pattern often indicates masquerading, where an adversary places a malicious file with a legitimate name in an attempt to evade detection.
Detects the invocation of the undocumented ntdll function 'EtwpCreateEtwThread', which is used as an alternative to standard thread-creation APIs like CreateThread or CreateRemoteThread. This technique is often associated with advanced shellcode execution, such as MovieReaper, designed to evade common thread-creation monitoring sensors.
Detects the invocation of the undocumented ntdll function 'EtwpCreateEtwThread', which is used as an alternative to standard thread-creation APIs like CreateThread or CreateRemoteThread. This technique is often associated with advanced shellcode execution, such as MovieReaper, designed to evade common thread-creation monitoring sensors.
This rule detects the creation of specific system mutexes commonly used by malware for persistence or to avoid multiple infections (Mutual Exclusion). It monitors for both a specific hardcoded mutex and a pattern-based approach (15-20 alphanumeric characters) initiated by executables from common temporary or user-writable directories, which is a frequent indicator of malicious secondary payloads or droppers.
Page 135 of 864