Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects installation of password filter DLLs to intercept plaintext passwords
Detects exploitation of application vulnerabilities for denial of service
This rule detects potential 'impossible travel' scenarios within Azure AD sign-in logs. It identifies users who successfully sign in to Office 365 from two geographically distant IP addresses within a one-hour window, suggesting a potential compromise or an attempt to bypass security controls.
Detects mshta.exe executing HTA applications for LOLBin proxy execution
Detects modification of Group Policy Objects for privilege escalation
This rule detects attempts to bypass the Mark-of-the-Web (MOTW) security feature by removing or altering the Zone.Identifier stream from downloaded files. Specifically, it looks for HTTP traffic (flow:to_client,established) containing both 'Zone.Identifier' and 'ZoneId=3' (which typically indicates an internet zone download) in the file data, suggesting an attempt to strip this metadata during transit to prevent security warnings or restrictions on the client side. This technique is often used by attackers to make malicious files appear less suspicious.
This rule detects attempts to obfuscate PowerShell commands by looking for the 'IEX' (Invoke-Expression) command combined with '(New-Object' within the HTTP URI. This combination is often used by attackers to execute malicious PowerShell scripts downloaded from a remote source, while attempting to evade detection through obfuscation.
Detects removal of Zone.Identifier ADS to bypass MOTW security prompts
This rule detects the delivery of a payload via HTTP that contains junk code padding and appears to be an executable file. Specifically, it looks for the byte sequence '90 90 90 90 90 90 90 90 90 90' (often used as NOPs for padding or obfuscation) followed by the 'MZ' magic bytes at the beginning of a file (indicating a Windows executable). The detection is triggered on HTTP responses flowing to the client.
This rule detects the delivery of a polymorphic engine payload via HTTP. It looks for specific content within the HTTP response body, including the strings "mutate" and "engine" (case-insensitive), and the "MZ" magic bytes at the beginning of the file data, indicating a Windows executable. This combination suggests the download of a polymorphic malware component designed to evade detection.
Detects addition of AV exclusion paths to hide malicious files from scanning
Detects when the same SessionId is used to sign in from more than one location across interactive and non-interactive sign-ins.
This rule detects attempts to clear network connection history by deleting the wtmp log file via an SSH connection. The rule specifically looks for the command 'rm -rf /var/log/wtmp' being sent over TCP port 22 (SSH). This activity is often associated with defense evasion tactics used by attackers to remove forensic evidence.
This rule detects the presence of the string "ReflectiveLoader" in HTTP response bodies, which is indicative of a Reflective DLL Loading payload. Reflective DLL loading is a technique used by attackers to load a DLL into a process without the need for the DLL to be present on disk, often used for defense evasion.
Detects suspicious modifications to Registry Run and RunOnce keys that include common scripting or command execution keywords (powershell, cmd, .bat). This activity is often associated with persistence mechanisms where adversaries attempt to execute malicious code upon user login.
This rule detects suspicious command-line activity indicative of potential token impersonation or theft. It specifically looks for the keywords 'token' or 'impersonate' within process creation command lines (EventID 4688) and triggers an alert if these keywords appear 3 or more times within an hour on the same computer by the same account. This could indicate an adversary attempting to manipulate access tokens to elevate privileges or operate under a different security context.
This rule detects attempts to deploy a malicious pod via the Kubernetes API. It specifically looks for HTTP POST requests to the '/api/v1/namespaces/' endpoint followed by '/pods', indicating an attempt to create a new pod within a Kubernetes namespace.
This rule detects a spike in modifications or creations of Azure Diagnostic Settings within a one-hour window. A high volume of 'Diagnostic Setting' operations by a single caller could indicate an attempt to alter logging configurations, potentially to impair defenses or hide malicious activity.
This rule detects when multiple versions of files are deleted within SharePoint by a single user. This could indicate an attempt to remove historical data or cover tracks.
The detection looks for Entra ID sign-in events where both the source country and user agent string are new for the authenticating account(e.g., neither value has been seen during the 14-day training window (days 14–2 prior to now)). This can be changed easily in the let variable
The double signal requirement is intentional. A new country alone is relatively common (VPN usage, business travel, Microsoft service IPs), and a new user agent alone is low signal (browser updates, new devices). Requiring both to be new on the same sign-in increases fidelity, while still capturing the pattern typically associated with credential compromise or account takeover.
Sign-in events are collapsed to a single row per user per country, with EventStartTime and EventEndTime showing the first and last sign-in seen within the defined detection window.
A dynamic risk score is applied on top of the core detection to drive alert severity so you can set noise for your environment to 'informational' and reduce SOC alert fatigue.
Set the `HighRiskCountries` array to suit your risk profile
The double signal requirement is intentional. A new country alone is relatively common (VPN usage, business travel, Microsoft service IPs), and a new user agent alone is low signal (browser updates, new devices). Requiring both to be new on the same sign-in increases fidelity, while still capturing the pattern typically associated with credential compromise or account takeover.
Sign-in events are collapsed to a single row per user per country, with EventStartTime and EventEndTime showing the first and last sign-in seen within the defined detection window.
A dynamic risk score is applied on top of the core detection to drive alert severity so you can set noise for your environment to 'informational' and reduce SOC alert fatigue.
Set the `HighRiskCountries` array to suit your risk profile
Detects instances where the Windows COM surrogate (DllHost.exe) writes executable files or scripts to user-writable/temp directories. This proxy file-write behavior indicates potential WSL2 payload staging that bypasses network telemetry.
Page 436 of 864