Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects rapid termination of specific mobile messenger applications (Max) within seconds of starting, while indicators of the Frida dynamic instrumentation tool are concurrently detected on the device. This pattern suggests the application is identifying the presence of a hooking/instrumentation environment and self-terminating as a defense mechanism. The detection is further correlated with failed connection attempts to the application's backend.
Detects rapid termination of specific mobile messenger applications (Max) within seconds of starting, while indicators of the Frida dynamic instrumentation tool are concurrently detected on the device. This pattern suggests the application is identifying the presence of a hooking/instrumentation environment and self-terminating as a defense mechanism. The detection is further correlated with failed connection attempts to the application's backend.
Detects rapid termination of specific mobile messenger applications (Max) within seconds of starting, while indicators of the Frida dynamic instrumentation tool are concurrently detected on the device. This pattern suggests the application is identifying the presence of a hooking/instrumentation environment and self-terminating as a defense mechanism. The detection is further correlated with failed connection attempts to the application's backend.
Detects the obfuscated first-stage JavaScript payload sharedLoad.min.js dropped by the malicious npm indexed-btree package, identified by string-array encoding and self-checksumming array rotation obfuscation patterns
Detects Vidar Infostealer variants by identifying its unique per-build polymorphic virtual machine bytecode interpreter and custom ARX stream cipher. The rule uses a combination of high file entropy, lack of standard OS cryptographic API imports, and the presence of structurally invariant indirect jump-table dispatch patterns used in custom VM execution loops.
Detects user sign-ins that utilize an 'External Authentication Method' within 3 days of a password reset event. This behavior may indicate an adversary has successfully established persistence using a rogue authentication provider (e.g., via a TrustSink or similar malicious configuration) that survives password remediation and is capable of capturing or intercepting subsequent authentication tokens.
Detects the deletion of .zip files within the Public directory by VBScript or JScript interpreters (wscript.exe or cscript.exe). This pattern is often indicative of a malicious dropper or downloader that extracts a payload from a staged archive and subsequently removes the evidence to hinder analysis and forensics.
Detects instances where wscript.exe deletes a .zip archive from within the C:\Users\Public\ directory structure. This activity is frequently associated with VBScript droppers performing anti-forensic cleanup by removing staged payloads after extraction but prior to execution.
This rule detects the execution of script files (such as .vbs, .vbe, .js, .jse) via wscript.exe when the file name uses a double-extension technique (e.g., .pdf.vbs) to masquerade as a benign PDF document. These files are typically found in temporary or user-download directories, indicating potential malicious activity initiated by downloaded attachments.
This rule identifies sign-in events using an External Authentication Method (EAM) that occur within the 2-day cache window immediately following a certificate or key credential update for an application or service principal in Entra ID. This detection highlights a timeframe where an attacker potentially possessing a compromised old signing key could use it to forge tokens before the Entra cache refreshes.
Detects potential session hijacking where a user logs into Google Workspace from a new IP or country, followed within an hour by the registration of a new security key or passkey, which is a common technique to establish persistent unauthorized access.
This rule detects potential staging activity for ClickFix or Vidar malware campaigns. It identifies the creation of files or folders in directories mimicking Windows Diagnostics infrastructure (WDI) or known payload paths, correlated with the execution of suspicious PowerShell commands or archive-related utilities within a 30-minute window on the same device.
This rule detects malicious activity related to the exploitation of MpDlpService.exe. It looks for the execution or presence of known malicious file hashes associated with this threat, including a P-stage script, payload files, and a malicious mpclient.dll. Additionally, it identifies instances where the legitimate MpDlpService.exe binary is executed from a non-standard, suspicious directory, which is a common indicator of side-loading or persistence techniques.
Detects HTML smuggling files identified as 'FlipBook' lures, commonly used in device-code phishing campaigns. These lures utilize client-side JavaScript for AES-GCM decryption, extensive comment-based obfuscation, and specific junk-padding techniques to bypass security controls and trick users into providing credentials.
Detects a sequence of events where a user performs a device-code authentication followed rapidly by a device enrollment, and subsequently continues to access cloud services (Microsoft Graph, Exchange Online, Intune) shortly after their account password has been reset. This pattern is indicative of persistent access maintained via a registered device or OAuth token that survives credential remediation.
Detects HTML files utilizing the 'GhostCode' technique to hide malicious phishing redirects. The technique involves a password-protected HTML lure that uses JavaScript (Web Crypto API) to derive an AES-256-GCM key from a user-provided password via PBKDF2, decrypt an embedded ciphertext payload, and dynamically redirect the user to a concealed phishing URL.
This rule detects scenarios where common web browsers (e.g., chrome.exe, msedge.exe) spawn known living-off-the-land (LotL) binaries (e.g., powershell.exe, wscript.exe, mshta.exe) with command-line arguments indicative of malicious activity, such as base64-encoded strings, hidden window flags, or remote script invocation (IEX/Invoke-Expression). This pattern is frequently used in drive-by download or phishing delivery chains where an initial payload is triggered directly from a browser context.
Detects instances where mshta.exe is launched from a web browser or explorer.exe with suspicious command-line arguments, such as remote URLs, script protocols, or potentially obfuscated/base64-encoded strings, often indicative of 'ClickFix' social engineering attacks.
Detects Android APK files utilizing anti-analysis techniques associated with the RatHat malware family, including malformed AndroidManifest.xml structures with custom 0x9999 chunk headers, high-entropy/oversized manifest files, and obfuscated DEX bytecode markers designed to disrupt static analysis and decompilation tools.
Detects potential AI-targeted cloaking, a technique where a web server serves different content to AI crawlers versus human users, identified by comparing HTTP response sizes or hashes across session logs. The rule uses Microsoft Sentinel's ASIM Web Session schema to correlate web requests, identifying discrepancies that suggest malicious or evasive intent. Covers T1036 & T1027
Detects Azure AD/Entra ID authentication events where a session token or cookie is used without performing a fresh interactive MFA challenge, which is characteristic of session hijacking or adversary-in-the-middle (AiTM) relay attacks (e.g., NovaCookies) used to bypass security controls after initial authentication.
Page 87 of 864