Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
This rule detects the creation of specific files named 'spinstall0' within the SharePoint Web Server Extensions template layouts directory. This activity could indicate an attempt to install or modify SharePoint components, potentially for malicious purposes or unauthorized changes.
This detection identifies when a Microsoft Teams message containing a URL associated with a known Remote Monitoring and Management (RMM) tool was sent and subsequently clicked by the intended recipient or the original sender. The domain is not part of the organization's approved RMM solutions, indicating a potential use of Living-off-the-Land RMM (LOLRMM) techniques often employed in initial access or persistence stages by threat actors.
This activity may reflect attempted remote access, lateral movement, or data collection through unauthorized RMM deployment.
This activity may reflect attempted remote access, lateral movement, or data collection through unauthorized RMM deployment.
Detects successful Okta authentication using the FIDO/WebAuthn cross-device (hybrid) sign-in feature. This technique is abused by attackers in Adversary-in-the-Middle (AiTM) phishing campaigns, like those conducted by PoisonSeed, to bypass FIDO MFA by tricking a user into scanning a malicious QR code.
This rule detects suspicious activity where a file is first downloaded to the 'Downloads' folder and subsequently executed from the 'Public' folder on the same device within a 24-hour timeframe. This behavior can indicate an attempt to bypass security controls or stage malicious payloads in a commonly accessible location.
Detects successful user authentication using the FIDO2/WebAuthn cross-device (hybrid) sign-in feature. This technique can be abused by attackers in Adversary-in-the-Middle (AiTM) phishing campaigns to bypass FIDO key protections, as seen in the PoisonSeed campaign.
This detection identifies the use of a remote tool to download virtual machine disk files from a datastore. The NFC protocol is used by management tools to transfer files to and from ESXi hosts, but it can also be abused by attackers or insiders to exfiltrate full virtual disk images.
Detects Odyssey Infostealer, a macOS malware known for stealing sensitive data and establishing persistence. This rule identifies specific strings related to its C2 communication, data theft, and persistence mechanisms.
Hunting query to monitor downloads through popular browsers
KQL Query
KQL Query from file: DEVMAN ransomware detection
DEVMAN Ransomware Detection
KQL Query
KQL Query
KQL Query from file: Azure Cloud Security Monitoring
KQL Query from file: Potential Session/Cookie Theft
KQL Query
KQL Query
KQL Query from file: Sentinel All-In-One IP ThreatHunt
KQL Query
KQL Query from file: The Hunt for QR Phisher
KQL Query from file: Data Exfiltration via Microsoft Teams
Page 145 of 173