Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
545 detections
Filters
Last updated
All Time
Detection languages
272
102
85
38
17
Contributors
152
88
64
55
44
Categories
97
86
85
85
82
Platforms
299
182
64
41
35
Products / Services
10,665
9,773
6,705
4,421
3,749
545
MITRE Techniques
191
175
144
100
91
CVEs
19
18
12
6
6
IDS Classtypes
21
14
1
1
1
IDS Protocols
37
1
Detects the creation or modification of Exchange Online inbox rules, transport rules, or mailbox settings where the rule name consists exclusively of special characters. This pattern can be indicative of malicious activity, such as an attacker attempting to hide a forwarding rule or other automated action by using an obscure name.
Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit
Detects early-stage collection and reconnaissance activities targeting sensitive email data prior to exfiltration via Exchange cmdlets. This rule identifies the use of 'New-MailboxSearch' and 'Get-Recipient' cmdlets, which can be leveraged by adversaries to discover and collect email-related information. Detection covers both endpoint PowerShell execution and cloud audit logs for Microsoft Exchange Online.
Detects mass device wipe, retire, or delete operations performed via Microsoft Intune, inspired by the Stryker/Handala attack. This rule combines five detection signals: static velocity threshold, bulk destructive actions from a single operator, first-time operator detection, UEBA anomaly correlation, and ML anomaly detection. Operations are categorized into Tier 1 (critical, zero baseline activity like wipe/retire) and Tier 2 (high, legitimate IT ops activity like device delete, subject to velocity and ML thresholds). Severity escalates based on the number of overlapping signals.
KQL Query from file: OauthMSPhish Detection
Detects the creation of an unusual lock file at `/usr/share/nano/.lock`. This specific path is used by a backdoored Go module (impersonating golang.org/x/crypto) to temporarily store harvested plaintext passwords before exfiltration. The rule specifically looks for file creation events at this highly specific path.
This rule detects a potential quishing (QR code phishing) attack followed by a suspicious successful sign-in to Entra ID (formerly Azure AD). It correlates URL click events or device network events containing deep link indicators (like 'tg://login', 'wa.me/settings/linked_devices', 'signal://', 'line://') or '.apk' file downloads with a successful Entra ID sign-in by the same user within a 30-minute window. This behavior suggests a user may have scanned a malicious QR code, clicked a phishing link, or downloaded a malicious application, leading to a successful but potentially compromised authentication.
This rule detects various indicators associated with the Booking.com phishing campaign targeting hotels and customers. It identifies suspicious web requests to non-Booking.com domains containing 'op_token' and 'complaint' or 'reservation' keywords, especially when combined with punycode, 'booklng' typos, or management-related subdomains. It also looks for partner kit patterns involving 'sign-in/?tpo_token=' and 'booklng' in URLs. Additionally, it identifies suspicious emails from newly generated Gmail accounts with specific subjects ('Automatic reply', 'Availability', 'Reservation') containing 'op_token' in the subject or body.
Detects the creation or modification of Exchange inbox rules that move messages to potentially risky folders (e.g., Deleted Items, Junk Email, RSS Feeds, Archive, Clutter) or are configured to delete messages. This behavior can be indicative of an attacker attempting to hide malicious emails, exfiltrate data, or disrupt email flow.
Detects anomalous Exchange Transport Rule activity: high volume changes, suspicious patterns, or after-hours modifications
This query parses the complex JSON parameters of the New-TransportRule and Set-TransportRule commands to find instances where email is being secretly copied externally or security is being lowered.
This query uses the Machine Learning series_decompose_anomalies function to build a baseline of "normal" transport rule modification behavior. If your organization typically changes 0 rules a week, and suddenly 5 are changed at 2 AM on a Saturday, this query will catch it regardless of what the parameters are.
This rule tracks and deduplicates alert emails from a Managed Security Service Provider (MSSP). It identifies emails from a specific sender, filters by subject keywords (e.g., severity levels), and groups them into sessions to prevent duplicate alerts. It also extracts case numbers from portal URLs found within the emails.
Detects common commands used in Windows webshells
Detects a failed installation of a Exchange Transport Agent
Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations
Detects the Installation of a Exchange Transport Agent
Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations
Detects the Installation of a Exchange Transport Agent
Detects URLs that use the `https://user@host` syntax where the 'user' part is crafted to look like a legitimate domain (e.g., `https://example.com@malicious-site.net`). This is a technique used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539) to craft convincing phishing links.
KQL Query from file: Detecting Threat Actor Storm-2657
Page 12 of 26