Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61,044 detections
Filters
Last updated
All Time
Detection languages
23,953
16,903
4,364
4,342
3,270
Contributors
11,679
8,654
7,555
6,800
4,504
Categories
20,589
11,933
5,910
5,193
4,872
Platforms
40,153
7,368
6,547
3,915
3,691
Products / Services
10,809
9,795
6,757
4,421
3,770
MITRE Techniques
18,176
15,735
12,661
8,477
6,293
CVEs
71
71
64
58
49
IDS Classtypes
1,937
503
461
381
237
IDS Protocols
2,431
869
408
324
97
Detects when a web server account (such as www-data, apache, nginx) spawns a shell (bash, sh, etc.), 'su', or 'unshare', which may indicate web application exploitation and post-compromise activity. The query ran without errors in a live tenant.
Detects potential DLL sideloading where the legitimate Avira antivirus binary (avscan.exe) loads a custom DLL (avscan.dll) from user-writable directories such as AppData, Public, or ProgramData, potentially accompanied by a configuration file.
Detects SharePoint search queries using content class parameters (STS_Site or STS_Web) combined with wildcard patterns to discover and inventory all reachable SharePoint sites and content.
Detects persistent reverse SSH tunnels created using autossh or ssh with multiple remote port forwarding parameters (-R), or network activity communicating with a known C2 infrastructure domain (ssh.gputw.ai).
Correlates inbound delivered emails containing ChatGPT share links (https://chatgpt.com/share/) with subsequent allowed click events by the same recipient on the matching URL.
Detects indicators of compromise associated with a compromised AhsayCBS server, including connections to malicious infrastructure, execution of suspicious child processes or administrative utilities by cbssvcX64.exe, and the presence of known cryptominer artifacts and scripts. The query ran without errors in a live tenant.
Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6.
In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic.
This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.
In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic.
This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.
Detects XML parsing issues, if the application expects to work with XML make sure that the parser is initialized safely.
Detects the addition of a new Federated Domain.
Detects the use of the "ssh" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Use of Remote.exe
Sigma
Remote.exe is part of WinDbg in the Windows SDK and can be used for AWL bypass and running remote files.
Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud
Detects usage of winget to add new additional download sources
Detects usage of winget to add a new insecure (http) download source.
Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)
Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)
Detects changes to the "MaxMpxCt" registry value.
MaxMpxCt specifies the maximum outstanding network requests for the server per client, which is used when negotiating a Server Message Block (SMB) connection with a client. Note if the value is set beyond 125 older Windows 9x clients will fail to negotiate.
Ransomware threat actors and operators (specifically BlackCat) were seen increasing this value in order to handle a higher volume of traffic.
MaxMpxCt specifies the maximum outstanding network requests for the server per client, which is used when negotiating a Server Message Block (SMB) connection with a client. Note if the value is set beyond 125 older Windows 9x clients will fail to negotiate.
Ransomware threat actors and operators (specifically BlackCat) were seen increasing this value in order to handle a higher volume of traffic.
Detects a sequence where a Windows Defender exclusion is added via PowerShell or Command Prompt, followed by a silent installation of an 'app.msi' package on the same device within 30 minutes. Management agents and noisy administrative devices are filtered out to reduce false positives.
Detects a sequence where a file is dropped into a hidden .solidity directory followed by the creation of a persistence artifact (such as a systemd user unit or macOS LaunchAgent) on the same device within one hour.
Detects cross-account AWS AssumeRole activity from an external account followed by extensive Amazon S3 enumeration and read (GetObject) operations within a 12-hour window, potentially indicating unauthorized data access or exfiltration.
Correlates a successful Entra ID sign-in from an unmanaged device/IP with a persistence action (such as OAuth consent, app permission grant, or device registration) performed by the same user from a different IP within 1 hour. This behavior is indicative of post-AiTM or device-code session hijacking where stolen tokens are replayed from attacker infrastructure.
Detects network connections, file creations with specific SHA256 hashes, and email URL hits associated with known Forg365 threat actor infrastructure and indicators.
Identifies Microsoft Defender Vulnerability Management software inventory to identify endpoints running PHP versions potentially affected by CVE-2026-109618 and CVE-2026-109619
Page 14 of 2907