Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
545 detections
Filters
Last updated
All Time
Detection languages
272
102
85
38
17
Contributors
152
88
64
55
44
Categories
97
86
85
85
82
Platforms
299
182
64
41
35
Products / Services
10,665
9,773
6,705
4,421
3,749
545
MITRE Techniques
191
175
144
100
91
CVEs
19
18
12
6
6
IDS Classtypes
21
14
1
1
1
IDS Protocols
37
1
The analytic identifies the execution of the native mimikatz.exe binary on Windows systems, including instances where the binary is renamed. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names. This activity is significant because Mimikatz is a widely used tool for extracting authentication credentials, posing a severe security risk. If confirmed malicious, this activity could allow attackers to obtain sensitive credentials, escalate privileges, and move laterally within the network, leading to potential data breaches and system compromise.
The following analytic identifies suspicious Cmdlet usage in Exchange Management logs, focusing on commands like New-MailboxExportRequest and New-ManagementRoleAssignment. It leverages EventCode 1 and specific Message patterns to detect potential ProxyShell and ProxyNotShell abuse. This activity is significant as it may indicate unauthorized access or manipulation of mailboxes and roles, which are critical for maintaining email security. If confirmed malicious, attackers could export mailbox data, assign new roles, or search mailboxes, leading to data breaches and privilege escalation.
The following analytic identifies the addition and quick deletion of a Service Principal Name (SPN) to a domain account within 5 minutes. This detection leverages EventCode 5136 from the Windows Security Event Log, focusing on changes to the servicePrincipalName attribute. This activity is significant as it may indicate an attempt to perform Kerberoasting, a technique used to crack the cleartext password of a domain account offline. If confirmed malicious, this could allow an attacker to gain unauthorized access to sensitive information or escalate privileges within the domain environment.
This rule detects the execution of common command and scripting interpreters (cmd.exe, cscript.exe, powershell.exe, pwsh.exe, powershell_ise.exe, wmic.exe, wscript.exe) when their parent process is either w3wp.exe or svchost.exe, and the command arguments contain keywords related to SharePoint. This behavior can indicate suspicious activity within a SharePoint environment, potentially related to web shell execution, privilege escalation, or data exfiltration.
Detects potential exploitation attempts of the SharePoint vulnerability CVE-2025-53770 by looking for POST requests to ToolPane.aspx with a specific referrer.
No description available.
This query identifies when a suspicious SVG file, linked to known threat intelligence, is downloaded via a browser. This technique is often used for SVG smuggling, where attackers embed malicious JavaScript or links within the SVG's structure to bypass traditional content filters or sandboxing. Once rendered in the browser, the embedded content may redirect the victim to a malicious site or initiate further malicious activity.
KQL Query
Analyze Mail Bomb Attack by ISP
KQL Query from file: Critical Identities OAuth Grant
KQL Query from file: Exposure Management + Defender for Office 365
KQL Query
KQL Query from file: MDO Email Threat Classification By ISP
KQL Query from file: Defending against dot zip domain phishing attack
KQL Query from file: Detecting Misconfigured EXO Transport Rules
KQL Query
KQL Query
The analytic detects the use of PowerShell commands to copy the SAM, SYSTEM, or SECURITY hives, which are critical for credential theft. It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command executed. This activity is significant as it indicates an attempt to exfiltrate sensitive registry hives for offline password cracking. If confirmed malicious, this could lead to unauthorized access to credentials, enabling further compromise of the system and potential lateral movement within the network.
This query helps reviewing quarantine release trend in Defender for Office 365
The following analytic identifies the use of PowerShell's Start-Service or Stop-Service cmdlets on an endpoint. It leverages PowerShell Script Block Logging to detect these commands. This activity is significant because attackers can manipulate services to disable or stop critical functions, causing system instability or disrupting business operations. If confirmed malicious, this behavior could allow attackers to disable security services, evade detection, or disrupt essential services, leading to potential system downtime and compromised security.
Detects the Installation of a Exchange Transport Agent
Page 14 of 26