Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61,044 detections
Filters
Last updated
All Time
Detection languages
23,953
16,903
4,364
4,342
3,270
Contributors
11,679
8,654
7,555
6,800
4,504
Categories
20,589
11,933
5,910
5,193
4,872
Platforms
40,153
7,368
6,547
3,915
3,691
Products / Services
10,809
9,795
6,757
4,421
3,770
MITRE Techniques
18,176
15,735
12,661
8,477
6,293
CVEs
71
71
64
58
49
IDS Classtypes
1,937
503
461
381
237
IDS Protocols
2,431
869
408
324
97
Detects instances where svchost.exe runs outside the standard System32 or SysWOW64 directories and loads the graphics-hook-filter64.dll library, or where the known hash of this sideloaded payload is observed. This behavior is correlated with the presence of the encrypted configuration file graphics-hook_config.bin on the same device.
Someone holding a stolen secret often tries the wrong value first, then the right one.
Todyl (intel) observed an invalid secret (7000215) followed within minutes by a success for the same app from the same IP.
This rule finds that pattern, but only where the app has never succeeded from that IP in the previous 30 days, which removes routine automation. It doesn’t depend on any indicator, so it survives infrastructure changes.
Todyl (intel) observed an invalid secret (7000215) followed within minutes by a success for the same app from the same IP.
This rule finds that pattern, but only where the app has never succeeded from that IP in the previous 30 days, which removes routine automation. It doesn’t depend on any indicator, so it survives infrastructure changes.
Detects instances where the Claude Desktop application launches package managers (such as npm, npx, node, pnpm, or yarn) to perform global package installations. This helps identify potentially unintended or malicious code execution or package installations initiated by AI assistants.
Detects successful device-code authentication flow completions using the Microsoft Authentication Broker client, which is frequently targeted or abused in phishing attacks bypassing traditional MFA.
This query is designed to find information about a specific software vulnerability identified by a CVE ID (Common Vulnerabilities and Exposures ID) using Microsoft Defender XDR data. Here's a simple breakdown of what the query does:
Define the CVE ID: It starts by setting a specific CVE ID (in this case, "CVE-2022-3602") to search for.
Filter Vulnerabilities: It looks through the DeviceTvmSoftwareVulnerabilities table to find entries that match the specified CVE ID.
Identify Vulnerable Devices: It collects a list of device names that are vulnerable to this CVE and groups them by the CVE ID.
Join with Knowledge Base: It combines this information with additional details from the DeviceTvmSoftwareVulnerabilitiesKB table, which contains more comprehensive information about each vulnerability.
Calculate Total Devices: It calculates the total number of unique devices that are vulnerable to this CVE.
Select Relevant Information: Finally, it selects and displays the total number of vulnerable devices, the CVE ID, the severity level of the vulnerability, its CVSS score (a standard for assessing the severity of vulnerabilities), a description of the vulnerability, and the list of vulnerable devices.
In summary, this query helps you understand how many devices are affected by a specific vulnerability, along with detailed information about the vulnerability itself.
Define the CVE ID: It starts by setting a specific CVE ID (in this case, "CVE-2022-3602") to search for.
Filter Vulnerabilities: It looks through the DeviceTvmSoftwareVulnerabilities table to find entries that match the specified CVE ID.
Identify Vulnerable Devices: It collects a list of device names that are vulnerable to this CVE and groups them by the CVE ID.
Join with Knowledge Base: It combines this information with additional details from the DeviceTvmSoftwareVulnerabilitiesKB table, which contains more comprehensive information about each vulnerability.
Calculate Total Devices: It calculates the total number of unique devices that are vulnerable to this CVE.
Select Relevant Information: Finally, it selects and displays the total number of vulnerable devices, the CVE ID, the severity level of the vulnerability, its CVSS score (a standard for assessing the severity of vulnerabilities), a description of the vulnerability, and the list of vulnerable devices.
In summary, this query helps you understand how many devices are affected by a specific vulnerability, along with detailed information about the vulnerability itself.
Detects successful SSH password authentication (sshd) for sensitive accounts (such as root or alpine) from public, non-private IP addresses. The rule optionally correlates preceding connection attempts or failures from the same source IP.
This week, I'm sharing a new article inspired by a recent investigation published by Todyl about attackers abusing stolen application credentials to authenticate as legitimate applications in Microsoft Entra ID. The interesting part? Attackers don't necessarily need to compromise a user account. A stolen client secret could be enough to access sensitive cloud resources, depending on the application's permissions. As usual, rather than focusing on IP-based IOCs that attackers can easily rotate, I prefer looking for Indicators of Attack (IOAs). For this hunt, I'm focusing on two Entra ID authentication errors:
AADSTS7000215 – Invalid client secret
AADSTS7000222 – Expired client secret
AADSTS7000215 – Invalid client secret
AADSTS7000222 – Expired client secret
Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing.
The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure.
Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts.
It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records
to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.
The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure.
Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts.
It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records
to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.
Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Detects the presence of "UWhRC....AAYBAAAA" pattern in command line.
The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure.
Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts.
It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records
to spoof Service Principal Names (SPNs) and redirect authentication requests like in CVE-2025-33073.
If you see this pattern in the command line, it is likely an attempt to add spoofed Service Principal Names (SPNs) to DNS records,
or checking for the presence of such records through the `nslookup` command.
The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure.
Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts.
It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records
to spoof Service Principal Names (SPNs) and redirect authentication requests like in CVE-2025-33073.
If you see this pattern in the command line, it is likely an attempt to add spoofed Service Principal Names (SPNs) to DNS records,
or checking for the presence of such records through the `nslookup` command.
Detects execution of Advanced Installer MSIX Package Support Framework (PSF) components, specifically AI_STUBS executables with original filename 'popupwrapper.exe'.
This activity may indicate malicious MSIX packages build with Advanced Installer leveraging the Package Support Framework to bypass application control restrictions.
This activity may indicate malicious MSIX packages build with Advanced Installer leveraging the Package Support Framework to bypass application control restrictions.
Performs a retrospective threat hunt for Key Eater indicators of compromise, checking Entra ID sign-ins, Azure DevOps auditing logs, and network events for known malicious IPs, subnets, user agents, and tunnel infrastructure.
Detects PIM role activations and eligible or active role assignments that involve Entra agent users. Agents are identified by agentType, blueprintId or a maintained UPN list.
Review notes:
- The agentType and blueprintId branches are not validated against real agent user events.
- The UPN list is the only validated signal.
- The UPN list is manual and needs an owner and a review cadence.
- For a scheduled analytic rule, set Lookback to match the run frequency (for example 1d).
Entity mapping: Account: ActorUpn; Account: TargetUser (Actor intentionally not mapped).
Review notes:
- The agentType and blueprintId branches are not validated against real agent user events.
- The UPN list is the only validated signal.
- The UPN list is manual and needs an owner and a review cadence.
- For a scheduled analytic rule, set Lookback to match the run frequency (for example 1d).
Entity mapping: Account: ActorUpn; Account: TargetUser (Actor intentionally not mapped).
Detects suspicious curl commands spawned from shell processes on CI runners (such as GitHub Actions) that encode and POST environment variables using command substitution.
Details:
Identifies non-browser processes communicating with Mega/S4 storage services, 0x0.st, or the Telegram Bot API, which may indicate data staging, exfiltration, or automation activity.
Hypothesis:
An adversary may leverage command-line tools or custom scripts to communicate with cloud storage services, anonymous file-sharing platforms, or Telegram Bot APIs in order to stage, automate, or exfiltrate stolen data from a compromised host.
Identifies non-browser processes communicating with Mega/S4 storage services, 0x0.st, or the Telegram Bot API, which may indicate data staging, exfiltration, or automation activity.
Hypothesis:
An adversary may leverage command-line tools or custom scripts to communicate with cloud storage services, anonymous file-sharing platforms, or Telegram Bot APIs in order to stage, automate, or exfiltrate stolen data from a compromised host.
Detects network connections to webhook.site, execution of command-line tools referencing webhook.site or ArtexProbe, and creation or writing of files associated with ArtexProbe or known webshells.
Detects sign-in events and Microsoft Graph API activities originating from known Indicator of Compromise (IOC) IP addresses associated with Storm-0940 threat group activity.
Detects execution of the Nmap scanning tool initiated by script interpreters, shells, or container runtimes, coupled with network behavior indicating a fan-out of connections to multiple distinct hosts or ports.
Detects HTTP requests made to specific fabricated decoy routes planted as comments in application code or documentation (SpikeStrip comments). Probing these non-existent routes indicates that an agent or adversary has ingested the planted comments and is actively scanning the web application.
Detects processes other than known browsers accessing Chromium-based credential stores, cookies, or chat/messaging app session data, correlated with Wi-Fi profile and cleartext key enumeration via netsh.exe.
Detects a sequence where a remote host performs a network probe using netcat or curl with specific flags, followed shortly by downloading a known malicious RAT binary from the same remote IP address.
Page 3 of 2907