Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,045 detections
Filters
Last updated
All Time
Detection languages
15,346
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,106
9,754
3,848
3,756
3,712
Platforms
40,045
7,313
6,542
3,903
3,660
Products / Services
10,431
9,678
6,722
1,887
1,878
MITRE Techniques
13,736
13,114
8,062
5,947
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects persistence mechanisms installed by the trojanized Claude Code extension on Cursor or Node-based applications. On macOS, it detects the creation of LaunchAgent property list files. On Windows, it detects scheduled tasks created via schtasks.exe or event logs, and modifications to the Startup folder.
The following analytic detects suspicious processes spawned by WinRM (wsmprovhost.exe). It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific child processes like cmd.exe, powershell.exe, and others. This activity is significant as it may indicate exploitation attempts of vulnerabilities like CVE-2021-31166, which could lead to system instability or compromise. If confirmed malicious, attackers could execute arbitrary commands, escalate privileges, or maintain persistence, posing a severe threat to the environment.
Staging data into an archive and then sending it out within a short window is a hallmark of exfiltration. Correlating the two events on the same device (archive, then a public network connection from a transfer tool within 2 hours) is much higher fidelity than either event alone. The result is summarised per archive event to avoid join row multiplication.
Correlates a PKINIT-based Kerberos logon to a domain controller with a subsequent DCSync attack alert for the same account within a 60-second window, leveraging Microsoft Defender for Identity and Microsoft Defender XDR.
Detects potential ESC8 NTLM relay attacks against Active Directory Certificate Services (AD CS) Web Enrollment, where a domain controller machine account authenticates over NTLM from a non-DC IP address followed by a certificate request or retrieval via IIS.
When binaries are blocked or the operator is living off the land, uploads are done with .NET primitives and cmdlets (WebClient.UploadFile, Invoke-RestMethod -Method Post -InFile, FtpWebRequest). The logic is anchored on strong upload indicators (not just webclient + a URL, which mostly catches download cradles).
Detects a sequence where a domain user account is created (via net.exe or New-ADUser) and the same account is subsequently added to privileged groups such as Domain Admins or Enterprise Admins within one hour.
Detects browser processes accessing a chatgpt.com/share/ link followed shortly thereafter by connections to multiple distinct external hosts, potentially indicating exfiltration or unauthorized interaction following an AI chat reference.
Detects machine account NTLM logons to an Active Directory Certificate Services (AD CS) Web Enrollment server where the source device differs from the account's own host (indicative of NTLM coercion like PetitPotam), followed within 10 minutes by certificate enrollment requests (/certsrv/) from the same source host.
Correlates a certificate-based (PKINIT) Kerberos logon by an account with a DCSync-style directory replication from the same account within a 5-minute window, using Microsoft Defender for Identity logs.
Flags endpoints associated with anonymous file-drop sites, paste services and chat platforms commonly abused for exfiltration and C2. Domains are matched with term-based has_any, which avoids the substring false positives of contains (e.g. t.me matching client.messaging.adobe, or file.io matching sharefile.io). Sanctioned services (Dropbox, Google Drive, OneDrive/SharePoint, Box) are intentionally left out to keep volume manageable; an optional block is included.
Detects potential DLL sideloading where the legitimate Avira antivirus binary (avscan.exe) loads a custom DLL (avscan.dll) from user-writable directories such as AppData, Public, or ProgramData, potentially accompanied by a configuration file.
Detects indicators of compromise associated with a compromised AhsayCBS server, including connections to malicious infrastructure, execution of suspicious child processes or administrative utilities by cbssvcX64.exe, and the presence of known cryptominer artifacts and scripts. The query ran without errors in a live tenant.
Detects a sequence where a ZIP file from known lure repositories or names is downloaded, followed within a day by the execution of a LuaJIT binary (util64.exe or luajit.exe) via a script launcher (Application.bat or Launcher.cmd) using obfuscated text files.
Archiving then sending data out within a short window is a hallmark of exfiltration. Implemented with correlate() over three event sets: archive process → transfer-tool process → that same process's public connection, all on one aid within 2 hours.
Covers renamed binaries (binary first seen before the range, or the event was not emitted). Matches tool-specific command-line shapes on processes not named like the tool.
Node.js has announced upcoming security updates addressing multiple vulnerabilities, including high-severity issues. Organizations should start identifying installed Node.js versions across their environments, especially outdated or End-of-Life (EOL) releases that may no longer receive security patches. I created the following Query to quickly identify devices running Node.js, review their installed versions, and prioritize those requiring attention before the security updates become available
Detects a portable runtime launched from a KB folder under AppDataRoaming that establishes network connections to multiple domain-infrastructure ports (such as ports 88, 445, 636 for AD CS or domain services enumeration), indicative of potential internal reconnaissance or abuse.
Detects Tor client execution on Windows endpoints, including the tor.exe binary and the Tor client bundled with Brave Browser (Private Window with Tor). Tor can hide command-and-control or exfiltration traffic, and some malware ships or drops a Tor client. To triage, check the parent process, image path, command line and SHA-256 hash, and confirm whether the user is authorized to use Tor.
Bulk staging prior to exfiltration commonly produces large archives written by archiving utilities or PowerShell. A size threshold (≥100 MB) cuts noise from small routine archives.
Bulk staging before exfiltration commonly produces large archives written by archiving utilities or PowerShell.
Page 3 of 1907