Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,225 detections
Filters
Last updated
All Time
Detection languages
1,118
30
19
17
15
Contributors
391
236
131
85
62
Categories
313
252
228
185
166
Platforms
651
438
268
228
200
Products / Services
10,650
9,755
6,688
4,418
3,745
1,225
MITRE Techniques
264
259
234
217
208
CVEs
8
8
6
6
6
IDS Classtypes
2
2
1
1
1
IDS Protocols
2
1
This rule monitors for potentially malicious activities involving Azure AD Connect synchronization accounts. It flags anomalous sign-in events (e.g., interactive sign-ins or sign-ins originating from unauthorized IP addresses) and tracks when these sync accounts are granted privileged roles within the environment.
This rule detects the execution of known Remote Monitoring and Management (RMM) or remote access tools on devices where they have not been observed within the previous 90-day baseline (excluding the most recent 7 days). This pattern is often indicative of an adversary introducing unauthorized remote access capabilities for persistence or lateral movement.
This rule detects the use of the Frida dynamic instrumentation toolkit and the objection framework, specifically searching for command-line arguments and process names associated with their installation or use, as well as network activity on the default Frida server port (27042). It monitors for activities like SSL pinning bypass, mobile application patching, and remote agent deployment.
Detects instances where the Node.js package manager (npm) or node process initiates suspicious child processes such as curl, powershell, or shell interpreters (bash/sh/cmd) containing command-line arguments indicative of downloading or executing remote content (e.g., GitHub raw URLs or pipes to interpreters). This behavior is characteristic of supply chain attacks or malicious installation scripts.
Detects Azure AD sign-ins using the OAuth device code authentication flow that are followed by impossible-travel patterns (country change within a short window) or that occur near captive-portal network connections on the same device, consistent with Midnight Blizzard's CaptiveCrunch device-code phishing tradecraft targeting corporate travelers.
This rule identifies successful user sign-ins originating from IP addresses associated with residential or commercial VPN ASNs that have not been observed in the user's historical sign-in data (past 30 days). By comparing current activity against a baseline of known user locations, it flags potentially unauthorized access through masked connections.
This rule detects persistence mechanisms via Windows Registry Run or RunOnce keys, specifically targeting the execution of Python scripts or common interpreted/executable files located in suspicious user profile directories (AppData, Temp, or Public folders). This behavior is characteristic of adversaries using Python-based remote access trojans (RATs) to maintain a foothold on a compromised host.
Detects the delivery of a malicious SVG data-URI payload targeting the CVE-2026-42897 vulnerability in Outlook Web Access (OWA). This exploit uses a base64-encoded SVG image embedded in an email body, which triggers an onload JavaScript handler when rendered by OWA, leading to potential code execution within the mailbox context.
Detects the execution of known remote monitoring and management (RMM) or remote access tools shortly after Microsoft Teams process activity on a host. This behavior is consistent with helpdesk-impersonation vishing attacks where an adversary convinces a user to initiate a remote session.
Provides a consolidated access review report for all Microsoft Entra ID users, including account status (Enabled/Disabled), assigned roles, role assignment history, group memberships, and membership counts. Supports identity governance, user access reviews, and multi-vendor environments by providing a single view of user access and permissions.
This rule detects potentially malicious file deletion activity initiated by a Java-based application. It looks for common deletion commands ('del', 'rm', 'Remove-Item', 'unlink') in process command lines originating from 'java.exe' or 'javaw.exe', specifically targeting common staging paths ('Users\Public', 'AppData\Local\Temp') or filenames matching a specific pattern ('cleo.' followed by digits). This pattern is consistent with the behavior of staging and cleaning up artifacts during an intrusion.
This rule detects the Python interpreter (python.exe or pythonw.exe) spawning system administration or shell utility processes (e.g., cmd.exe, powershell.exe, netsh.exe). It explicitly excludes Python processes running from typical installation directories, flagging potential execution of malicious Python-based payloads or command-and-control (C2) agents that interact with the host operating system.
Detects the execution of 'cloudflared', a tool used to establish secure tunnels from a local network to Cloudflare's edge, by monitoring for common command-line arguments such as 'service install', 'tunnel run', or '--url'. This behavior could indicate an attempt by an attacker to create a persistent or ad-hoc reverse proxy for remote access.
Detects instances where the Node.js package manager (npm) or node process initiates suspicious child processes such as curl, powershell, or shell interpreters (bash/sh/cmd) containing command-line arguments indicative of downloading or executing remote content (e.g., GitHub raw URLs or pipes to interpreters). This behavior is characteristic of supply chain attacks or malicious installation scripts.
This rule identifies successful user sign-ins originating from IP addresses associated with residential or commercial VPN ASNs that have not been observed in the user's historical sign-in data (past 30 days). By comparing current activity against a baseline of known user locations, it flags potentially unauthorized access through masked connections.
Detects a multi-stage execution chain involving a malicious LNK file that triggers PowerShell. The rule specifically looks for PowerShell commands spawned by explorer.exe or mshta.exe that contain indicators of string deobfuscation (using .Replace), specific job-related keywords (CoreJob), or remote content retrieval (Net.WebClient.DownloadString). The detection correlates these process events with the presence of suspicious LNK files and decoy document files dropped within the temporary directory on the same endpoint.
This rule detects the execution of the Cloudflare Tunnel utility (cloudflared.exe) or similarly named binaries from non-standard, suspicious locations like temporary directories or public user folders. This pattern is commonly used by attackers to establish unauthorized persistent network tunnels (reverse proxies) into the victim's environment, bypassing firewall restrictions.
This rule detects persistence mechanisms via Windows Registry Run or RunOnce keys, specifically targeting the execution of Python scripts or common interpreted/executable files located in suspicious user profile directories (AppData, Temp, or Public folders). This behavior is characteristic of adversaries using Python-based remote access trojans (RATs) to maintain a foothold on a compromised host.
This rule detects potentially malicious file deletion activity initiated by a Java-based application. It looks for common deletion commands ('del', 'rm', 'Remove-Item', 'unlink') in process command lines originating from 'java.exe' or 'javaw.exe', specifically targeting common staging paths ('Users\Public', 'AppData\Local\Temp') or filenames matching a specific pattern ('cleo.' followed by digits). This pattern is consistent with the behavior of staging and cleaning up artifacts during an intrusion.
This rule detects potentially malicious modifications to agent configurations by monitoring for multiple significant changes within a short time frame (2 days) compared to a 14-day baseline. Monitored indicators include: changes to instructions, addition of new Model Context Protocol (MCP) servers, addition of new owners, and expansion of access permissions to include the entire organization. An alert is triggered when an agent exhibits at least two of these signals simultaneously.
The query builds a 14-day baseline snapshot and a 2-day current snapshot per agent from AgentsInfo, computes the four signals independently, then correlates them by AgentId and surfaces only agents with 2 or more signals firing in the same window. Output is a prioritized triage list instead of four separate alert streams.
The query builds a 14-day baseline snapshot and a 2-day current snapshot per agent from AgentsInfo, computes the four signals independently, then correlates them by AgentId and surfaces only agents with 2 or more signals firing in the same window. Output is a prioritized triage list instead of four separate alert streams.
This rule detects the execution of the Cloudflare Tunnel utility (cloudflared.exe) or similarly named binaries from non-standard, suspicious locations like temporary directories or public user folders. This pattern is commonly used by attackers to establish unauthorized persistent network tunnels (reverse proxies) into the victim's environment, bypassing firewall restrictions.
Page 34 of 59