Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,225 detections
Filters
Last updated
All Time
Detection languages
1,118
30
19
17
15
Contributors
391
236
131
85
62
Categories
313
252
228
185
166
Platforms
651
438
268
228
200
Products / Services
10,650
9,755
6,688
4,418
3,745
1,225
MITRE Techniques
264
259
234
217
208
CVEs
8
8
6
6
6
IDS Classtypes
2
2
1
1
1
IDS Protocols
2
1
Detects the execution of 'cloudflared', a tool used to establish secure tunnels from a local network to Cloudflare's edge, by monitoring for common command-line arguments such as 'service install', 'tunnel run', or '--url'. This behavior could indicate an attempt by an attacker to create a persistent or ad-hoc reverse proxy for remote access.
This rule detects the Python interpreter (python.exe or pythonw.exe) spawning system administration or shell utility processes (e.g., cmd.exe, powershell.exe, netsh.exe). It explicitly excludes Python processes running from typical installation directories, flagging potential execution of malicious Python-based payloads or command-and-control (C2) agents that interact with the host operating system.
This rule detects the Python interpreter (python.exe or pythonw.exe) spawning system administration or shell utility processes (e.g., cmd.exe, powershell.exe, netsh.exe). It explicitly excludes Python processes running from typical installation directories, flagging potential execution of malicious Python-based payloads or command-and-control (C2) agents that interact with the host operating system.
This rule detects persistence mechanisms via Windows Registry Run or RunOnce keys, specifically targeting the execution of Python scripts or common interpreted/executable files located in suspicious user profile directories (AppData, Temp, or Public folders). This behavior is characteristic of adversaries using Python-based remote access trojans (RATs) to maintain a foothold on a compromised host.
This rule detects persistence mechanisms via Windows Registry Run or RunOnce keys, specifically targeting the execution of Python scripts or common interpreted/executable files located in suspicious user profile directories (AppData, Temp, or Public folders). This behavior is characteristic of adversaries using Python-based remote access trojans (RATs) to maintain a foothold on a compromised host.
This rule detects the Python interpreter (python.exe or pythonw.exe) spawning system administration or shell utility processes (e.g., cmd.exe, powershell.exe, netsh.exe). It explicitly excludes Python processes running from typical installation directories, flagging potential execution of malicious Python-based payloads or command-and-control (C2) agents that interact with the host operating system.
Detects the full LegacyHive local privilege escalation chain (disclosed by Nightmare-Eclipse, July 2026): a TOCTOU race against the Windows User Profile Service (ProfSvc) using GLOBALROOT Object Manager symlinks and an oplock to trick ProfSvc, running as SYSTEM, into loading a different user's UsrClass.dat registry hive than the one it authenticated for.
This rule chains 3 stages on the same host within a 15-minute window:
(1) a staging copy of UsrClass.dat appearing outside its normal AppData profile path, typically in a randomly named folder off a drive root;
(2) an explicit-credential logon (Security 4648) immediately followed by a secondary-logon session (4624, LogonType 2, seclogon/Advapi) consistent with CreateProcessWithLogonW + LOGON_WITH_PROFILE;
(3) svchost.exe (ProfSvc) subsequently loading a UsrClass.dat whose profile owner does not match the helper account used in stage 2.
Requires Windows Security Event logs (Logon/Logoff auditing for 4648/4624) and Microsoft Defender for Endpoint DeviceFileEvents ingested into the same Sentinel workspace.
Known gap: Object Manager symlink creation and oplock placement, the mechanisms that perform the actual redirection, are not natively covered by Security auditing or MDE; consider supplementing with Sysmon/ETW if available.
Lab simulation checklist before enabling as high severity:
- Run the public PoC (https://github.com/MSNightmare/LegacyHive) against a lab VM with Security auditing (Logon/Logoff, Account Logon) and MDE onboarded.
- Confirm Stage 1 fires on the staging UsrClass.dat copy path and folder-name pattern.
- Confirm Stage 2's 4648/4624 pairing and LogonProcessName value match your OS build (may differ across Windows 10/11/Server releases).
- Confirm Stage 3's InitiatingProcessAccountName attribution for svchost.exe/ProfSvc; if it reports SYSTEM instead of the helper account, replace the ProfileOwner != Helper check with a LogonId/TargetLogonId correlation to Stage 2.
- Tune the staging-folder regex ag
This rule chains 3 stages on the same host within a 15-minute window:
(1) a staging copy of UsrClass.dat appearing outside its normal AppData profile path, typically in a randomly named folder off a drive root;
(2) an explicit-credential logon (Security 4648) immediately followed by a secondary-logon session (4624, LogonType 2, seclogon/Advapi) consistent with CreateProcessWithLogonW + LOGON_WITH_PROFILE;
(3) svchost.exe (ProfSvc) subsequently loading a UsrClass.dat whose profile owner does not match the helper account used in stage 2.
Requires Windows Security Event logs (Logon/Logoff auditing for 4648/4624) and Microsoft Defender for Endpoint DeviceFileEvents ingested into the same Sentinel workspace.
Known gap: Object Manager symlink creation and oplock placement, the mechanisms that perform the actual redirection, are not natively covered by Security auditing or MDE; consider supplementing with Sysmon/ETW if available.
Lab simulation checklist before enabling as high severity:
- Run the public PoC (https://github.com/MSNightmare/LegacyHive) against a lab VM with Security auditing (Logon/Logoff, Account Logon) and MDE onboarded.
- Confirm Stage 1 fires on the staging UsrClass.dat copy path and folder-name pattern.
- Confirm Stage 2's 4648/4624 pairing and LogonProcessName value match your OS build (may differ across Windows 10/11/Server releases).
- Confirm Stage 3's InitiatingProcessAccountName attribution for svchost.exe/ProfSvc; if it reports SYSTEM instead of the helper account, replace the ProfileOwner != Helper check with a LogonId/TargetLogonId correlation to Stage 2.
- Tune the staging-folder regex ag
Detects instances where a user receives an email containing a link to SharePoint or OneDrive, but upon clicking the link, the user is redirected to a different, non-Microsoft domain. This behavior is indicative of a phishing attempt using legitimate file-sharing services to bypass initial URL filtering.
Detects network activity associated with the TELEPUZ malware communicating with public Polygon blockchain RPC nodes. The malware interacts with a specific smart contract (0xf55Bea1FdCf1c3ABb39ab92567C09aC1BFf6753E) to resolve its AES-encrypted Command and Control (C2) server address.
This rule detects access to known adversary-in-the-middle (AiTM) phishing infrastructure mimicking Microsoft login pages. It identifies malicious URLs matching specific randomized path token patterns or those hosting a known phishing domain, while also monitoring for associated session-specific parameters such as 'rt=', 'PHPSESSID', and 'preload=1' cookies, as well as traffic interacting with legitimate 'login.microsoftonline.com' domains in a proxy context.
This rule monitors process execution events for activity related to known malware families (CryptoLoader, PsStealer, Net.loader, PureRAT) or processes executed from '_MEI' temporary directories. It aggregates events within a 15-minute window per device and user, alerting when two or more distinct processes are identified, which is indicative of malware staging or execution chains.
This KQL rule queries the IdentityInfo table to retrieve the most recent identity, risk, and criticality profile for a specific user account. It maps raw criticality data into a human-readable format and extracts key identity attributes such as department, job title, and assigned roles.
Detects successful non-interactive sign-ins to Azure CLI using the Resource Owner Password Credentials (ROPC) flow where Conditional Access policies failed to enforce multi-factor authentication (MFA). This typically indicates misconfigured Conditional Access policies, such as exclusions for non-interactive authentication methods or service accounts, which could be exploited by adversaries to bypass MFA.
Detects Node.js processes generating text or log files containing diagnostic markers related to network activity monitoring, such as 'Network Connection Dump Snapshot' or 'Monitoring active egress sockets'. This behavior is characteristic of custom tool execution used for network discovery and data collection on a host.
This rule detects successful sign-in events originating from IP addresses that have previously demonstrated a password-spraying pattern (multiple failed sign-ins across distinct accounts within a two-hour window). To reduce noise, it excludes successful logins originating from 'known' Autonomous System Numbers (ASNs) where at least 10 distinct users have historically authenticated successfully. The detection further filters for sessions lacking managed device identifiers and allows for manual exclusion of specific applications, IP addresses, or geographic locations.
Detects the creation of a local user account using net.exe or net1.exe followed immediately (within 10 minutes) by that same account being added to a local administrators group on the same device.
This rule detects successful Azure AD sign-in events (ResultType 0) that occur following a series of repeated failed sign-in attempts (ResultType 50126) from the same user account. The activity is specifically scoped to the LSHIY IPv6 address range and utilizes Azure CLI or similar mobile/desktop client applications, which is a strong indicator of an automated password spraying or credential stuffing attack followed by a successful compromise.
Detects potential remote code execution (RCE) via CVE-2026-55200 in libssh2-linked applications. The rule monitors for two signals: firstly, a post-exploitation child process (such as a shell or interpreter) spawned by a common libssh2-reliant application (e.g., ssh, curl, git, php) shortly after an outbound connection to TCP ports 22 or 2222; secondly, anomalous outbound network connections to port 2222 originating from these same libssh2-linked binaries.
Detects potential zero-click LLM prompt injection attacks against Microsoft 365 Copilot. The rule correlates Microsoft 365 Copilot activity involving external/untrusted URLs or domains with recent inbound email activity to the same user. This pattern is designed to identify scenarios where an attacker leverages an inbound email to trigger a Copilot interaction with malicious external content, potentially leading to unauthorized data access or exfiltration.
This rule detects command-line arguments and file names associated with the execution of Mimikatz or derived tools (such as SafetyKatz). It monitors for specific modules and flags, including credential harvesting (sekurlsa, lsadump, vault), DPAPI operations, and Kerberos manipulation, which are characteristic of adversary credential theft and privilege escalation activities.
Detects network, DNS, proxy, and email interactions with known Microsoft-themed lookalike domains used in Adversary-in-the-Middle (AiTM) phishing campaigns. These domains impersonate Microsoft login portals to facilitate credential and session token harvesting by kits such as EvilProxy, Sneaky2FA, and Tycoon.
Page 35 of 59