Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,061 detections
Filters
Last updated
All Time
Detection languages
15,357
13,598
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,759
3,853
3,760
3,714
Platforms
40,061
7,331
6,542
3,907
3,664
Products / Services
10,439
9,679
6,724
1,888
1,879
MITRE Techniques
13,740
13,119
8,066
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
This rule detects potential execution of malicious files from removable media (e.g., USB drives). It monitors for a sequence of events where a removable drive is mounted, a file is subsequently created on that drive, and then that same file is executed within a short time window.
This rule detects potential execution of malicious files from removable media (e.g., USB drives). It monitors for a sequence of events where a removable drive is mounted, a file is subsequently created on that drive, and then that same file is executed within a short time window.
Detects the execution of batch files named 'db.bat' or 'adb.bat' from the Windows User Temp directory using cmd.exe. This activity is a known indicator of the OpnKey ransomware, which utilizes these scripts to facilitate its operations.
This KQL detects potential social engineering and vishing activity in Microsoft Teams over the last 30 days.
Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL.
Detects the use of the Windows schtasks utility to delete a scheduled task named 'Windows Update'. This pattern is associated with OpnKey ransomware, which attempts to remove legitimate or potentially competing tasks to maintain persistence or avoid detection.
Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL.
Detects the deletion of a file named 'Config.ini', a behavior associated with the OpnKey ransomware for cleaning up configuration artifacts after its execution cycle.
Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL.
Detects the execution of the Bun JavaScript runtime invoking 'index.js' as part of an npm lifecycle event (such as preinstall). This pattern is commonly used in supply chain attacks to execute arbitrary code during the installation of malicious packages.
Detects attempts to install or modify the 'WMI Provider Host' (WmiPrvSE) service, which is a common technique used by adversaries for persistence or to masquerade malicious activity. The rule monitors process execution, registry modifications, and service installation events specifically targeting this service name.
This rule detects potential attempts to tamper with or bypass Windows Defender by monitoring for files or processes named 'ShieldCrash' occurring in close temporal proximity to the creation or modification of files within Windows Defender's shadow or scan directories (BaseNamedObjects\Restricted\WD_SHADOW_ or WD_SCAN). This behavior is often associated with malware attempting to evade security detection.
Detects the use of PowerShell cmdlets such as Invoke-WmiMethod, Invoke-CimMethod, Get-CimInstance, or Get-WmiObject to interact with the Win32_Process class for process creation on local or remote systems. This behavior is frequently associated with administrative activity but is also commonly used by adversaries for remote command execution and lateral movement.
This rule monitors network connections and DNS query responses for activity associated with known suspicious domains: 'getmacouscloud.com', 'ferncore13.com', and 'grove-89.com'. It identifies communication attempts (successes, failures, or DNS lookups) between endpoints and these domains, which is indicative of potential command and control (C2) activity.
This rule monitors network connections and DNS query responses for activity associated with known suspicious domains: 'getmacouscloud.com', 'ferncore13.com', and 'grove-89.com'. It identifies communication attempts (successes, failures, or DNS lookups) between endpoints and these domains, which is indicative of potential command and control (C2) activity.
This rule monitors network traffic, DNS queries, and user web clicks to detect interactions with known malicious domains associated with credential harvesting and phishing campaigns, specifically those impersonating security or SSO portals.
Detects anomalous child process execution by Chromium-based browsers (e.g., chrome.exe, msedge.exe, brave.exe). This behavior is indicative of potential exploitation of browser vulnerabilities such as CVE-2026-85046, where a memory corruption vulnerability is leveraged to escape the browser sandbox and execute arbitrary commands via interpreters like cmd.exe or powershell.exe.
SAMR User and Domain Enumeration via RPC
Cortex XDR
Detects high-volume usage of SAMR RPC functions (SamrEnumerateUsersInDomain, SamrLookupNamesInDomain, SamrQueryInformationUser) used to enumerate domain users and account attributes. This behavior is indicative of reconnaissance activities performed by tools such as secretsdump, BloodHound, and NetExec.
This rule detects potentially suspicious file deletion activity originating from PowerShell processes (powershell.exe or pwsh.exe). It monitors for commands targeting temporary directories and specific file extensions (such as .vbs, .lnk, .js, or .ps1) combined with recursive deletion arguments. Additionally, it highlights scenarios where these PowerShell commands are executed by potentially unusual parent processes such as script engines (wscript.exe, cscript.exe, mshta.exe) or other command-line utilities.
Detects instances where the Windows Character Map utility (charmap.exe) loads both 'amsi.dll' (Antimalware Scan Interface) and 'clr.dll' (Common Language Runtime). This combination is highly anomalous for charmap.exe and is indicative of process injection or defense evasion attempts, often associated with executing arbitrary malicious code within a trusted system process.
Detects potential process injection attempts involving 'charmap.exe', a Windows system utility. The rule monitors for a sequence of memory management and thread creation API calls (OpenProcess, VirtualAlloc, WriteProcessMemory, and CreateRemoteThread) originating from or targeting this binary, which is often abused as a host for malicious code to bypass security controls.
Page 379 of 1908