Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
This rule analyzes historical logon, process, and network activity for a specified device over a configurable lookback period. It aims to validate whether a device, potentially flagged as decommissioned or stale, exhibits a pattern of sporadic, legitimate use (e.g., executive laptops, break-glass machines) rather than continuous or unauthorized activity. The output provides a daily timeline of activity, helping to differentiate between truly dormant assets and those with intermittent, legitimate usage.
Detects command-line activity indicative of mounting a remote WebDAV share, a technique used to bypass browser security controls and deliver malware. This rule looks for specific keywords used to force a connection to a remote WebDAV server.
KQL Query from file: DefenderXDR BlueHammer Detection
Detects the execution of the ScreenConnect ClientSetup MSI from the C:\Temp directory, indicating potential unauthorized deployment associated with fileless loader campaigns.
EXE Search
KQL
Gives you a report from a specific date and onwards of a certain file name that was used within the tenant. (Replace "Outlook.exe" with the file name you are looking for, and replace date to desired range)
Notes: LocalIP ≠ RemoteIP = Outbound connection
Notes: LocalIP ≠ RemoteIP = Outbound connection
This rule detects the loading of drivers that are known to be vulnerable, as listed in the LOLDrivers.io database. It correlates driver load events with a curated list of vulnerable driver hashes (SHA1 and SHA256) to identify potential Bring Your Own Vulnerable Driver (BYOVD) attacks.
This rule detects the execution of Remote Monitoring and Management (RMM) tools by service accounts. RMM tools are legitimate software used for IT administration, but their use by service accounts can be indicative of malicious activity, such as an adversary maintaining persistence or performing lateral movement using compromised credentials. The rule identifies processes whose filenames match a predefined list of RMM tool executables or process names and are executed by accounts identified as service accounts based on common naming patterns.
This rule detects the execution of AnyDesk from suspicious file paths that are not typically used for legitimate installations of remote access software. It identifies attempts to masquerade AnyDesk by placing it in system-like directories (e.g., Themes, Startup folders, Temp, or AppData subfolders with masquerading names) and also flags elevated executions (SYSTEM account) or service installations from these suspicious locations. The rule specifically excludes legitimate AnyDesk per-user installation paths to reduce false positives.
Detects suspicious process execution chains involving 'regsvr32.exe' followed by 'mshta.exe', 'powershell.exe', or 'rundll32.exe', especially when 'regsvr32.exe' is launched from common user download or application data directories. This pattern is often indicative of malware execution or living-off-the-land techniques.
Medusa Ransomware Script Execution
This rule detects the exposure of Kuwaiti Civil ID numbers in various log sources, including process command lines, additional device event fields, and email subjects/sender addresses. A Kuwaiti Civil ID is identified by a 12-digit number starting with 1, 2, or 3.
This rule detects the exposure of Kuwaiti Civil ID numbers in various log sources, including process command lines, additional device event fields, and email subjects/sender addresses. A Kuwaiti Civil ID is identified by a 12-digit number starting with 1, 2, or 3.
Detects indicators associated with the axios npm supply chain compromise by identifying suspicious payload execution (wt.exe in ProgramData) and persistence via the Windows Run registry key (MicrosoftUpdate). The rule triggers when either behavior is observed, providing visibility into potential post-compromise activity on Windows endpoints.
This rule detects suspicious activity across process events, file events, and network events by looking for specific SHA1/SHA256 hashes, command line arguments, folder paths, and remote URLs. The indicators suggest potential malware execution, file manipulation, or command and control communication.
Detects the creation of specific VBScript or PowerShell dropper files (6202033.vbs, 6202033.ps1) within temporary directories. This activity is indicative of malware attempting to establish a foothold or execute malicious code.
Detects suspicious network connections to 'sfrclak.com' on port 8000 or command-line activity involving 'curl' targeting 'packages.npm.org' on port 8000, potentially indicating malicious activity such as malware download or command and control communication. The rule specifically looks for various command-line patterns including 'cmd.exe' with PowerShell scripts, 'python' scripts, or 'com.apple.act.mond' related commands.
Just reading about a fake Boeing RFQ was enough to trigger a full attack chain — starting from a DOCX and moving through RTF, JavaScript, PowerShell and even a full Python runtime, ending with Cobalt Strike running in memory.
Nothing particularly new in terms of techniques, but the way everything is chained together makes it effective and easy to miss. It relies on tools and formats we see daily.
Being focus on catch the IoA Pattern, I created the KQL Detection below. PowerShell disabling TLS validation before downloading the payload, it’s a small step, but a very useful one from a detection point of view.
Nothing particularly new in terms of techniques, but the way everything is chained together makes it effective and easy to miss. It relies on tools and formats we see daily.
Being focus on catch the IoA Pattern, I created the KQL Detection below. PowerShell disabling TLS validation before downloading the payload, it’s a small step, but a very useful one from a detection point of view.
This rule detects suspicious process command-line activity on devices identified as ATMs. It looks for known malware-related executables (CSCSERVICE.EXE) and common ATM software components (DISPENSR, XFS, MSXFS, AGILIS, APTRA, PROCASH, *.xfs) being executed or initiated by unusual processes like svchost.exe, rundll32.exe, or regsvr32.exe. This activity could indicate an attempt at ATM jackpotting or other unauthorized access.
Detects network connections to a suspicious Vercel application URL ('vscode-ext-git.vercel.app') combined with file events initiated by command-line shells (cmd.exe, powershell.exe, pwsh.exe) using 'curl' in their command line. This correlation suggests potential ingress tool transfer or data exfiltration attempts.
Requires Defender DeviceNetworkEvents table
Group together attempted connections from single remote IPs and bin them into time intervals. For each remote IP series find a best fit line and extend the slope measure. Using the slope attribute display the outliers.
Varying the timespan does change the results, long timespans will only display very noisy port scans whereas short timespans tend to produce more false positives.
Group together attempted connections from single remote IPs and bin them into time intervals. For each remote IP series find a best fit line and extend the slope measure. Using the slope attribute display the outliers.
Varying the timespan does change the results, long timespans will only display very noisy port scans whereas short timespans tend to produce more false positives.
Detects network connections to a suspicious Vercel application URL combined with file events initiated by command-line shells (cmd.exe, powershell.exe, pwsh.exe) using 'curl' in their command line. This correlation suggests potential data exfiltration attempts as noted in the linked blog post.
Page 438 of 509