Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,224 detections
Filters
Last updated
All Time
Detection languages
1,117
30
19
17
15
Contributors
391
236
131
85
62
Categories
313
252
228
185
166
Platforms
651
437
269
228
200
Products / Services
10,680
9,761
6,694
4,418
3,744
1,224
MITRE Techniques
265
260
234
217
209
CVEs
8
8
6
6
6
IDS Classtypes
2
2
1
1
1
IDS Protocols
2
1
his query hunts for Beagle malware indicators by correlating suspicious file artifacts (NOVupdate.exe, avk.dll, Claude.msi), process command-line executions, and potential network callbacks. It unifies multiple telemetry sources to surface persistence, DLL sideloading, and C2 activity aligned with MITRE ATT&CK techniques.
his detection identifies suspicious execution of update.exe processes launched by svchost.exe from user-writable directories such as AppData, Temp, Downloads, and Public folders.
This behavior is associated with malware techniques observed in the MiniFast campaign, where attackers use fake updater binaries and service-based execution chains to evade detection and maintain persistence.
The rule helps detect:
Malicious or fake update.exe execution
Abnormal parent-child process relationship (svchost.exe → update.exe)
Execution from non-standard user directories
Potential malware staging and execution behavior
This detection is intended to identify early-stage malware execution and suspicious process behavior linked to threat actor techniques described in recent threat intelligence reports.
This behavior is associated with malware techniques observed in the MiniFast campaign, where attackers use fake updater binaries and service-based execution chains to evade detection and maintain persistence.
The rule helps detect:
Malicious or fake update.exe execution
Abnormal parent-child process relationship (svchost.exe → update.exe)
Execution from non-standard user directories
Potential malware staging and execution behavior
This detection is intended to identify early-stage malware execution and suspicious process behavior linked to threat actor techniques described in recent threat intelligence reports.
This detection identifies suspicious child process execution spawned from Notepad++ (notepad++.exe), which may indicate exploitation attempts related to CVE-2026-48778 and CVE-2026-48800. These vulnerabilities involve potential arbitrary code execution through malicious manipulation of Notepad++ configuration (config.xml) and shortcut (shortcuts.xml) files.
The rule detects abnormal execution of system binaries such as PowerShell, CMD, MSHTA, Rundll32, and Regsvr32 launched from Notepad++, which is not expected in normal user activity. Such behavior may indicate successful exploitation, plugin abuse, or post-exploitation execution triggered via malicious configuration or user interaction.
This detection is intended for identifying early indicators of code execution chains originating from Notepad++.
The rule detects abnormal execution of system binaries such as PowerShell, CMD, MSHTA, Rundll32, and Regsvr32 launched from Notepad++, which is not expected in normal user activity. Such behavior may indicate successful exploitation, plugin abuse, or post-exploitation execution triggered via malicious configuration or user interaction.
This detection is intended for identifying early indicators of code execution chains originating from Notepad++.
Detects sign-in or Microsoft Graph API activity using user-agent strings characteristic of ROADtools and similar Python-based identity-attack tooling. The rule generalizes beyond ROADtools to catch AzureHound, MicroBurst, MFASweep, GraphRunner, and similar identity attack frameworks by looking for scripting user-agents (python, requests, urllib, curl) which signal non-browser, non-app authentication that is inherently suspicious for Entra ID admin operations.
Detects installation or update of a VSCode extension from an unapproved publisher by monitoring for vsce-sign.exe signature verification events in DeviceProcessEvents. VSCode invokes vsce-sign.exe once per extension install or auto-update to verify the extension's marketplace signature before extraction. The full extension slug is passed as the --package argument, making this a reliable, install-time signal that fires for all extension types regardless of whether the extension has a background process or language server.
Extensions are evaluated against an approved publisher list maintained as an embedded datatable. Publishers are matched on the prefix before the first . in the extension slug (e.g., ms-python from ms-python.python), allowing publisher-level approval rather than per-extension management.
This detection was developed in response to the TeamPCP supply chain campaign (May 2026), in which malicious VSCode extensions were distributed via fake GitHub issue notifications targeting developers.
Extensions are evaluated against an approved publisher list maintained as an embedded datatable. Publishers are matched on the prefix before the first . in the extension slug (e.g., ms-python from ms-python.python), allowing publisher-level approval rather than per-extension management.
This detection was developed in response to the TeamPCP supply chain campaign (May 2026), in which malicious VSCode extensions were distributed via fake GitHub issue notifications targeting developers.
This can be used as an alert that can be sent when a severe vulnerability affects your onboarded devices.
You can replace the country in line 2 using the country codes available at https://learn.microsoft.com/en-us/linkedin/shared/references/reference-tables/country-codes
Detects AiTM compromise where user click phishing URL, completed MFA, and signed in from a different IP within 10 minutes
Detects Node.js processes querying public IP-address and geolocation lookup services. This automated reconnaissance behavior is the standard "where am I" primitive used by an enormous range of Node-based malware and supply chain campaigns including PhantomRaven (npm), Shai-Hulud, the Bitwarden CLI compromise, Ultralytics-style attacks, and countless commodity Node-based stealers and droppers. Legitimate Node applications rarely query public IP services from developer endpoints — when they do, it is most often during malicious package install lifecycle hooks or within fileless droppers fetched from attacker-controlled C2 servers.
Creating multiple detections without reviewing them over time to ensure they’re still effective can easily turn them into pure noise, adding nothing but fatigue to our day-to-day incident analysis.
The DOVE Model (Detection Overlap & Value Evaluation) evaluates detections across four main dimensions (https://zenodo.org/records/20011459):
1. Detection Type
IOC-based detections tend to have a shorter lifecycle, current TI sources are collecting a huge number of indicators based on new attack or threats which present a higher duplication risk.
IOA-based detections focus on behaviors, have a longer lifecycle, provide higher unique value and requires extended time to create corresponding detection.
2. System / Technology Coverage
Mainstream technologies (e.g., Windows, M365, macOS) are heavily monitored and widely covered by SIEM platforms, increasing duplication probability.
Non-mainstream or custom systems offer less coverage and therefore provide opportunities for more unique detections.
3. Threat Recency
Older or well-known threats are widely documented and likely already covered by existing detections.
New or emerging threats are less likely to be covered, reducing duplication risk and increasing detection value.
4. Source / Provider
Built-in or native detections are already integrated into SIEM platforms and often overlap with custom logic.
Custom or third-party detections introduce tailored logic and reduce overlap probability.
The following KQL query can evaluate how useful are our current detections with the aim to detect alerts that are showing the same assets within the same hour, which indicates potential overlap.
Custom detections added in current SIEM or XDR solutions can easily turn from useful detections into noise, so analyzing their results is crucial.
The DOVE Model (Detection Overlap & Value Evaluation) evaluates detections across four main dimensions (https://zenodo.org/records/20011459):
1. Detection Type
IOC-based detections tend to have a shorter lifecycle, current TI sources are collecting a huge number of indicators based on new attack or threats which present a higher duplication risk.
IOA-based detections focus on behaviors, have a longer lifecycle, provide higher unique value and requires extended time to create corresponding detection.
2. System / Technology Coverage
Mainstream technologies (e.g., Windows, M365, macOS) are heavily monitored and widely covered by SIEM platforms, increasing duplication probability.
Non-mainstream or custom systems offer less coverage and therefore provide opportunities for more unique detections.
3. Threat Recency
Older or well-known threats are widely documented and likely already covered by existing detections.
New or emerging threats are less likely to be covered, reducing duplication risk and increasing detection value.
4. Source / Provider
Built-in or native detections are already integrated into SIEM platforms and often overlap with custom logic.
Custom or third-party detections introduce tailored logic and reduce overlap probability.
The following KQL query can evaluate how useful are our current detections with the aim to detect alerts that are showing the same assets within the same hour, which indicates potential overlap.
Custom detections added in current SIEM or XDR solutions can easily turn from useful detections into noise, so analyzing their results is crucial.
Detects creation or modification of the SafeBoot\Network\Remote Access Service registry key, a persistence mechanism used by the STAC6405 (VENOMOUS#HELPER) campaign. This ensures the SimpleHelp-based RAT survives Safe Mode with Networking reboots, which is a common remediation step for defenders. The specific 'Remote Access Service' subkey under SafeBoot\Network is a static Indicator of Compromise (IOC) for this campaign, as modifications to SafeBoot\Network are generally rare in benign Windows operations.
Detects high-fidelity static artifacts from VECT 2.0 across Windows, Linux, and ESXi variants. This includes known SHA-256 hashes of the ransomware executables, the '.vect' encrypted file extension, the '!!!READ_ME!!!.txt' ransom note, the 'dvm3_wall.bmp' wallpaper, the 'vector_notice.sh' shell hook, and the embedded Tor C2 hostname. These indicators are unique to VECT ransomware and have no legitimate use.
This detection highlights potential privilege escalation through misuse of the Agent ID Administrator role. In the past, this role has been exploited to bypass restrictions by granting the actor ownership of sensitive Service Principals, enabling them to add unauthorized credentials.
Detects signed executable files with untrusted certificates (expired, revoked,
or broken chain) that were downloaded from the internet and executed within one
hour of being written to a high-risk path such as user temp, AppData, Downloads,
or Public directories.
An untrusted certificate on a downloaded executable can indicate use of a
revoked or stolen code-signing certificate, a technique observed in multiple
Iranian APT campaigns including Seedworm/MuddyWater (ref: CyberProof, April 2026)
and consistent with CISA advisory AA26-097A.
Note: IsTrusted reflects certificate status at time of MDE cloud scan, not
real-time revocation status. Files executed before MDE scan completion or before
CA revocation may not be detected.
or broken chain) that were downloaded from the internet and executed within one
hour of being written to a high-risk path such as user temp, AppData, Downloads,
or Public directories.
An untrusted certificate on a downloaded executable can indicate use of a
revoked or stolen code-signing certificate, a technique observed in multiple
Iranian APT campaigns including Seedworm/MuddyWater (ref: CyberProof, April 2026)
and consistent with CISA advisory AA26-097A.
Note: IsTrusted reflects certificate status at time of MDE cloud scan, not
real-time revocation status. Files executed before MDE scan completion or before
CA revocation may not be detected.
Detects curl commands using user-agent strings that Sapphire Sleet uses as campaign tracking identifiers in their macOS intrusion chain. Each stage of the cascading payload delivery uses a distinct UA (mac-cur1 through mac-cur5) to route requests to different server paths serving AppleScript payloads or ZIP archives containing malicious .app bundles.
Identifies an event where there are there are too many accounts assigned the Global Administrator role.
Identifies when an account hasn't signed in during the past n number of days.
Invalid PIM License
Sigma
Identifies when an organization doesn't have the proper license for PIM and is out of compliance.
Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack.
Identifies when the same privilege role has multiple activations by the same user.
Identifies when a privilege role can be activated without performing mfa.
Page 45 of 59