Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,224 detections
Filters
Last updated
All Time
Detection languages
1,117
30
19
17
15
Contributors
391
236
131
85
62
Categories
313
252
228
185
166
Platforms
651
437
269
228
200
Products / Services
10,680
9,761
6,694
4,418
3,744
1,224
MITRE Techniques
265
260
234
217
209
CVEs
8
8
6
6
6
IDS Classtypes
2
2
1
1
1
IDS Protocols
2
1
Identifies when a user has been assigned a privilege role and are not using that role.
Detects network activity consistent with a user attempting to download or install OpenClaw or a known variant — an open-source AI agent family classified as a Potentially Unwanted Application (PUA). Monitors for access to OpenClaw distribution URLs including GitHub releases, the install script endpoint, raw GitHub content, and npm registry paths for known variants. Also detects variant names appearing in process command lines at the time of a network connection, covering alternative package managers and runtimes such as Bun, pnpm, Yarn, and Deno in addition to traditional browsers and shell tools. Covers 33 known variants of the OpenClaw family including Clawdbot, Moltbot, Ironclaw, MalClaw, and others.
Detects installation and post-installation activity associated with OpenClaw and its known variants — an open-source AI agent family classified as a Potentially Unwanted Application (PUA). Monitors for npm global install commands, execution of shell installer scripts, OpenClaw-related binary or package files written to disk, and outbound network activity originating from known OpenClaw agent processes. Covers 33 known variants of the OpenClaw family including Clawdbot, Moltbot, Ironclaw, MalClaw, and others.
Detects mass device wipe, retire, or delete operations performed via Microsoft Intune, inspired by the Stryker/Handala attack. This rule combines five detection signals: static velocity threshold, bulk destructive actions from a single operator, first-time operator detection, UEBA anomaly correlation, and ML anomaly detection. Operations are categorized into Tier 1 (critical, zero baseline activity like wipe/retire) and Tier 2 (high, legitimate IT ops activity like device delete, subject to velocity and ML thresholds). Severity escalates based on the number of overlapping signals.
This is highly adjustable script that tells us whether HTTPS request was successful, the reason why it was blocked or not, and on top of that, it explains the error code. This is still a work-in-progress but it already does 99% of the job.
This rule detects network communication with known AI model providers by checking `RemoteUrl` against a list of AI API URLs from an external CSV file. It aims to identify potential unauthorized use of AI services, data exfiltration to AI models, or to monitor AI usage within an environment.
This query will work every 30 minutes to see if anyone that's not InfoSec performed any administrative Identity actions on users. This will also depend on your company policy, if only Information Security members are allowed to perform actions on risky users such as dismissing users, then this will trigger.
This KQL script detects if end user interacted with a PDF attachment in a potential phishing/BEC incident
This rule detects outbound network connections to known Command and Control (C2) and exfiltration domains associated with the SANDWORM_MODE campaign. These domains are used to exfiltrate stolen credentials and other sensitive data.
This detection identifies potentially malicious SSH tunneling activity initiated by OpenClaw‑derived AI agents, including earlier variants such as Clawdbot and Moltbot. OpenClaw is known to operate with extensive access to the underlying operating system and command‑line interface, creating opportunities for misuse when vulnerable or misconfigured. Instances of OpenClaw have been shown to expose sensitive automation capabilities, making them a high‑risk launching point for unauthorized system‑level actions.
The rule specifically looks for SSH or Plink processes executed with tunneling or proxying flags (such as -L, -R, -D, -oProxyCommand, and similar switches commonly associated with port forwarding, lateral movement, credential exfiltration, covert channels, and SOCKS proxy creation). When these commands originate from OpenClaw, Clawdbot, or Moltbot processes, it may indicate that an AI agent has been compromised or repurposed to establish unauthorized remote access pathways.
The rule specifically looks for SSH or Plink processes executed with tunneling or proxying flags (such as -L, -R, -D, -oProxyCommand, and similar switches commonly associated with port forwarding, lateral movement, credential exfiltration, covert channels, and SOCKS proxy creation). When these commands originate from OpenClaw, Clawdbot, or Moltbot processes, it may indicate that an AI agent has been compromised or repurposed to establish unauthorized remote access pathways.
Multi-layered detection rule that identifies anomalous behavior on privileged accounts across six independent detection layers: absolute rule violations ("never actions"), self-calibrating ratio-based thresholds, behavioral technique substitution (e.g., WMI drop-off while other lateral movement continues), time-series statistical anomaly detection via series_decompose_anomalies(), reconnaissance burst detection on LDAP/directory queries, and MFA gap analysis. All layers roll up into a composite risk score for analyst prioritization. Originally derived from diffpatterns() analysis of real penetration test data vs. normal operations, this community edition replaces environment-specific hardcoded thresholds with self-calibrating statistical baselines. Requires Microsoft Defender for Identity and Entra ID Sign-in Logs.
This simple script detects whether a user clicked on a URL in an email message. It uses the 'UrlClickEvents' table in Sentinel to identify such interactions, as well as the 'EmailEvents' table to correlate the email message with the URL click event.
Detect the email delivery delta, comparing before and after the Priority Account Protection Enablement date.
This detection identifies the execution of SyncAppvPublishingServer.vbs—a legitimate Microsoft App‑V script—when launched under wscript.exe or cscript.exe, which is abnormal outside of App‑V environments. Although the script is signed by Microsoft and intended to support application publishing workflows, threat actors have increasingly adopted it as a LOLScript-based execution proxy. By invoking this script directly and supplying crafted arguments, adversaries can cause it to spawn PowerShell or run additional commands on their behalf, often without ever calling powershell.exe explicitly. This evasion is highly effective against visibility controls that rely on direct process-name monitoring.
Detects files being written to USB-mounted removable drives. The rule enriches these alerts with USB device identifiers such as VID_PID, InstancePathId, and SerialNumberId, gathered from fleet-wide Plug and Play (PnP) events. This enrichment allows security analysts to cross-reference the detected USB devices against an organization's approved device exclusion list, potentially managed by solutions like Microsoft Intune, to differentiate legitimate data transfers from potential data exfiltration attempts.
This KQL query identifies file creation events within common Windows startup directories and enriches them with Windows Shell Link (shortcut) creation activity.
Startup folders are frequently abused by adversaries for persistence since files or shortcuts placed here automatically execute at user login. The query covers both system-wide and user-specific startup paths and can exclude known legitimate items via an exclusion list to reduce false positives.
Startup folders are frequently abused by adversaries for persistence since files or shortcuts placed here automatically execute at user login. The query covers both system-wide and user-specific startup paths and can exclude known legitimate items via an exclusion list to reduce false positives.
This is a KQL script to automate investigation by full email address. This can be pitched as a workbook as well. Keep in mind all the extra stuff is there for automation, this doesn't need to be your day-to-day query. There's simpler stuff you can make it on the fly in a matter of seconds and give you similar results. This here is for extra information in case you need a single pane of glass.
Detects successful VPN connections from various common security devices logging to CommonSecurityLog. Monitoring successful VPN logins is crucial for tracking remote access and identifying potential unauthorized access, especially when correlated with other events like logins from unusual locations or impossible travel scenarios.
Of course you can get an easier version to simply search emails by subject, this is too verbose. But this is used to make a workbook that will display a set of information about the incident and give you the possibility to click on a button, generate this and visit the incident's page.
This query utilizes the IOCs provided by Rapid7 and focuses on columns in the DeviceFileEvents, DeviceProcessEvents and DeviceNetworkEvents tables. This is a high FP query, however each event will require an investigation to its legitimacy. The query accounts for all devices that have installed notepad++ in the past 400d and only looking for IOCs within time of known compromise in order to save on resources. Some IOCs are commented out due to high FP rate.
Detects indicators of compromise related to trojanized ScreenConnect installers and abuse of ScreenConnect C2 configuration. This rule identifies suspicious process executions of ScreenConnect components, known malicious hashes associated with ScreenConnect malware, ScreenConnect processes launched by installer executables (msiexec), network connections to ScreenConnect relay domains, DNS resolutions for ScreenConnect relays, modifications to 'system.config' files within ScreenConnect directories indicative of C2 configuration, and malicious registry artifacts related to ScreenConnect installation.
Page 46 of 59