Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
This query identifies an anomalous pattern associated with behavior performed using the PhaaS platform with adversary-in-the-middle (AiTM) capabilities, DadSec.
A Tor exit node is the last server in the Tor network that your traffic passes through before it reaches the public internet so it is the one that actually makes the connection to website.
In this particular query, I am getting the devices with connections to Tor Exit Nodes, to list to which node are connecting and possible suspicious URLs with connections to the mentioned servers.
In this particular query, I am getting the devices with connections to Tor Exit Nodes, to list to which node are connecting and possible suspicious URLs with connections to the mentioned servers.
Detects the use of the 'attrib.exe' utility to set the hidden attribute on a .lnk file. Adversaries may use this technique to hide malicious shortcuts used for persistence or initial execution.
This rule detects the execution of unsigned or invalidly signed executable files from user-writable folders such as \Users\ or \ProgramData\. It specifically looks for process creation events where the initiating process's signature status is not 'Valid' and the SHA256 hash of the executable is not in a predefined whitelist. Additionally, it filters for executables with a global prevalence of less than 2500 and an unsigned signature state. This aims to identify potentially malicious or unauthorized software being run from locations where users typically have write permissions, bypassing standard software deployment and security controls.
Detects a sequence of file operations indicative of CLFS Base Log File (.blf) tampering, a technique used in CVE-2024-49138 exploitation. The detection looks for a process writing to a .blf file, immediately followed by a read of the same file, which is an unusual pattern as regular applications use CLFS APIs, not direct file writes.
IOCs and behavior from Danabot version 669
Detects a pattern of behavior associated with VanHelsing ransomware's lateral movement, where an executable is written to a device over SMB and then executed shortly after. This is indicative of remote code execution techniques like those using PsExec.
Detects potential command-and-control (C2) activity associated with Lazarus Group malware, such as Cryptoistic. This rule identifies outbound TCP connections that do not appear to be using a standard application-layer protocol like HTTP/S, which is a characteristic of some custom backdoors used by the group. The rule filters for successful outbound TCP connections with an empty RemoteUrl, excluding private IP ranges and a allowlist of common processes. It further prioritizes processes running from suspicious user-writable locations and requires more than two connection attempts to reduce noise.
A detection triggered on endpoint events where common system binaries (e.g., mshta.exe, powershell.exe, cmd.exe) were launched by user-facing parent processes (explorer.exe, chrome.exe, msedge.exe, firefox.exe, iexplore.exe) and executed suspicious command-lines. The pattern matches the evolving technique used in ClickFix-style campaigns whereby malicious pages dynamically place payloads into the clipboard and prompt users to paste or execute them.
Detects indicators associated with a watering hole attack originating from a compromised xubuntu.org website. This includes the creation of a tampered 'tos.txt' file, the dropping and execution of a trojanized dropper ('elzvcf.exe') in AppData\Roaming, and the establishment of persistence via a registry Run key.
This rule identifies and summarizes the usage of various Remote Monitoring and Management (RMM) tools across an environment. It correlates process execution events (based on executable and process names) and network connection events (based on remote URLs/domains) with a predefined list of known RMM tools. The output provides a count of unique devices using each RMM tool, grouped by machine group, allowing for an overview of RMM tool prevalence and distribution.
This KQL query hunts for repeated remote logon activity (via RDP or similar) from source devices that lack Microsoft Defender for Endpoint (MDE) telemetry to server-class devices over an extended period (default 60 days). It identifies patterns where a non-monitored endpoint consistently connects to a server daily or near-daily, which may indicate:
=> Compromised or unmanaged jump hosts
=> Lateral movement from external or BYOD devices
=> Unauthorized administrative access from unmonitored workstations
=> Potential living-off-the-land or persistence techniques
The detection focuses on initiating devices without MDE sensor data (HasTelemetry == false) targeting servers, with logons occurring on multiple distinct days, suggesting routine access rather than one-off events.
Cross validate via HasTelemetry == true (i.e with this changes it identifies source devices which are reporting with proper MDE.)
KQL for MDE.
=> Compromised or unmanaged jump hosts
=> Lateral movement from external or BYOD devices
=> Unauthorized administrative access from unmonitored workstations
=> Potential living-off-the-land or persistence techniques
The detection focuses on initiating devices without MDE sensor data (HasTelemetry == false) targeting servers, with logons occurring on multiple distinct days, suggesting routine access rather than one-off events.
Cross validate via HasTelemetry == true (i.e with this changes it identifies source devices which are reporting with proper MDE.)
KQL for MDE.
Detects suspicious behavior where a Node.js-based application launches cmd.exe to query MachineGuid from the registry, indicating potential fingerprinting or persistence activity by EvilAi malware. The rule specifically looks for processes initiated from a suspicious folder path, where node.exe is the parent process, and cmd.exe is used to query 'HKLM\Software\Microsoft\Cryptography' for 'MachineGuid'.
Detecting post-exploitation attempts based on RomCom group adversary activity and the following malware/backdoor signatures: Mythic agent, SnipBot and MeltingClaw.
Based on the following threat reports after the WinRAR CVE-2025–8088 exploitation.
1. ESET: https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/
2. Talos: https://blog.talosintelligence.com/uat-5647-romcom/
Based on the following threat reports after the WinRAR CVE-2025–8088 exploitation.
1. ESET: https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/
2. Talos: https://blog.talosintelligence.com/uat-5647-romcom/
Detects network connections to blockchain APIs that are indicative of EtherHiding techniques, specifically those used by UNC5342 to retrieve malicious payloads. It identifies connections to domains containing keywords like 'explorer', 'block', 'cypher', 'eth', 'bit', 'coin', or 'crypto', combined with suspicious URL patterns such as 'eth_call' (a read-only function call for smart contracts) or 'apiKey=freekey' (a common free API key used by threat actors).
This rule detects suspicious, obfuscated PowerShell commands by analyzing the command line for long string literals with low character diversity and high frequency of a single character. It extracts strings enclosed in single quotes, double quotes, or backticks, and then calculates the ratio of distinct characters to total length and the ratio of the most frequent character's count to total length. If these ratios fall below and above certain thresholds, respectively, the command is flagged as suspicious.
This rule detects suspicious process activity originating from Windows Server Update Services (WSUS) processes (wsusservice.exe or w3wp.exe with 'wsuspool' in its command line) that then execute known Living Off The Land Binaries (LOLBINs) associated with ingress tool transfer (T1105) or common Windows execution binaries such as cmd.exe, powershell.exe, or certutil.exe. This behavior could indicate the exploitation of a Remote Code Execution vulnerability in WSUS, such as CVE-2025-59287.
This detection identifies command-line activity consistent with attempts to stop, uninstall, or otherwise tamper with the CrowdStrike Falcon agent. It looks for specific commands and utilities (sc.exe, net.exe, powershell.exe, falconctl.exe, taskkill) used in conjunction with CrowdStrike-related keywords to detect attempts to disable, uninstall, or terminate the agent's processes or services.
NTDS theft
KQL
Microsoft has observed compromises related to Bazacall resulting in theft of the Active Directory database using ntdsutil.exe.
This rule detects the execution of command-line interpreters (cmd.exe or powershell.exe) by either the w3wp.exe process (IIS worker process) or the wsusservice.exe process (Windows Server Update Services). This behavior can indicate a compromise, potentially leveraging vulnerabilities in web applications or WSUS to achieve remote code execution.
To detect sensitive or confidential information sent by email from our users, I discovered that DefenderXDR is registering events when some user or services is reading files tagged or marked as sensitive. Basically, it has a "SensitiveFileRead" ActionType in the DeviceFileEvents table which indicates that a process on the monitored device has accessed a file classified as sensitive. This could include files with personally identifiable information (PII), intellectual property, or other data deemed sensitive based on the organization’s data protection policies or Microsoft’s predefined rules. This event type is essential for tracking access to sensitive data, helping to identify potential data leakage or unauthorized access attempts.
Page 462 of 509