Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
This query is oriented to identify and classify browser extensions by group and risk severity based on a well-known list of browser extension.
A critical remote code execution vulnerability, CVE-2025-59287, affects Windows Server Update Services (WSUS), enabling unauthenticated attackers to execute arbitrary code via unsafe deserialization in the AuthorizationCookie.
Actively exploited since October 2025, this flaw targets WSUS servers on ports 8530/8531, often leaving forensic artifacts like modified SoftwareDistribution.log files and suspicious process chains involving w3wp.exe or wsusservice.exe spawning cmd.exe, powershell.exe, or net.exe.
The provided KQL query for Microsoft Defender XDR correlates network, file, and process events to detect exploitation attempts.
Actively exploited since October 2025, this flaw targets WSUS servers on ports 8530/8531, often leaving forensic artifacts like modified SoftwareDistribution.log files and suspicious process chains involving w3wp.exe or wsusservice.exe spawning cmd.exe, powershell.exe, or net.exe.
The provided KQL query for Microsoft Defender XDR correlates network, file, and process events to detect exploitation attempts.
This rule detects the presence of percent-encoded Bi-Directional (BiDi) control characters in URLs within network events. Specifically, it looks for '%E2%80%AE' (Right-to-Left Override - RLO), '%E2%80%8E' (Left-to-Right Mark - LRM), and '%E2%80%8F' (Right-to-Left Mark - RLM). These characters can be used to obfuscate URLs, making malicious links appear benign to users and potentially bypass security controls.
Detects when the Windows Server Update Services (WSUS) process (wsusservice.exe) or its associated IIS worker process (w3wp.exe with 'wsuspool' in its command line) spawns cmd.exe or powershell.exe. This activity is highly suspicious as WSUS services typically do not need to execute command-line interpreters, and could indicate an attempt to exploit a vulnerability or execute arbitrary commands on the system.
This rule detects the creation of common Windows command-line interpreters and utilities (cmd.exe, powershell.exe, pwsh.exe, powershell_ise.exe, whoami.exe, net.exe, net1.exe) when initiated by 'w3wp.exe'. The 'w3wp.exe' process is the IIS worker process, and the execution of these utilities from an IIS worker process can be indicative of web shell activity, compromise of the web server, or other malicious activity.
Detection based on: https://malwaretech.com/2025/10/exif-smuggling.html
This rule detects suspicious PowerShell execution patterns that might indicate an 'Exif smuggling FileFix Technique' or similar obfuscated command execution. It specifically looks for 'conhost.exe' launching PowerShell ('powershell.exe', 'pwsh.exe', 'pwsh.dll') with an encoded command ('-e' or '-EncodedCommand'), containing more than 5 spaces, and including a UNC path. This combination of indicators suggests an attempt to execute obfuscated PowerShell code, potentially from a remote source.
This rule detects suspicious PowerShell execution patterns that might indicate an 'Exif smuggling FileFix Technique' or similar obfuscated command execution. It specifically looks for 'conhost.exe' launching PowerShell ('powershell.exe', 'pwsh.exe', 'pwsh.dll') with an encoded command ('-e' or '-EncodedCommand'), containing more than 5 spaces, and including a UNC path. This combination of indicators suggests an attempt to execute obfuscated PowerShell code, potentially from a remote source.
This detection monitors the CommonSecurityLog (which adheres to the Common Event Format - CEF) for indications of malicious network activity. Specifically, it flags outgoing HTTP requests originating from system utilities such as curl, wget, and PowerShell. These requests are often leveraged by attackers for data theft (exfiltration) or establishing command-and-control channels.
Review the full user agent string and destination hostname. Investigate the source IP and user context. Check whether the tool usage aligns with expected behavior for the host or user. Correlate with other indicators such as unusual process execution, file access, or authentication anomalies. Escalate if the destination is unknown or suspicious. Remove the KQL summarise line to view more details.
UA_Check and SafeHosts will require tuning for your specific environment setup and traffic.
Review the full user agent string and destination hostname. Investigate the source IP and user context. Check whether the tool usage aligns with expected behavior for the host or user. Correlate with other indicators such as unusual process execution, file access, or authentication anomalies. Escalate if the destination is unknown or suspicious. Remove the KQL summarise line to view more details.
UA_Check and SafeHosts will require tuning for your specific environment setup and traffic.
This rule detects when a high number of downloads have been performed by a user from SharePoint. This could indicate an insider threat collecting data before sending it outside of the company.
This rule detects modifications to the HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CLSID}\InProcServer32 registry key where the RegistryValueData ends with ".dll" and does not point to common system directories (%systemroot%, C:\Program Files (x86)\, C:\Program Files\). This behavior is indicative of CLSID hijacking, a technique used by adversaries to achieve persistence or privilege escalation by redirecting legitimate COM object calls to a malicious DLL.
This rule detects a sequence of events indicative of a potential macOS ClickFix attack. It looks for a base64 encoded command executed by 'bash' or 'zsh', immediately followed (within 10 seconds) by a 'curl' command that initiates a network connection to a URL. The rule specifically excludes a whitelisted curl command to reduce false positives. The correlation of base64 execution, a subsequent curl command, and a successful network connection to the domain extracted from the curl command suggests an attempt to download and execute malicious content, possibly after decoding it.
KQL Query
Monitoring the execution of auditpol.exe can be crutial to detect first-stage of a real attack because they will be shown as previous steps to obfuscate the next execution such a ransomware.
KQL Query
This rule detects the installation of AppX or MSIX packages, specifically looking for installations initiated by PowerShell that are either developer-signed (EventID 855) or unsigned (EventID 603 with specific flags). It filters out known legitimate Microsoft packages to reduce false positives. The rule correlates PowerShell process events with device events related to AppX/MSIX installations within a 30-seconds window.
This rule detects the creation of executable files (.exe, .dll, .pyd) within browser extension folders (Chrome, Edge, Firefox) followed by a related registry modification within a one-hour window. This behavior is indicative of malicious browser extension installation or modification, often used for persistence or data exfiltration.
This rule detects suspicious execution of 'RUNDLL32.EXE' with specific command-line arguments. It looks for instances where 'RUNDLL32.EXE' is executed with both a backslash and a comma in the command line, combined with specific DLL names or keywords like 'iamnotarobot.dll', 'checkme.dll', 'machinerie.dll', 'humanCheck', or 'verifyme'. This pattern is often indicative of malicious DLL loading or persistence mechanisms.
This detection identifies network connections to external DNS servers over TCP (port 53) initiated by common scripting engines like PowerShell, Python, or WScript. While DNS over TCP is a valid protocol, it is less common for standard queries and is often used by malware for command and control (C2) or data exfiltration through DNS tunneling.
Detects the use of PowerShell to add exclusions to Microsoft Defender, which can be an attempt by an adversary to impair defenses and prevent detection of malicious activities.
Detects potential FileFix attacks where a web browser spawns a suspicious child process (e.g., command prompt, PowerShell, MSHTA) via the file upload dialog's address bar.
Enhancement:
This query correlates two queries to find cases where a user accessed RunMRU and then executed a suspicious PowerShell command.
RMU flags are added to get more close records mapped with Registry Access to RunMRU (Clipboard Paste via Run Dialog) Copy Clipboard data.
Enhancement:
This query correlates two queries to find cases where a user accessed RunMRU and then executed a suspicious PowerShell command.
RMU flags are added to get more close records mapped with Registry Access to RunMRU (Clipboard Paste via Run Dialog) Copy Clipboard data.
Detects the execution of heavily obfuscated PowerShell, characteristic of the MAYBEROBOT backdoor. COLDRIVER uses this script, often via a logon script for persistence, to download and execute further commands. The rule specifically looks for a combination of string replacement functions ('-replace', '\n', ';', '[^\x20-\x7E]') used by MAYBEROBOT for de-obfuscation before execution.
This rule detects suspicious activity related to Windows Server Update Services (WSUS) that could indicate compromise. It correlates three types of events: 1) external network connections to WSUS ports, 2) modifications to the WSUS log file (SoftwareDistribution.log), and 3) suspicious processes (like cmd.exe, powershell.exe, whoami.exe, net.exe) spawned by WSUS-related processes (w3wp.exe, wsusservice.exe) with specific command-line arguments. The rule aims to identify scenarios where an attacker might be interacting with or manipulating a WSUS server.
Page 463 of 509