Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,224 detections
Filters
Last updated
All Time
Detection languages
1,117
30
19
17
15
Contributors
391
236
131
85
62
Categories
313
252
228
185
166
Platforms
651
437
269
228
200
Products / Services
10,680
9,761
6,694
4,418
3,744
1,224
MITRE Techniques
265
260
234
217
209
CVEs
8
8
6
6
6
IDS Classtypes
2
2
1
1
1
IDS Protocols
2
1
This alert generates a log when a device onboarded is seen connecting to a known malicious domain within the ThreatIntelIndicators table. The TimeGenerated field should not be changed as the table refreshes every ~10 days.
This query is better used in a workbook for automation.
This query looks for any emails containing N8N webhooks linked to malicious Screen Connect installers
Detects emails containing threat-actor lure links to trojanized ScreenConnect MSI files, specifically targeting 'cld.pt' downloads with 'COMPROBANTE*.msi' patterns. The rule also looks for 'COMPROBANTE' keywords in email subjects as a fallback.
This rule will alert when a pending action is required by a Security Administrator in Defender XDR. XDR lacks integrations with common ITSM applications and can only natively email for notifications. This will allow you to create a Sentinel Incident which then you can use a logic app to alert to whatever platform you would like.
Detects anomalies in data connector log volumes by comparing current log counts to 30-day averages, identifying significant deviations.
This query monitors the health and performance of data connectors feeding into Microsoft Sentinel by analyzing log volumes from various sources over the past 30 days. It calculates hourly averages to establish a baseline and compares these to logs from the last hour to identify significant deviations.
Specifically, the query detects "No Logs" (indicating a complete halt in log transmission), "Critical Spike" and "Elevated Spike" (indicating significantly higher log volumes, suggesting potential security incidents or increased activity), and "Critical Drop" and "Elevated Drop" (indicating significantly lower log volumes, which could point to misconfigurations or data source issues). The query provides detailed alerts for these anomalies, helping administrators proactively address potential issues with data connectors.
This query monitors the health and performance of data connectors feeding into Microsoft Sentinel by analyzing log volumes from various sources over the past 30 days. It calculates hourly averages to establish a baseline and compares these to logs from the last hour to identify significant deviations.
Specifically, the query detects "No Logs" (indicating a complete halt in log transmission), "Critical Spike" and "Elevated Spike" (indicating significantly higher log volumes, suggesting potential security incidents or increased activity), and "Critical Drop" and "Elevated Drop" (indicating significantly lower log volumes, which could point to misconfigurations or data source issues). The query provides detailed alerts for these anomalies, helping administrators proactively address potential issues with data connectors.
This query will generate an alert for any emails that Defender AIR identifies as malicious but has taken no AIR actions.
This analytics rule measures Mean Time to Detect (MTTD) for alerts generated by Sentinel analytics rules. It correlates rule execution data from SentinelHealth with corresponding alerts in SecurityAlert and incidents in SecurityIncident to determine how long it took for an analytics rule to detect malicious or suspicious activity after the first related event occurred.
The query retrieves all successful analytics rule executions within the specified time window, joins them to alerts using the CorrelationId, and then maps those alerts to incidents through AlertIds. For each alert–incident pair, the rule calculates MTTD as the difference between the rule run time and the first activity time associated with the incident. Results are aggregated by alert name and severity to provide counts and average detection times, enabling visibility into detection performance and rule efficacy.
The query retrieves all successful analytics rule executions within the specified time window, joins them to alerts using the CorrelationId, and then maps those alerts to incidents through AlertIds. For each alert–incident pair, the rule calculates MTTD as the difference between the rule run time and the first activity time associated with the incident. Results are aggregated by alert name and severity to provide counts and average detection times, enabling visibility into detection performance and rule efficacy.
There are simpler versions of this when investigating manually, this is not for manual use on your day to day activities, this is for automation.
This simple query helps detect whether a user interacted with the URL within the email message or not.
Esta detección identifica posibles conexiones relacionadas con el uso de VPNs dentro del entorno corporativo, correlacionando puertos asociados a protocolos VPN, dominios no habituales, procesos iniciadores y adaptadores de red virtuales o tunelizados. El objetivo es descubrir actividad de VPN no autorizada, conexiones cifradas ocultas dentro de tráfico HTTPS y el uso de extensiones de navegador que actúan como túneles tipo VPN.
La lógica de esta consulta aplica múltiples capas de filtrado para reducir falsos positivos:
- Filtra conexiones salientes hacia puertos característicos de IPsec, OpenVPN, WireGuard, L2TP y PPTP.
- Detecta túneles sobre puerto 443 cuando el proceso iniciador no corresponde a aplicaciones del sistema.
- Excluye ruido generado por procesos de Windows y dominios legítimos asociados a Microsoft, Google y servicios cloud corporativos.
- Identifica adaptadores TAP, TUN, Wintun, WireGuard, Tailscale o ZeroTier presentes en el host.
- Clasifica el tipo probable de VPN según el puerto utilizado y el proceso que inicia la conexión.
Esta detección permite encontrar:
- Clientes VPN instalados sin autorización.
- Extensiones de navegador que establecen túneles SSL-VPN encubiertos.
- Herramientas de túneles encubiertos como WireGuard stealth, Tailscale o ZeroTier.
- Actividad anómala desde navegadores que podría indicar proxies cifrados o VPNs embebidas.
La lógica de esta consulta aplica múltiples capas de filtrado para reducir falsos positivos:
- Filtra conexiones salientes hacia puertos característicos de IPsec, OpenVPN, WireGuard, L2TP y PPTP.
- Detecta túneles sobre puerto 443 cuando el proceso iniciador no corresponde a aplicaciones del sistema.
- Excluye ruido generado por procesos de Windows y dominios legítimos asociados a Microsoft, Google y servicios cloud corporativos.
- Identifica adaptadores TAP, TUN, Wintun, WireGuard, Tailscale o ZeroTier presentes en el host.
- Clasifica el tipo probable de VPN según el puerto utilizado y el proceso que inicia la conexión.
Esta detección permite encontrar:
- Clientes VPN instalados sin autorización.
- Extensiones de navegador que establecen túneles SSL-VPN encubiertos.
- Herramientas de túneles encubiertos como WireGuard stealth, Tailscale o ZeroTier.
- Actividad anómala desde navegadores que podría indicar proxies cifrados o VPNs embebidas.
This rule detects potential network beaconing activity by analyzing network connection events. It identifies repetitive outbound connections from a device to a remote IP and port with a consistent time interval (low jitter). The rule filters out known legitimate processes and domains to reduce false positives. It calculates the average time delta between connections, standard deviation, and interquartile range to identify beacon-like patterns. The rule also considers the number of unique devices connecting to the same remote endpoint to identify potentially compromised infrastructure.
Spot rogue or compromised endpoints attempting brute force attacks across your MDE fleet.
Author: Steven Lim
Author: Steven Lim
This rule detects potential malicious email campaigns by identifying when multiple users submit email reports (e.g., phishing or spam) that share common entities such as sender IP, primary sender address/domain, secondary sender address/domain, or subject line. A configurable threshold determines the minimum number of distinct reports required to flag an entity as suspicious.
This detection correlates suspicious device code authentication behaviour in Azure AD with a successful creation of a Windows Hello for Business (WHfB) credential within the same 24 hours.
Microsoft allows specific application and resource combinations (permitted by CA) access without a previously registered device. Even more, one of these combinations allows the registration of a device.
An access token issued for the Microsoft Authentication Broker application and the Intune Enrollment resource can be used to authenticate and initiate the device join process.
Therefore, an attacker can leverage the token to bypass CA, register device, and establish persistence. Once registered, attacker gets a Primary Refresh Token (PRT), valid for 90 days.
Attackers often push further to configure WHfB (Windows Hello For Business) on the registered device. WHfB issues TPM-backed, cryptographic credentials that Entra recognizes as a strong, phishing-resistant, passwordless authentication method.
Device registration unlocks persistence, but WHfB unlocks the ability to bypass stricter authentication-strength requirements.
Analysts: Check for IP mismatches, since in the Device Code authentication event we will see the victims IP, the WHfB registration event will contain the attackers IP.
Microsoft allows specific application and resource combinations (permitted by CA) access without a previously registered device. Even more, one of these combinations allows the registration of a device.
An access token issued for the Microsoft Authentication Broker application and the Intune Enrollment resource can be used to authenticate and initiate the device join process.
Therefore, an attacker can leverage the token to bypass CA, register device, and establish persistence. Once registered, attacker gets a Primary Refresh Token (PRT), valid for 90 days.
Attackers often push further to configure WHfB (Windows Hello For Business) on the registered device. WHfB issues TPM-backed, cryptographic credentials that Entra recognizes as a strong, phishing-resistant, passwordless authentication method.
Device registration unlocks persistence, but WHfB unlocks the ability to bypass stricter authentication-strength requirements.
Analysts: Check for IP mismatches, since in the Device Code authentication event we will see the victims IP, the WHfB registration event will contain the attackers IP.
This rule detects 3 types of suspicious activities: first, the presence of files matching a list of known malicious SHA256 hashes associated with Sha1-Hulud; second, suspicious process behavior involving file deletion commands and third traffic towards potential C2.
This detection looks for administrative activity that creates or updates Cross-Tenant Access Settings or Cross-Tenant Identity Synchronization Settings in Microsoft Entra ID (Azure AD). These settings control how identities, claims, and trust relationships are shared between Microsoft Entra tenants.
This detection monitors the CommonSecurityLog (which adheres to the Common Event Format - CEF) for indications of malicious network activity. Specifically, it flags outgoing HTTP requests originating from system utilities such as curl, wget, and PowerShell. These requests are often leveraged by attackers for data theft (exfiltration) or establishing command-and-control channels.
Review the full user agent string and destination hostname. Investigate the source IP and user context. Check whether the tool usage aligns with expected behavior for the host or user. Correlate with other indicators such as unusual process execution, file access, or authentication anomalies. Escalate if the destination is unknown or suspicious. Remove the KQL summarise line to view more details.
UA_Check and SafeHosts will require tuning for your specific environment setup and traffic.
Review the full user agent string and destination hostname. Investigate the source IP and user context. Check whether the tool usage aligns with expected behavior for the host or user. Correlate with other indicators such as unusual process execution, file access, or authentication anomalies. Escalate if the destination is unknown or suspicious. Remove the KQL summarise line to view more details.
UA_Check and SafeHosts will require tuning for your specific environment setup and traffic.
The following analytic detects the use of default or publicly known named pipes associated with Cobalt Strike. It leverages Sysmon EventID 17 and 18 to identify specific named pipes commonly used by Cobalt Strike's Artifact Kit and Malleable C2 Profiles. This activity is significant because Cobalt Strike is a popular tool for adversaries to conduct post-exploitation tasks, and identifying its named pipes can reveal potential malicious activity. If confirmed malicious, this could indicate an active Cobalt Strike beacon, leading to unauthorized access, data exfiltration, or further lateral movement within the network.
This analytic detects suspicious data transfer activities involving the use of the `split` syscall with the `-b` option, which specifies the size of each output file. This technique can be used by attackers to evade detection by breaking large files into smaller parts, bypassing size-based security controls, and facilitating covert exfiltration of sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall with a specified block size, this analytic helps identify potential data exfiltration attempts.
This analytic identifies the bulk creation of ransomware notes (e.g., .txt, .html, .hta files) on an infected machine. It leverages Sysmon EventCode 11 to detect multiple instances of these file types being created within a short time frame (10 seconds). A detection is triggered if 15 or more unique readme paths are observed. This activity is a strong indicator of an active ransomware attack, where the attacker is notifying the victim of the encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering critical files inaccessible and potentially causing significant operational disruption.
Page 47 of 59