Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,665 detections
Filters
Last updated
All Time
Detection languages
10,181
119
110
99
60
Contributors
2,815
2,800
1,768
504
492
Categories
4,275
2,971
2,237
1,829
1,457
Platforms
10,376
1,102
802
155
98
Products / Services
10,665
9,773
6,705
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
This query is designed to inventory Wi-Fi-connected devices and their network configurations, identify public IP addresses in use, and geolocate those IPs to detect anomalies (e.g., a device showing a public IP from an unexpected country). It also provides visibility into network adapter details, including vendor and status.
This detection rule uses a WDAC audit policy to ingest missing DeviceImageLoad events in MDE, and check for suspicious processes using the ncrypt.dll and requesting an Entra ID Nonce. More information on the attack scenario this is detection is applicable for can be found in the references.
This query hunts for files shared by a specified malicious sender on user devices. It identifies if attachments from emails sent by the malicious sender have been downloaded, saved, or are present on the user's devices by joining email attachment information with device file events based on the SHA256 hash of the attachment.
This rule detects process events where `svchost.exe` or `schtasks.exe` are the initiating processes on specific devices. This is designed to identify unexpected or suspicious scheduled tasks, whether system-initiated or user-triggered, on monitored devices. It can be used for hunting or to investigate alerts from other security tools regarding suspicious scheduled tasks.
This detection rule uses a WDAC audit policy to ingest missing DeviceImageLoad events in MDE, and check for suspicious processes using the ncrypt.dll. More information on the attack scenario this is detection is applicable for can be found in the references.
This rule identifies devices onboarded to Microsoft Defender that are vulnerable to a specific CVE (CVE-2024-38063) by querying the DeviceTvmSoftwareVulnerabilities table and joining it with DeviceInfo to filter for onboarded devices. It aims to help identify the presence of a known vulnerability across the environment's devices.
Detects if multiple users logged into a single machine within the same day.
This hunting query identifies devices enrolled in Microsoft Defender for Endpoint that support device containment. It determines support by analyzing the client version and estimating when that version became available. The query specifically looks at Windows devices and categorizes them based on their client version's support for containment (with or without AH Audit) or if containment is unsupported. Non-Windows devices are always classified as unsupported for containment.
Detects suspicious activities related to CVE-2025-8088 WinRAR exploitation, including malicious file creation, COM hijacking, C2 communication, and anti-analysis techniques. Enhanced with ADS detection, command-line analysis, and refined false positive handling. This threat is now attributed to RomCom.
Detects various Indicators of Compromise (IOCs) associated with UAT-7237 activity, including file hashes, IP addresses, domains, and URLs. This rule identifies suspicious process executions based on known malicious file hashes and network connections to malicious IP addresses or URLs.
Detects suspicious SMB/NTLM activity triggered by explorer.exe following recent .lnk file creation by script engines. This behavior aligns with the CVE-2025-50154 bypass of Microsoft’s NTLM credential leak patch (CVE-2025-24054), allowing zero-click NTLM hash disclosure and remote binary staging without execution.
This hunting query detects potential abuse of the MS-RPC protocol for DoS/DDoS attacks by monitoring outbound LDAP-related DNS queries originating from Domain Controllers.
It is inspired by the SafeBreach “Win-DOS Epidemic” research, which revealed a technique where attackers abuse RPC calls to trigger massive LDAP query floods. The query flags high-volume _ldap queries to external (non-private) IPs, with extra scrutiny on processes like lsass.exe and svchost.exe that, if abused, may indicate system-level compromise or protocol exploitation.
The detection is filtered to DC naming conventions (DC*) to reduce false positives and maintain high fidelity.
Stage 1 logic integrated from SlimKQL.
It is inspired by the SafeBreach “Win-DOS Epidemic” research, which revealed a technique where attackers abuse RPC calls to trigger massive LDAP query floods. The query flags high-volume _ldap queries to external (non-private) IPs, with extra scrutiny on processes like lsass.exe and svchost.exe that, if abused, may indicate system-level compromise or protocol exploitation.
The detection is filtered to DC naming conventions (DC*) to reduce false positives and maintain high fidelity.
Stage 1 logic integrated from SlimKQL.
KQL Query designed to detected tactics employed during active exploitation of WinRAR Zero-Day ( CVE-2025-8088)
This detection identifies Windows service installations (Event ID 4697) where potentially dangerous permissions like Everyone:Full Control or Authenticated Users:Full Control may be assigned to the service executable.
Such configurations can lead to privilege escalation via service binary hijacking.
Note:
Field index positions in EventData.Data[] may vary depending on the system and must be manually verified using parse_xml(EventData).
This detection requires the following audit subcategory to be enabled:
Audit Policy: Audit Kernel Object (under Object Access)
Such configurations can lead to privilege escalation via service binary hijacking.
Note:
Field index positions in EventData.Data[] may vary depending on the system and must be manually verified using parse_xml(EventData).
This detection requires the following audit subcategory to be enabled:
Audit Policy: Audit Kernel Object (under Object Access)
Detects the execution of remote access, tunneling, and credential access tools from suspicious directories. This rule specifically targets tools commonly abused by threat actors like Scattered Spider, such as AnyDesk, TeamViewer, ngrok, Teleport, Tailscale, and Mimikatz, when executed from user-writable or temporary folders. It excludes legitimate installations in standard Program Files directories to reduce false positives.
Adversaries often use malicious macros embedded in Office documents (Word, Excel) to execute payloads often spawning PowerShell, cmd, or LOLBins. This rule detects macro-triggered process chains indicative of weaponized documents.
Purpose: Hunts for risky OAuth applications in Microsoft 365 with overly permissive Microsoft Graph permissions.
Key Actions:
Finds enabled OAuth apps and retrieves their latest state (arg_max).
Expands permissions and flags sensitive ones (e.g., Mail.Send, Files.ReadWrite.All, User.ReadWrite.All, Sites.ReadWrite.All).
Notes publisher verification, origin, and last modification date.
Marks risky apps via HasRiskyPermissions flag.
Use Cases: Detects malicious consent grant phishing, overprivileged third-party apps, and integrations that could enable data theft or long-term access.
Key Actions:
Finds enabled OAuth apps and retrieves their latest state (arg_max).
Expands permissions and flags sensitive ones (e.g., Mail.Send, Files.ReadWrite.All, User.ReadWrite.All, Sites.ReadWrite.All).
Notes publisher verification, origin, and last modification date.
Marks risky apps via HasRiskyPermissions flag.
Use Cases: Detects malicious consent grant phishing, overprivileged third-party apps, and integrations that could enable data theft or long-term access.
This rule detects Waiting Thread Hijacking (WTH) by identifying sequences of API calls indicative of process injection. It includes three main detection logics: a basic sequence of OpenThread, Allocate, and Write operations; a more specific API sequence that checks for THREAD_GET_CONTEXT access and two separate write operations; and a split execution variant where multiple processes target a single victim process with memory allocation, write, and protect operations. The rule aims to catch malicious code injection into remote processes.
This query identifies browser extensions with a low global prevalence, which could indicate a malicious or unwanted extension. It specifically looks for .crx files created in "Webstore Downloads" folders and enriches the data with file prevalence information.
This rule detects potential DLL sideloading attempts by monitoring the loading of specific DLLs (version.dll and rtworkq.dll) from non-standard Windows system directories. It specifically looks for these DLLs being loaded by 'icardagt.exe' or 'mfpmp.exe' processes outside of 'C:\Windows\System32\' or 'C:\Windows\SysWOW64\'. This behavior is indicative of an adversary attempting to execute malicious code by tricking legitimate applications into loading their malicious DLLs instead of the legitimate ones.
Detects .lnk (shortcut) files launched by scripting engines (e.g., PowerShell, CMD, WScript) exhibiting suspicious traits like hidden execution, embedded commands, or admin privilege requests. Common in phishing, LOLBin abuse, and initial access.
Page 471 of 508