Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
This rule detects instances where an antivirus scan fails on a device. It extracts the scan type, error code, and error description from the `AdditionalFields` property to provide detailed information about the failure. This could indicate issues with the antivirus software itself, a system compromise attempting to disable security controls, or a problem with the scanned files.
This rule detects a potentially malicious Human Interface Device (HID) attack where a newly connected keyboard device (e.g., a USB Rubber Ducky) immediately triggers the execution of a script interpreter such as PowerShell, CMD, or MSHTA. The correlation occurs within 60 seconds of device insertion, which is characteristic of HID-based keystroke injection attacks.
This rule identifies devices that have software installed which has reached its End-Of-Support (EOS) status. This is crucial for identifying potential security vulnerabilities due to unpatched software and for maintaining compliance with organizational security policies. The rule summarizes the count of such software instances per device, along with the software name and its End-Of-Support date.
This rule detects instances where an antivirus scan has been cancelled on a device. It specifically looks for 'AntivirusScanCancelled' actions in device events and extracts the 'ScanTypeIndex' from additional fields to provide context on the type of scan that was cancelled. This could indicate an attempt to evade detection by disabling security software.
This query detects multiple behaviors associated with the ApolloShadow malware, used by the Secret Blizzard threat actor. It looks for the creation of a specific administrator account, installation of root certificates using certutil, modification of Firefox settings to trust new certificates, and changes to network profiles to relax firewall rules.
This rule detects when an antivirus scan has completed on a device. It extracts the scan type from the additional fields and summarizes the count of completed scans by timestamp, device name, action type, and scan type. This rule can be used to monitor the frequency and types of antivirus scans occurring across an environment.
This rule detects network connections, email activity, URL clicks, and Teams messages that involve domains commonly used by threat actor group Scattered Spider. It specifically looks for domains containing '-servicedesk.', '-okta.', '-sso.', '-cms.', '-helpdesk.', or 'oktalogin-'. The rule aims to identify potential phishing attempts or suspicious activity targeting SSO/helpdesk credentials by monitoring interactions with these specific domain patterns across multiple data sources.
Detects suspicious reuse of NTLM authentication hashes by the same user account across multiple hosts within a short time window. This behavior may indicate lateral movement techniques such as pass-the-hash attacks or credential replay.
This rule identifies software installed on devices that has reached its End of Support (EOS) version. It provides details such as the device name, software name, vendor, version, EOS status, and EOS date, which is crucial for identifying potential security risks due to unpatched or unsupported software.
This rule identifies software installed on devices that is approaching its end-of-support (EOS) date. It queries the DeviceTvmSoftwareInventory table to find software with an 'Upcoming EOS Version' status, providing details such as device name, software name, vendor, version, EOS status, and EOS date. This can help in proactive patch management and identifying potential security risks associated with outdated software.
This detection identifies processes that have executed on a host in the last 7 days but were not observed in the previous 30 days. This is useful for detecting potentially malicious or anomalous activity, such as new software installations, LOLBins, or attacker tools introduced during a compromise.
Detects the execution of mshta.exe spawning a command shell (cmd.exe) to download a remote file. This behavior is indicative of malicious HTA files used to deliver malware, as seen in campaigns distributing Epsilon Red ransomware.
This rule detects suspicious file access patterns to Chromium-based browser extension data folders. Specifically, it looks for any process other than the browser itself (msedge.exe, chrome.exe, wavebrowser.exe, vivaldi.exe, brave.exe, brchrome.exe) reading or accessing files within the 'AppData\Local\User Data\Default\Extensions' directory. This activity could indicate an attempt by malware or an unauthorised process to inspect, modify, or exfiltrate data related to browser extensions, potentially for credential theft, session hijacking, or to inject malicious code into extensions.
This detection identifies suspicious command-line activity (e.g. powershell, cmd.exe, wsl.exe, etc.) that is initiated via explorer.exe, suggesting potential user-initiated execution (e.g., copy-paste into Run dialog or file association abuse). This technique is commonly used in social engineering campaigns or malware execution patterns, and is associated with the campaign tag: fileFix.
This rule detects potential data exfiltration attempts using the built-in Windows `ping.exe` utility. Specifically, it looks for `ping.exe` executions where a large payload size (greater than 1024 bytes) is specified using the -L command-line argument. This technique can be used to tunnel data over ICMP, which might bypass some network defenses.
This rule detects if the Antivirus (AV) mode on a Windows device, as reported by DeviceTvmInfoGathering, is not set to '0'. A non-zero AvMode could indicate that the antivirus is not in a default or expected state, potentially suggesting a disabled or misconfigured AV.
Detects the execution of an HTA file (via mshta.exe) that spawns a command prompt to silently download and execute a remote payload using curl. This behavior is consistent with the Epsilon Red ransomware campaign that uses malicious HTA files with embedded JScript to run shell commands.
Identifies devices that have been observed as being directly exposed to the public internet. This is based on Microsoft Defender for Endpoint's device discovery capabilities. Such devices may be at higher risk of attack and should be reviewed to ensure the exposure is intentional and properly secured.
Detects potential Unicode-based homograph attacks by scanning for non-ASCII characters in both DeviceNetworkEvents.RemoteUrl and EmailUrlInfo.Url. These attacks leverage visually deceptive domain names—using characters from non-Latin scripts (e.g., Cyrillic "а" instead of Latin "a")—to mimic legitimate sites and deceive users.
The detection covers both network activity and email delivery paths, helping uncover phishing attempts, credential harvesting links, or other malicious redirects.
Recommendation: If available, include telemetry from DNS logs (e.g., DnsEvents) and firewall/proxy logs to improve detection coverage and correlate threats across multiple layers of the kill chain.
The detection covers both network activity and email delivery paths, helping uncover phishing attempts, credential harvesting links, or other malicious redirects.
Recommendation: If available, include telemetry from DNS logs (e.g., DnsEvents) and firewall/proxy logs to improve detection coverage and correlate threats across multiple layers of the kill chain.
Detects the use of GoodSync command-line tools for data exfiltration, a TTP associated with the Chaos ransomware group. The rule looks for suspicious command-line patterns, including masquerading as wininit.exe.
This rule detects network connections and DNS queries to domains impersonating legitimate services, which are known to be used in the Epsilon Red ransomware campaign to deliver malicious HTA files.
Page 473 of 509