Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
Detects the execution of a Cloudflared that uses 'tunnel run' with a long token, which is indicative of a tunneling tool being used. This pattern is often associated with legitimate remote access tools or potentially malicious C2 frameworks.
KQL Query from file: Suspicious FileFix activity
This rule detects PowerShell command lines that contain non-English (Unicode) characters, excluding the en-dash character. This behavior is often indicative of obfuscation techniques used by adversaries to evade detection, as legitimate PowerShell commands typically do not contain such characters in their command line arguments.
This rule detects instances where common web browsers (e.g., Chrome, Edge, Firefox) launch specific Living Off The Land Binaries (LOLBins) or scripting interpreters. The LOLBins and interpreters include `cmd.exe`, `powershell.exe`, `rundll32.exe`, `regsvr32.exe`, `msiexec.exe`, `mshta.exe`, `hh.exe`, `certutil.exe`, and `bitsadmin.exe`. This activity can indicate malicious intent, such as drive-by downloads, exploit kit activity, or initial access attempts where an attacker leverages a browser to execute system utilities for further compromise.
This detection looks for activity associated with the Redirection ad-jacking campaign. It detects network connections to known malicious C2 domains and the installation of malicious browser extensions identified by their extension IDs.
(no description)
Detects suspicious driver loads indicative of rootkits or BYOVD attacks. Flags unsigned/non-Microsoft drivers loaded from temp paths or by unusual processes. Targets random-named drivers (e.g., 'a1b2c3.sys'), known vulnerable drivers, and system driver impersonators.
KQL Query from file: Detection fake CAPTCHA-based clipboard hijacking
This rule detects the presence of specific file hashes (MD5, SHA1, SHA256) across device file events, device process events, and email attachment information. It is designed to identify known malicious files or indicators of compromise (IOCs) within an environment.
This package searches endpoint processes for cscript executing a wsf file which has been attributed to the Serpentine#Cloud campaign.
This is a brittle detection narrowly defined to this particular campaign but is nonetheless useful.
This is a brittle detection narrowly defined to this particular campaign but is nonetheless useful.
This hunt looks for PowerShell being executed as a child or grandchild of mshta.exe or network events initiated by PowerShell as a child of mshta.exe.
There are two ways to approach this:
Look for device network events initiated by PowerShell with a parent of mshta.exe
Look for process events where PowerShell is executed with a parent process of mshta.exe
The search in this hunt leverages the second approach.
You could also look for PowerShell command lines making web requests but the obfuscation employed by known threat actors makes this more difficult to find by matching strings.
There are two ways to approach this:
Look for device network events initiated by PowerShell with a parent of mshta.exe
Look for process events where PowerShell is executed with a parent process of mshta.exe
The search in this hunt leverages the second approach.
You could also look for PowerShell command lines making web requests but the obfuscation employed by known threat actors makes this more difficult to find by matching strings.
This rule detects network connections or DNS queries to domains associated with the Tycoon 2FA phishing kit. The rule leverages an external data source containing a list of known malicious domains used by this phishing kit. Detection occurs if a device attempts to connect to or resolve any of these domains.
KQL Query
Detecting LOLDrivers using www.loldrivers.io and MDE telemetry.
This rule was created by Mehmet Ergene from BluRaven Academy and added to Detections.ai as it was missing from the repository.
This rule was created by Mehmet Ergene from BluRaven Academy and added to Detections.ai as it was missing from the repository.
This rule detects activity from a list of specified malicious IP addresses across network connection events and sign-in attempts. It correlates `DeviceNetworkEvents` (network connections from devices) and `SigninLogs` (user authentication attempts) to identify instances where these IPs are involved. The rule is designed for hunting, looking back 30 days for any activity originating from the defined IP addresses.
This rule detects the execution of common Windows utilities (PowerShell, Regsvr32, BITSAdmin, Certutil, MSHTA) when initiated by a web browser. This behavior can indicate an attempt to execute malicious code or download additional payloads after a user clicks a malicious link or visits a compromised website. Adversaries often leverage these utilities for various purposes, including code execution, file transfer, and bypassing security controls.
Detects suspicious registry modifications for IFEO entries which can be used by attackers for persistence.
This is based off of testing with Atomic Red Team tests - https://www.atomicredteam.io/atomic-red-team/atomics/T1546.012
This is based off of testing with Atomic Red Team tests - https://www.atomicredteam.io/atomic-red-team/atomics/T1546.012
Hunting query to monitor downloads through popular browsers
This hunt identifies activity related to known malicious domains or URLs across network, email, and messaging telemetry over the past 30 days. It searches for domain-based IOCs within device network events, emails, and Microsoft Teams messages to highlight potential indicators of compromise (IOCs). It tracks delivery actions and recipients for further investigation.
Detects mshta.exe executing with command-line arguments containing 'http', which is indicative of mshta.exe being used to download and execute remote HTA files or scripts. This procedure is known to be used in ClickFix attacks where threat actors use fake Captcha portals to download malware payloads.
This KQL detection is designed for use in Microsoft Defender for Endpoint Advanced Hunting or Microsoft Sentinel, depending on table availability.
It focuses on identifying two common persistence techniques used by threat actors:
COM hijacking via user-specific registry hives (InprocServer32 and LocalServer32), particularly when leveraged by .NET or PowerShell-based malware; and uncommon registry-based persistence through suspicious keys such as DelegateExecute, TreatAs, and ScriptletURL.
The KQL focusses on user-specific registry hives as they don't require elevated privileges to modify and is why we also ignore "nt authority" activity as this detection is focused on low hanging fruit that would be easily accessible to a threat actor initially for persistence without privilege escalation.
It focuses on identifying two common persistence techniques used by threat actors:
COM hijacking via user-specific registry hives (InprocServer32 and LocalServer32), particularly when leveraged by .NET or PowerShell-based malware; and uncommon registry-based persistence through suspicious keys such as DelegateExecute, TreatAs, and ScriptletURL.
The KQL focusses on user-specific registry hives as they don't require elevated privileges to modify and is why we also ignore "nt authority" activity as this detection is focused on low hanging fruit that would be easily accessible to a threat actor initially for persistence without privilege escalation.
Page 475 of 509