Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,224 detections
Filters
Last updated
All Time
Detection languages
1,117
30
19
17
15
Contributors
391
236
131
85
62
Categories
313
252
228
185
166
Platforms
651
437
269
228
200
Products / Services
10,680
9,761
6,694
4,418
3,744
1,224
MITRE Techniques
265
260
234
217
209
CVEs
8
8
6
6
6
IDS Classtypes
2
2
1
1
1
IDS Protocols
2
1
The following analytic detects suspicious attempts to find credentials stored in password stores, indicating a potential attacker's effort to access sensitive login information. Password stores are critical repositories that contain valuable credentials, and unauthorized access to them can lead to significant security breaches. By monitoring for unusual or unauthorized activities related to password store access, this analytic helps identify potential credential theft attempts, allowing security teams to respond promptly and prevent unauthorized access to critical systems and data.
This KQL query detects the activation or modification of Guest accounts or Guest group memberships, which may indicate unauthorized access attempts or privilege escalation.
Analysts should review the initiating user (SubjectUserName) and process context. Confirm whether the Guest account is expected to be active on the system. Investigate the host for signs of lateral movement or privilege abuse. Correlate with logon events and group membership changes. Escalate if Guest account activation is unexpected or unauthorized.
Analysts should review the initiating user (SubjectUserName) and process context. Confirm whether the Guest account is expected to be active on the system. Investigate the host for signs of lateral movement or privilege abuse. Correlate with logon events and group membership changes. Escalate if Guest account activation is unexpected or unauthorized.
Detects the creation or update of an Azure Sentinel analytics rule. This can indicate administrative activity related to security monitoring configuration. Monitoring these changes is crucial for detecting potential tampering with detection capabilities or the introduction of malicious rules.
This KQL detection will create an incident related to malicious .html execution on device
Detects potential abuse of LOLBAS techniques (e.g., WerFaultSecure.exe, rundll32.exe, comsvcs.dll) associated with EDR-Freeze attacks. These attacks suspend EDR or AV processes by exploiting Windows Error Reporting to create a race condition, leaving the system unmonitored.
The rule triggers when a known LOLBAS executable is run and the device stops reporting telemetry, with no legitimate shutdown or logoff activity recorded, suggesting the endpoint security agent may have been suspended.
The rule triggers when a known LOLBAS executable is run and the device stops reporting telemetry, with no legitimate shutdown or logoff activity recorded, suggesting the endpoint security agent may have been suspended.
This rule hunts for various artifacts and behaviors associated with the APT28 campaign "Phantom Net Voxel", which leverages COM hijacking, steganography, and cloud services for C2. This version is specifically tailored for Azure Sentinel using only DeviceProcessEvents, DeviceFileEvents, and DeviceNetworkEvents. It detects known malicious file hashes, regsvr32 execution of a specific DLL, Office applications dropping malicious DLLs or steganographic PNGs, C2 communications to known cloud storage domains, creation of SlimAgent log files, and explorer.exe accessing steganographic PNG files indicating successful COM hijacking.
Detects multiple Event ID 4648 logon attempts using the same target account but from different source accounts within a short time window. This behavior may indicate lateral movement, credential stuffing, or misuse of shared credentials. By correlating explicit credential use across users, it helps identify possible compromise or abuse of privileged accounts.
This rule identifies unusual activity from locations not previously observed for a user within a defined lookback period. It leverages Microsoft Entra ID (Azure AD) Behavior Analytics and SigninLogs to baseline legitimate user locations and filter out trusted devices/IPs. The rule flags unusual activity where the source IP location is new for the user and exceeds a configurable threshold of 'unusual' behavior indicators, while also excluding specified trusted countries.
Detects repeated denied UAC elevation attempts (UAC "prompt storms") initiated by the same process within a short time frame.
This detection is based entirely on Microsoft Defender for Endpoint (MDE) telemetry from DeviceProcessEvents and is useful in environments where traditional SecurityEvent logs (e.g. Event ID 4688) are unavailable or not ingested.
It identifies patterns where a process consistently triggers `consent.exe` (the UAC prompt), but no elevated child process follows — indicating the prompt was denied or ignored.
This is particularly useful for detecting UAC bombing attacks, where a malicious process tries to overwhelm the user with repeated elevation prompts to bypass security friction.
This detection is based entirely on Microsoft Defender for Endpoint (MDE) telemetry from DeviceProcessEvents and is useful in environments where traditional SecurityEvent logs (e.g. Event ID 4688) are unavailable or not ingested.
It identifies patterns where a process consistently triggers `consent.exe` (the UAC prompt), but no elevated child process follows — indicating the prompt was denied or ignored.
This is particularly useful for detecting UAC bombing attacks, where a malicious process tries to overwhelm the user with repeated elevation prompts to bypass security friction.
Detects multiple denied or failed multi-factor authentication (MFA) prompts for a single user within a short time window. This pattern is commonly associated with MFA fatigue or push bombing attacks, where an attacker attempts to trick the user into approving an MFA request by spamming prompts repeatedly.
This detection uses Azure AD sign-in logs and does not require asset inventory or conditional access policies to be effective.
This detection uses Azure AD sign-in logs and does not require asset inventory or conditional access policies to be effective.
Detects activity related to high-value (VIP) accounts, including:
- Azure AD account modifications
- Conditional Access policy changes affecting the user
- Role assignment changes
- Mailbox rule creation/modification
- Successful sign-ins
Useful for tracking executive account abuse, targeted attacks, or policy misconfigurations.
- Azure AD account modifications
- Conditional Access policy changes affecting the user
- Role assignment changes
- Mailbox rule creation/modification
- Successful sign-ins
Useful for tracking executive account abuse, targeted attacks, or policy misconfigurations.
This rule detects network connections to known dynamic DNS (DDNS) subdomains. Adversaries often use dynamic DNS services to maintain persistent command and control (C2) communication channels, as these services allow them to frequently change the IP address associated with a static hostname, making it harder for defenders to block or track their infrastructure. These providers also have established domain reputation, and provide legitimate services making blanket IOC rules impossible. The rule identifies connections to specific DDNS providers such as DuckDNS, No-IP, PublicVM, and others.
This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. Threat actors like Static Tundra have been observed configuring TFTP servers to make device configuration files accessible for exfiltration after gaining initial access. The detection specifically looks for commands that expose critical configuration files such as startup-config, running-config, and other sensitive system information through TFTP. This activity is particularly concerning as it may represent an attempt to steal credentials, network topology information, and other sensitive data stored in device configurations.
Detects potential misuse of AI model APIs by correlating process creation, network activity, and non-standard AI service ports.
Covers Ollama, OpenAI, Azure OpenAI, Anthropic, Google Gemini, Mistral, Cohere, Copilot, OpenRouter, Together, and Perplexity.
Covers Ollama, OpenAI, Azure OpenAI, Anthropic, Google Gemini, Mistral, Cohere, Copilot, OpenRouter, Together, and Perplexity.
Detects activity related to the PromptLock ransomware, which leverages the Ollama AI API and is written in Go. This rule looks for network connections to the Ollama service (port 11434) and related process executions, specifically identifying processes like go.exe, curl.exe, wget.exe, python.exe, powershell.exe making connections or processes with 'ollama' in their command line.
This detection identifies attempts to disable Microsoft Defender Antivirus or bypass its protection mechanisms such as Tamper Protection or Real-Time Protection.
It leverages signals from Microsoft Defender for Endpoint (via DeviceEvents) as well as Windows Security Events (e.g., Event ID 5001 and 5004), which are triggered when antivirus services are modified or stopped.
Such behavior is commonly associated with defense evasion techniques used by threat actors or unauthorized administrative actions and should be investigated immediately.
It leverages signals from Microsoft Defender for Endpoint (via DeviceEvents) as well as Windows Security Events (e.g., Event ID 5001 and 5004), which are triggered when antivirus services are modified or stopped.
Such behavior is commonly associated with defense evasion techniques used by threat actors or unauthorized administrative actions and should be investigated immediately.
In May 2025, a campaign started using the Microsoft Exchange Direct Send feature to send phishing mails to organizations. This feature is designed for use by printers, scanners, cloud services and other devices that need to send messages on behalf of the company. This detection rule tries to detect the malicious mails being send via Direct Send using a couple of indicators:
- Sender email is the same as Recipient email
- SPF and DMARC both failed
- Mail is not comming in via an Exchange connector
- The sender IP address country is not a country that the user is known to login from
FYI, if you remove the country check (last line of the query), you can use the query to identify if there are legitimate mails as well. If not, you can disable the Direct Send feature in Exchange Online.
- Sender email is the same as Recipient email
- SPF and DMARC both failed
- Mail is not comming in via an Exchange connector
- The sender IP address country is not a country that the user is known to login from
FYI, if you remove the country check (last line of the query), you can use the query to identify if there are legitimate mails as well. If not, you can disable the Direct Send feature in Exchange Online.
This KQL query searches the ExposureGraphNodes table in Microsoft Defender XDR or Sentinel to identify user accounts whose credentials have been leaked. It focuses on nodes categorized as "identity" and labeled as "user", then extracts detailed identity-related properties such as: Display name, UPN, email address, Account status (enabled/disabled), Job title, department, phone, address, Source provider (e.g., Azure AD, on-prem AD), Account creation time, and whether the account's credentials have been leaked. The query filters and enriches this data, and presents it in a clean, readable format for hunting or triage.
This detection rule identifies suspicious logins by service accounts on devices they haven't accessed in the last 14 days. This behavior could indicate a compromised service account being used for lateral movement within the environment. Service accounts typically have a static set of devices they authenticate to, making deviations easier to spot compared to user accounts. However, some service accounts (e.g., MDI service accounts) are known to dynamically log into devices, which may require environment-specific fine-tuning to reduce false positives.
This detection rule flags events where conditional access policies are getting weaker, when modifications to CA inclusion or exclusion groups are happening, or when the effectiveness of a policy is disabled.
This rule identifies accounts that have been assigned administrative roles within the environment. It helps assess exposure risk by focusing on identities with elevated permissions, supports attack surface reduction by auditing role assignments, and enables proactive threat hunting for potential misuse of admin privileges.
Page 48 of 59