Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61,046 detections
Filters
Last updated
All Time
Detection languages
23,955
16,903
4,364
4,342
3,270
Contributors
11,679
8,654
7,555
6,800
4,504
Categories
20,590
11,933
5,910
5,194
4,872
Platforms
40,154
7,369
6,547
3,915
3,692
Products / Services
10,809
9,795
6,757
4,421
3,771
MITRE Techniques
18,176
15,735
12,661
8,477
6,293
CVEs
71
71
64
58
49
IDS Classtypes
1,937
503
461
381
237
IDS Protocols
2,431
869
408
324
97
Detects a sequence where a Windows Defender exclusion is added via PowerShell or Command Prompt, followed by a silent installation of an 'app.msi' package on the same device within 30 minutes. Management agents and noisy administrative devices are filtered out to reduce false positives.
Detects inbound quarantine-themed emails where the embedded URL contains the recipient's email address (either plain or URL-encoded), combined with optional user click events, potentially indicating a targeted phishing attempt.
Detects network connections, file creations with specific SHA256 hashes, and email URL hits associated with known Forg365 threat actor infrastructure and indicators.
Detects endpoint file creation, modification, process execution, and image load events where the file hash matches a known malicious hash feed from Live-Malware-DB.
Detects a new MFA method registration (phone, authenticator or passkey) shortly after the same user signs in to the Security Info pages from an ASN they haven’t used in the past 14 days. Common AiTM pattern: the attacker replays a stolen session cookie, then registers their own MFA method to keep access after the password is reset. Correlates on the sign-in rather than the audit log IP, because “User registered security info” events often record a Microsoft backend IP instead of the attacker’s.
Detects a sequence of discovery commands typical of the Phexia macOS stealer, including system_profiler hardware/software/display profiles, public IP lookups via api.ipify.org, and cryptocurrency wallet or file extension probing executed within a short time window via command shells or script interpreters.
Detects outbound network connections to known C2 domains and IP addresses associated with the Lazarus TraderTraitor campaign (ROOFDECK/FLATROOF).
Detects the correlation of an executable and command file staged via SMB to a Windows admin share (C$) followed closely by shadow copy deletion using vssadmin.exe on the same host, indicative of BlackSuit ransomware pre-encryption activity.
This rule detects high-volume password spraying activity against Microsoft Entra ID (M365) sign-ins. It utilizes two detection branches: a behavioral branch identifying single source IPs generating massive failed sign-ins and lockouts across multiple accounts, and an indicator-based branch flagging known Storm-0940 infrastructure or specific scripted user agents performing rapid authentication attempts.
Detects rare browser extensions installed on a low number of devices via direct file creation/modification within browser extension directories or through command-line sideloading using the --load-extension flag.
This query is designed to identify and list files with executable extensions that have been downloaded via HTTP GET requests. Here's a simplified breakdown of what the query does:
Define Executable Extensions: It starts by defining a list of file extensions that are considered executable, such as .exe, .bat, .cmd, etc.
Filter Network Events: The query looks at network events where the action type is "NetworkSignatureInspected". This means it is inspecting network traffic for specific patterns or signatures.
Extract HTTP GET Requests: It further filters these events to only include those where the signature name is "HTTP_Client" and the HTTP request method is "GET". This focuses the query on HTTP GET requests, which are typically used to download files.
Extract Downloaded Content: The query extracts the content of the download from the network event data, specifically looking for the file name and its extension.
Filter Executable Files: It checks if the file extension of the downloaded content matches any of the predefined executable extensions and ensures the extension is not empty and is less than 8 characters long.
Project Relevant Information: Finally, it organizes the output to show the timestamp (or time generated), device name, the content that was downloaded, the HTTP request method, and the remote IP address involved in the transaction.
This query helps in identifying potentially risky downloads of executable files over the network, which could be indicative of malware or unauthorized software being downloaded.
Define Executable Extensions: It starts by defining a list of file extensions that are considered executable, such as .exe, .bat, .cmd, etc.
Filter Network Events: The query looks at network events where the action type is "NetworkSignatureInspected". This means it is inspecting network traffic for specific patterns or signatures.
Extract HTTP GET Requests: It further filters these events to only include those where the signature name is "HTTP_Client" and the HTTP request method is "GET". This focuses the query on HTTP GET requests, which are typically used to download files.
Extract Downloaded Content: The query extracts the content of the download from the network event data, specifically looking for the file name and its extension.
Filter Executable Files: It checks if the file extension of the downloaded content matches any of the predefined executable extensions and ensures the extension is not empty and is less than 8 characters long.
Project Relevant Information: Finally, it organizes the output to show the timestamp (or time generated), device name, the content that was downloaded, the HTTP request method, and the remote IP address involved in the transaction.
This query helps in identifying potentially risky downloads of executable files over the network, which could be indicative of malware or unauthorized software being downloaded.
This analytic detects a successful Linux execve event where a PID changes executable image under the same parent after the prior image has been active for at least one second and no more than 60 seconds.
A delayed image change in an existing process can indicate execution following exploitation and should be investigated with related endpoint and network activity.
A delayed image change in an existing process can indicate execution following exploitation and should be investigated with related endpoint and network activity.
Detects network connections to the Telegram Bot API (api.telegram.org) originating from processes other than the official Telegram desktop application. Adversaries frequently abuse legitimate services like Telegram for Command and Control (C2) or data exfiltration.
Dual-use transfer tools (rclone, WinSCP, curl, AzCopy, AWS/GCloud CLI) are favored by ransomware affiliates and APT operators for exfiltration because they are signed or legitimate and blend into admin activity. This hunt keys on upload-oriented flags and sub-commands rather than binary presence, and also matches on OriginalFileName to catch renamed binaries (rclone is routinely renamed).
Detects external password spraying activity from a source IP address followed by internal network port scanning or connection attempts originating from a device utilizing that same IP address.
Detects artifacts of the compromised litellm 1.107.0 release: connections to the exfiltration host, installs of the affected version and the dropped stealer files. Needs Defender for Endpoint network, process and file events and covers only published indicators. The query ran without errors in a live tenant.
Detects Claude Desktop or its spawned child processes (such as node, python, or shell interpreters) accessing two or more distinct credential or sensitive configuration paths (such as SSH keys, AWS credentials, npmrc, etc.) within a 10-minute window on the same device.
Detects workload identity sign-ins from an IP /24 not seen for that service principal in the prior 30 days, followed by bulk Azure Key Vault secret reads by the same service principal within 1 hour, characteristic of Storm-0940 credential abuse and exfiltration.
Detects the pulling and execution of known backdoored ARTEX Docker Hub images followed by a shell execution within a container runtime on the same device within a one-hour window.
Detects CrowdStrike Falcon telemetry referencing specific version and folder patterns of the Anthropic Claude Code extension, identifying potentially malicious builds (such as version 2.1.313 or 2.1.312 under Cursor) versus verified clean versions.
The following analytic detects suspicious Azure Active Directory device registrations by monitoring "Register device" audit events for device names matching specific DESKTOP patterns or the user agent "Dsreg/10.0 (Windows 10.0.19041.928)".
This user agent may indicate device registration activity through ROADtools, an offensive security framework targeting EntraID deployments.
Device registration can support persistence or provide a device identity that can be used to access internal resources.
If confirmed malicious, an attacker could use the registered device to maintain access or facilitate further compromise of the environment.
This user agent may indicate device registration activity through ROADtools, an offensive security framework targeting EntraID deployments.
Device registration can support persistence or provide a device identity that can be used to access internal resources.
If confirmed malicious, an attacker could use the registered device to maintain access or facilitate further compromise of the environment.
Page 5 of 2907