Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,045 detections
Filters
Last updated
All Time
Detection languages
15,346
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,106
9,754
3,848
3,756
3,712
Platforms
40,045
7,313
6,542
3,903
3,660
Products / Services
10,431
9,678
6,722
1,887
1,878
MITRE Techniques
13,736
13,114
8,062
5,947
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects execution of virtualization and container software on Windows endpoints by image name, covering Hyper-V, VMware, VirtualBox, QEMU, Xen, Parallels, WSL, Docker and containerd. Attackers can run payloads inside a virtual machine or WSL instance to hide activity from host-based security tools. Developers and administrators use these tools routinely, so the rule suits inventory and hunting. To triage, check the user, parent process, command line and hash, and whether the host is expected to run virtual machines.
Detects post-exploitation behavior where a Node.js process spawns a shell, interpreter, or utility (such as sh, bash, nc, curl, python), which may indicate Remote Code Execution (RCE) via vulnerabilities like CVE-2026-111497 in the Node.js Brotli decoder.
Detects creation, modification, disabling, or deletion of Windows Firewall rules and profiles using netsh.exe or PowerShell NetSecurity cmdlets. Adversaries tamper with the host firewall to disable defenses, open inbound or outbound paths for tools and C2, or remove blocking rules. This is common in hands-on-keyboard intrusions and ransomware staging. The query matches on file name and original file name to catch renamed binaries, covers both modern (advfirewall) and legacy (netsh firewall) syntax, and labels each event with the action performed to speed up triage.
Detects Sysinternals executables written to disk on Windows endpoints, identified by the Sysinternals company name in the PE metadata of newly written EXE files. These are legitimate admin utilities, but attackers also copy them to hosts for discovery, process inspection and credential access. The rule shows tool presence only, not misuse, so it suits inventory and hunting. To triage, review the file path, hash, writing process and whether the user is an administrator.
Network-layer view: catches obfuscated or wrapped command lines and gives destination context for pivoting. Network and process events are unioned and paired per process on aid + process ID. The process side is pre-filtered to transfer tools, so the union stays small.
Detects security software discovery behavior by identifying tasklist execution combined with directory listings of the CrowdStrike sensor folder on the same device within a short window, which can serve as a coverage check for hosts lacking the Falcon sensor.
Detects PowerShell attempting to install and start the OpenSSH Server on Windows, typically triggered by malicious extensions or backdoors to enable remote SSH access.
The following analytic identifies instances where `ipconfig.exe`, `systeminfo.exe`, `net1.exe`, or similar tools are executed by a non-standard shell parent process, excluding CMD, PowerShell, Explorer, or `net.exe`.
This detection leverages Endpoint Detection and Response (EDR) telemetry to monitor process creation events. Such behavior is significant as it may indicate adversaries using injected processes to perform system discovery, a tactic observed in FIN7's JSSLoader.
If confirmed malicious, this activity could allow attackers to gather critical host information, aiding in further exploitation or lateral movement within the network.
This detection leverages Endpoint Detection and Response (EDR) telemetry to monitor process creation events. Such behavior is significant as it may indicate adversaries using injected processes to perform system discovery, a tactic observed in FIN7's JSSLoader.
If confirmed malicious, this activity could allow attackers to gather critical host information, aiding in further exploitation or lateral movement within the network.
The following analytic detects cmd.exe being used to write a Windows Scheduled Task XML definition to disk through the echo command.
This analytic focuses on command lines that combine echo with the Task Scheduler XML namespace. This is a significant activity because legitimate
software rarely assembles a task definition on the fly from the console. Browser hijackers and adware droppers do this to create a scheduled task,
through schtasks.exe and the generated XML file, that periodically relaunches a copy of themselves, and then delete the XML file to hinder forensic analysis.
If confirmed malicious, this could allow an attacker to establish persistence, repeatedly execute a payload and maintain control over the victim's browser.
This analytic focuses on command lines that combine echo with the Task Scheduler XML namespace. This is a significant activity because legitimate
software rarely assembles a task definition on the fly from the console. Browser hijackers and adware droppers do this to create a scheduled task,
through schtasks.exe and the generated XML file, that periodically relaunches a copy of themselves, and then delete the XML file to hinder forensic analysis.
If confirmed malicious, this could allow an attacker to establish persistence, repeatedly execute a payload and maintain control over the victim's browser.
Detects instances where Microsoft Teams (ms-teams.exe, Teams.exe) or its associated WebView2 process spawns a command or script interpreter (such as PowerShell, Cmd, Mshta, Wscript, Cscript) with suspicious download-and-execute arguments, which is commonly associated with ClickFix social engineering attacks or similar initial access tactics.
Detects file write, creation, or modification of C:\Windows\System32\TieringEngineService.exe
by any process other than legitimate Windows servicing components. The RedSun exploit
(CVE-2026-33825) overwrites this binary via a Defender cloud-file-rollback redirection
abuse, enabling SYSTEM-level code execution when the Tier Management Engine COM object
is subsequently invoked. Legitimate modification of this file is almost exclusively
performed by TrustedInstaller during Windows servicing operations.
by any process other than legitimate Windows servicing components. The RedSun exploit
(CVE-2026-33825) overwrites this binary via a Defender cloud-file-rollback redirection
abuse, enabling SYSTEM-level code execution when the Tier Management Engine COM object
is subsequently invoked. Legitimate modification of this file is almost exclusively
performed by TrustedInstaller during Windows servicing operations.
Detects processes rapidly invoking multiple system and network reconnaissance APIs (such as NetGetJoinInformation, NetSessionEnum, GetAdaptersAddresses, etc.) within a short window, which is indicative of automated discovery or reconnaissance activity.
Detects behavioral indicators of an SSH or autossh reverse tunnel (-R) executed with no remote command (-N) and host-key checking disabled, combined with network connections to a known command and control IP address.
Hunts DeviceFileCertificateInfo for files signed by certificates issued by the eight eMudhra (and eight Sectigo) intermediate CAs with compromised weak keys. It matches on issuer hash, issuer name and CA serial, with an optional broader eMudhra/emSign match.
Detects suspicious DLL loads by consent.exe, focusing on known side-loading and search-order hijacking targets that may indicate privilege escalation, UAC bypass, or execution of attacker-controlled code through trusted Windows processes.
Detects potential MuddyWater/RustyWater malware execution chains by identifying Office applications spawning scripting engines, LOLBins, or known campaign-related payloads from attacker-favored writable directories.
Identify potential defense evasion activity where attackers abuse built-in Windows administration tools to stop services, clear logs, or modify auditing and security controls.
Generic rule content from file: Transfer Utilities Making Public Network Connections - T1048.cql
Generic rule content from file: shanya byovd activity vulnerable driver drops and loads - T1068.cql
Detects Node.js builds, Express, and body-parser libraries vulnerable to CVE-2026-111497 (Node2Shell) via Microsoft Defender vulnerability inventory, process telemetry, and software inventory.
Detects potential AS-REP Roasting activity through two branches: endpoint tooling execution such as GetNPUsers or hashcat with AS-REP related flags, and domain controller Kerberos TGT requests (Event ID 4768) indicating pre-authentication disabled (PreAuthType 0) using RC4 encryption across multiple accounts from a single source IP.
Page 5 of 1907