Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,224 detections
Filters
Last updated
All Time
Detection languages
1,117
30
19
17
15
Contributors
391
236
131
85
62
Categories
313
252
228
185
166
Platforms
651
437
269
228
200
Products / Services
10,680
9,761
6,694
4,418
3,744
1,224
MITRE Techniques
265
260
234
217
209
CVEs
8
8
6
6
6
IDS Classtypes
2
2
1
1
1
IDS Protocols
2
1
This detection identifies instances where a Windows service is installed with a file path that contains spaces but is not enclosed in quotation marks. Such misconfigurations can be exploited by attackers for privilege escalation using unquoted service path vulnerabilities. This detection helps administrators identify and remediate potentially insecure service installations.
This detection identifies suspicious authentication failure patterns that may indicate brute-force attacks. It detects four common scenarios:
- Repeated failed login attempts to a single account from a single IP address.
- Distributed login attempts to a single account from multiple IPs.
- A single IP address targeting multiple accounts.
- Broad-scale attempts involving multiple accounts and multiple IPs in a short timeframe.
This rule focuses on failed login attempts only and is intended for early brute-force detection and threat hunting.
Note:
Consider tuning the TimeWindow (default: 10 minutes) and Threshold (default: 5 attempts) values to reflect your organization’s normal login activity. A more permissive or stricter threshold may be necessary depending on your environment (e.g., high-traffic services, mobile users, VPNs).
Includes both a readable union-based version and a compact case()-based variant for performance-conscious deployments.
- Repeated failed login attempts to a single account from a single IP address.
- Distributed login attempts to a single account from multiple IPs.
- A single IP address targeting multiple accounts.
- Broad-scale attempts involving multiple accounts and multiple IPs in a short timeframe.
This rule focuses on failed login attempts only and is intended for early brute-force detection and threat hunting.
Note:
Consider tuning the TimeWindow (default: 10 minutes) and Threshold (default: 5 attempts) values to reflect your organization’s normal login activity. A more permissive or stricter threshold may be necessary depending on your environment (e.g., high-traffic services, mobile users, VPNs).
Includes both a readable union-based version and a compact case()-based variant for performance-conscious deployments.
This rule detects a potentially malicious Human Interface Device (HID) attack where a newly connected keyboard device (e.g., a USB Rubber Ducky) immediately triggers the execution of a script interpreter such as PowerShell, CMD, or MSHTA. The correlation occurs within 60 seconds of device insertion, which is characteristic of HID-based keystroke injection attacks.
Detects suspicious reuse of NTLM authentication hashes by the same user account across multiple hosts within a short time window. This behavior may indicate lateral movement techniques such as pass-the-hash attacks or credential replay.
This detection identifies processes that have executed on a host in the last 7 days but were not observed in the previous 30 days. This is useful for detecting potentially malicious or anomalous activity, such as new software installations, LOLBins, or attacker tools introduced during a compromise.
This detection identifies suspicious command-line activity (e.g. powershell, cmd.exe, wsl.exe, etc.) that is initiated via explorer.exe, suggesting potential user-initiated execution (e.g., copy-paste into Run dialog or file association abuse). This technique is commonly used in social engineering campaigns or malware execution patterns, and is associated with the campaign tag: fileFix.
This detection identifies when a user executes a potentially malicious command via the Windows Run dialog (Win+R). It monitors the RunMRU registry key for commands associated with living-off-the-land binaries (LOLBins) and scripting engines like PowerShell, MSHTA, Bitsadmin, and others. Such activity is often a sign of initial access, where an attacker has tricked a user into running a payload downloader or stager command
Detects potential Unicode-based homograph attacks by scanning for non-ASCII characters in both DeviceNetworkEvents.RemoteUrl and EmailUrlInfo.Url. These attacks leverage visually deceptive domain names—using characters from non-Latin scripts (e.g., Cyrillic "а" instead of Latin "a")—to mimic legitimate sites and deceive users.
The detection covers both network activity and email delivery paths, helping uncover phishing attempts, credential harvesting links, or other malicious redirects.
Recommendation: If available, include telemetry from DNS logs (e.g., DnsEvents) and firewall/proxy logs to improve detection coverage and correlate threats across multiple layers of the kill chain.
The detection covers both network activity and email delivery paths, helping uncover phishing attempts, credential harvesting links, or other malicious redirects.
Recommendation: If available, include telemetry from DNS logs (e.g., DnsEvents) and firewall/proxy logs to improve detection coverage and correlate threats across multiple layers of the kill chain.
This detection identifies instances where the diskshadow.exe utility is executed by a privileged user shortly after a successful logon. diskshadow.exe is a legitimate tool often abused by attackers for shadow copy manipulation and data exfiltration. Monitoring its use by privileged accounts helps identify potential malicious activity.
This detection identifies when a one-on-one Microsoft Teams chat is initiated with an external domain that has not been observed in previous Teams chats (past 90 days) or recent email communications (past 15 days). This may indicate a new, potentially unsolicited or suspicious contact attempting to engage with an internal user, which could represent a social engineering attempt or early-stage reconnaissance.
Hunting WMI execution from remote system
Ngrok is a legitimate tool that creates secure tunnels to localhost servers through NAT/firewalls, often used by developers.
Additionally, Ngrok tunnels have been used by Iranian APT groups, among others, to support their operations particularly for Command and Control (C2), data exfiltration, and initial access staging.
Additionally, Ngrok tunnels have been used by Iranian APT groups, among others, to support their operations particularly for Command and Control (C2), data exfiltration, and initial access staging.
This rule detects when a user is added to an administrative or management role in Azure Active Directory outside of defined business hours. It specifically looks for 'Add member to role completed' or 'Add app role assignment grant to user' operations where the target role contains 'admin' or 'Manage', and the event occurs outside of the configured business hours (7 AM to 6 PM local time, Monday to Friday).
Analytic detect abnormal pattern of command and scripting interpreter followed by USB mount
This detection identifies outbound SSL connections where the certificate issuer or subject matches suspicious strings associated with PureRAT infrastructure.
This detection identifies when Microsoft Teams applications send messages to groups / users in your organization's tenant. It utilizes the 'BotAddedToTeam' and 'AppInstalled' action types from CloudAppEvents to collect all Teams applications created in the specified timeframe and then joins on MessageEvents, matching events where SenderObjectId equals AppGuid.
This activity is significant as it may uncover unverified applications being added to teams channels and communicating with users in your tenant. Teams application security, compliance, and permissions can be reviewed in the Microsoft Teams Admin portal -
https://admin.teams.microsoft.com/policies/manage-apps/
This activity is significant as it may uncover unverified applications being added to teams channels and communicating with users in your tenant. Teams application security, compliance, and permissions can be reviewed in the Microsoft Teams Admin portal -
https://admin.teams.microsoft.com/policies/manage-apps/
This detection looks for any mass deletion events on an endpoint from a previously unseen and unsigned executable.
KQL Query from file: Potential ClickFix Execution
Guildma malware (also known as Astaroth), has been observed abusing the legitimate Windows colorcpl.exe tool in a cunning way. According to SANS ISC, the malware first uses colorcpl.exe to silently copy bitsadmin.exe into the writable C:\Windows\System32\spool\drivers\color\ directory, avoiding the typical copy command that security tools might detect. Once relocated, Guildma executes this copy of bitsadmin.exe from the less-scrutinized path to download additional payloads, effectively sidestepping traditional detection mechanisms that monitor only the original binary location.
Shimcache flushing refers to the deliberate clearing or manipulation of the Application Compatibility Cache on a Windows system, which stores metadata about executables that have been run. This cache is valuable for forensic investigations because it provides evidence of program execution, even if the original binary has been deleted. Flushing shimcache could be considered suspicious because it is rarely performed during normal system operations and is often used by attackers to hide their tracks. By wiping this artifact, threat actors attempt to prevent incident responders from identifying which tools or malware were executed on the compromised system. This behavior is typically associated with anti-forensic techniques used by advanced persistent threats, malware, or red team operators.
KQL Query from file: Suspicious Stealer Behavior
Page 50 of 59