Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61,046 detections
Filters
Last updated
All Time
Detection languages
23,955
16,903
4,364
4,342
3,270
Contributors
11,679
8,654
7,555
6,800
4,504
Categories
20,590
11,933
5,910
5,194
4,872
Platforms
40,154
7,369
6,547
3,915
3,692
Products / Services
10,809
9,795
6,757
4,421
3,771
MITRE Techniques
18,176
15,735
12,661
8,477
6,293
CVEs
71
71
64
58
49
IDS Classtypes
1,937
503
461
381
237
IDS Protocols
2,431
869
408
324
97
Detects a staged execution sequence on a single device within a 30-minute window involving ftp.exe fetching an icon or resource file, optional schtasks creating a task, curl.exe downloading an MSI, and msiexec.exe installing the MSI.
Detects a suspicious execution chain where a LNK file executed from a mounted VHDX launches cmd.exe, opening a decoy .xls/.xlsx file while simultaneously launching a silent MSI installation using msiexec.
Detects the use of the "capsh" utility to invoke a shell.
Detects the addition of a new "Allow" firewall rule by the WMI process (WmiPrvSE.EXE).
This can occur if an attacker leverages PowerShell cmdlets such as "New-NetFirewallRule", or directly uses WMI CIM classes such as "MSFT_NetFirewallRule".
This can occur if an attacker leverages PowerShell cmdlets such as "New-NetFirewallRule", or directly uses WMI CIM classes such as "MSFT_NetFirewallRule".
Detects modifications to DNS records in Active Directory where the Distinguished Name (DN) contains a base64-encoded blob
matching the pattern "1UWhRCAAAAA...BAAAA". This pattern corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure,
commonly used in Kerberos coercion attacks. Adversaries may exploit this to coerce victim systems into authenticating to
attacker-controlled hosts by spoofing SPNs via DNS. It is one of the strong indicators of a Kerberos coercion attack,.
where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.
Please investigate the user account that made the changes, as it is likely a low-privileged account that has been compromised.
matching the pattern "1UWhRCAAAAA...BAAAA". This pattern corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure,
commonly used in Kerberos coercion attacks. Adversaries may exploit this to coerce victim systems into authenticating to
attacker-controlled hosts by spoofing SPNs via DNS. It is one of the strong indicators of a Kerberos coercion attack,.
where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.
Please investigate the user account that made the changes, as it is likely a low-privileged account that has been compromised.
Detects disabling of the "Automatic Sample Submission" feature of Windows Defender.
Detects the use of curl with NTLM authentication and empty credentials (-u :), which can be abused to leak the currently logged-in user's NTLMv2 challenge-response to an
attacker-controlled server, enabling offline cracking or relay attacks.
When no credentials are provided, the Microsoft-shipped curl passes a NULL identity to Windows SSPI, which automatically falls back to the current user's logon session credentials
stored in LSASS — without requiring a plaintext password.
This behavior is exclusive to the curl binary shipped by Microsoft (available since Windows 10 / Windows Server 2019), which is built with SSPI support.
attacker-controlled server, enabling offline cracking or relay attacks.
When no credentials are provided, the Microsoft-shipped curl passes a NULL identity to Windows SSPI, which automatically falls back to the current user's logon session credentials
stored in LSASS — without requiring a plaintext password.
This behavior is exclusive to the curl binary shipped by Microsoft (available since Windows 10 / Windows Server 2019), which is built with SSPI support.
Detects the use of reg.exe or PowerShell to delete the Windows Defender context menu handler registry keys.
This action removes the "Scan with Microsoft Defender" option from the right-click menu for files, directories, and drives.
Attackers may use this technique to hinder manual, on-demand scans and reduce the visibility of the security product.
This action removes the "Scan with Microsoft Defender" option from the right-click menu for files, directories, and drives.
Attackers may use this technique to hinder manual, on-demand scans and reduce the visibility of the security product.
Detects potential Adversary-in-the-Middle (AiTM) phishing attacks targeting Microsoft 365. The rule correlates browser network events where a user lands on a non-Microsoft host showing interaction required or session information errors, followed shortly by a successful Entra ID sign-in from the same user account.
Detects endpoint telemetry indicators associated with DDoSia client activity, including specific process executions, file creations/renames for executables or scripts, and network connections to NoName057(16) Tor portal infrastructure (nnmo57).
Detects a sequence where a non-browser process connects to a dead drop/paste or chat service (such as Pastebin, Nostr, or Telegram), followed on the same device by contact with the FLATROOF C2 webhook domain.
Detects a sequence where a Terraform provider process executes on a developer host, followed by the same device establishing a network connection to known ROOFDECK or FLATROOF C2 domains or IP addresses within 1 hour.
Detects Cobalt Strike psexec or psexec_psh lateral movement behavior where a Windows service (Event ID 7045) is installed using either an ADMIN$ binary path or a hidden encoded PowerShell command, followed by the spawned process executing rundll32.exe.
Detects PowerShell execution with an encoded command that invokes reg.exe to modify the Terminal Server registry settings, specifically setting fDenyTSConnections to 0 to enable Remote Desktop.
Detects the Remote Desktop client (mstsc.exe) attempting to open the Local Security Authority Subsystem Service (lsass.exe) with PROCESS_VM_READ access rights (0x1010), which is indicative of credential dumping or process injection.
Network-layer view of the tooling. It catches exfil where the command line is obfuscated, wrapped in a script, or the binary is renamed, and gives you destination context (IP, URL, port) for pivoting. BITS is excluded because transfers are performed by svchost.exe, not bitsadmin.exe.
Detects successful interactive sign-ins followed by non-interactive session replays using the same SessionId from a different IP address and country within 60 minutes, which is indicative of an Adversary-in-the-Middle (AiTM) phishing attack and subsequent session hijacking.
Detects a sequence of suspicious activities where a risky or anomalous Entra ID sign-in is followed by the creation or modification of inbox rules (such as deleting, moving, or marking messages as read) and a subsequent burst of outbound emails from the same user account.
KQL Query from file: Detecting the Node.js Brotli RCE
This rule detects high-volume password spraying activity against Microsoft Entra ID (M365) sign-ins. It utilizes two detection branches: a behavioral branch identifying single source IPs generating massive failed sign-ins and lockouts across multiple accounts, and an indicator-based branch flagging known Storm-0940 infrastructure or specific scripted user agents performing rapid authentication attempts.
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
Page 6 of 2907