Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,045 detections
Filters
Last updated
All Time
Detection languages
15,346
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,106
9,754
3,848
3,756
3,712
Platforms
40,045
7,313
6,542
3,903
3,660
Products / Services
10,431
9,678
6,722
1,887
1,878
MITRE Techniques
13,736
13,114
8,062
5,947
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects a Microsoft Office application loading taskschd.dll, which exposes COM interfaces for managing Windows Scheduled Tasks.
This load is an early precursor to scheduled task creation or modification and has been frequently observed in macro-enabled
malicious documents attempting to establish persistence.
This load is an early precursor to scheduled task creation or modification and has been frequently observed in macro-enabled
malicious documents attempting to establish persistence.
The following analytic detects instances where Java, or Tomcat processes spawn a Linux shell, which may indicate exploitation attempts, such as those related to CVE-2021-44228 (Log4Shell).
This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and parent-child process relationships.
This activity is significant as it can signify a compromised Java application, potentially leading to unauthorized shell access.
If confirmed malicious, attackers could execute arbitrary commands, escalate privileges, or maintain persistent access, posing a severe threat to the environment.
This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and parent-child process relationships.
This activity is significant as it can signify a compromised Java application, potentially leading to unauthorized shell access.
If confirmed malicious, attackers could execute arbitrary commands, escalate privileges, or maintain persistent access, posing a severe threat to the environment.
Detects Node-RED admin API flow deployments (POST /flows) where the payload contains an 'http in' node, a 'function' node, an 'exec' node, and 'addpay' enabled, which can indicate malicious workflow deployment or command execution attempts.
This analytic detects HTTP POST requests with a body of at least one megabyte that receive an HTTP 500 response.
Large failed uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.
Large failed uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.
Detects Kerberoasting activity on endpoints via the execution of Impacket's GetUserSPNs with request flags or hashcat executing Kerberos TGS cracking modes (13100/19700).
Detects suspicious commands executed via the Windows Run dialog (Win+R) by correlating RunMRU registry updates with the originating process. This hunt is intended to identify user-driven execution techniques commonly observed in ClickFix, FileFix, fake CAPTCHA, and other social engineering attacks.
Detects instances where svchost.exe runs outside the standard System32 or SysWOW64 directories and loads the graphics-hook-filter64.dll library, or where the known hash of this sideloaded payload is observed. This behavior is correlated with the presence of the encrypted configuration file graphics-hook_config.bin on the same device.
Detects execution of tunneling, proxy, and remote exposure tools associated with unauthorized access and protocol tunneling and web sockets.
Detects behavior where a process initiates an outbound public network connection and shortly afterwards deletes its own executable file from user-writable directories, a technique commonly associated with malware cleanup such as info-stealers.
This rule detects outbound SSH network connections (to ports 22, 2222) to external, non-private IP addresses.
It filters out internal IP addresses, local traffic, and allows for exclusions based on approved source processes, destination IPs, source hostnames, and destination domains.
It filters out internal IP addresses, local traffic, and allows for exclusions based on approved source processes, destination IPs, source hostnames, and destination domains.
Dual-use transfer tools (rclone, WinSCP, curl, AzCopy, AWS/GCloud CLI) are favored by ransomware affiliates and APT operators for exfiltration because they are signed or legitimate and blend into admin activity. This hunt keys on upload-oriented flags and sub-commands rather than binary presence, and also matches on OriginalFileName to catch renamed binaries (rclone is routinely renamed).
Detects external password spraying activity from a source IP address followed by internal network port scanning or connection attempts originating from a device utilizing that same IP address.
Detects artifacts of the compromised litellm 1.107.0 release: connections to the exfiltration host, installs of the affected version and the dropped stealer files. Needs Defender for Endpoint network, process and file events and covers only published indicators. The query ran without errors in a live tenant.
Detects network connections to the Telegram Bot API (api.telegram.org) originating from processes other than the official Telegram desktop application. Adversaries frequently abuse legitimate services like Telegram for Command and Control (C2) or data exfiltration.
Correlates external Microsoft Teams chat, impersonation, or security risk events targeting a user with the subsequent launch of the Quick Assist application on that user's device within a short timeframe, indicating potential social engineering or tech support scams.
Network-layer view of the tooling. It catches exfil where the command line is obfuscated, wrapped in a script, or the binary is renamed, and gives you destination context (IP, URL, port) for pivoting. BITS is excluded because transfers are performed by svchost.exe, not bitsadmin.exe.
Generic rule content from file: Potential C2 Activity via Outbound Network Connections - T1071.cql
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
Detects outbound IPv4 and IPv6 connections from endpoints to public addresses on ports other than DNS (53), HTTP (80), HTTPS (443), 8000.
Command-and-control tools and tunnels often use uncommon ports to avoid web-focused filtering. Private, loopback, link-local, multicast and documentation ranges are excluded, and repeated connections are grouped by endpoint, process, remote IP and port. Custom apps and admin tools also use these ports, so triage by process, destination reputation and how rare the destination is.
Command-and-control tools and tunnels often use uncommon ports to avoid web-focused filtering. Private, loopback, link-local, multicast and documentation ranges are excluded, and repeated connections are grouped by endpoint, process, remote IP and port. Custom apps and admin tools also use these ports, so triage by process, destination reputation and how rare the destination is.
Detects network connections to webhook.site, execution of command-line tools referencing webhook.site or ArtexProbe, and creation or writing of files associated with ArtexProbe or known webshells.
Detects CrowdStrike Falcon telemetry referencing specific version and folder patterns of the Anthropic Claude Code extension, identifying potentially malicious builds (such as version 2.1.313 or 2.1.312 under Cursor) versus verified clean versions.
Page 1 of 1907