Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
49 detections
Filters
Last updated
All Time
Detection languages
49
Contributors
37
11
1
Categories
8
7
7
5
5
Platforms
20
11
7
5
5
Products / Services
10,809
9,795
6,757
4,421
3,771
MITRE Techniques
20
11
10
8
7
CVEs
3
1
Detects PIM role activations and eligible or active role assignments that involve Entra agent users. Agents are identified by agentType, blueprintId or a maintained UPN list.
Review notes:
- The agentType and blueprintId branches are not validated against real agent user events.
- The UPN list is the only validated signal.
- The UPN list is manual and needs an owner and a review cadence.
- For a scheduled analytic rule, set Lookback to match the run frequency (for example 1d).
Entity mapping: Account: ActorUpn; Account: TargetUser (Actor intentionally not mapped).
Review notes:
- The agentType and blueprintId branches are not validated against real agent user events.
- The UPN list is the only validated signal.
- The UPN list is manual and needs an owner and a review cadence.
- For a scheduled analytic rule, set Lookback to match the run frequency (for example 1d).
Entity mapping: Account: ActorUpn; Account: TargetUser (Actor intentionally not mapped).
Hunts for NetScaler Pitboss packet engine messages where the text after NSPPE carries shell syntax such as separators, command substitution or ${IFS}. Security vendors observed this pattern during exploitation of the NetScaler pre authentication command injection flaw patched in September 2026.
The query reads Syslog and CommonSecurityLog and decodes URL encoding. It checks only the text after NSPPE, so plain heartbeat lines without shell syntax do not match. The matching logic was checked on sample strings only, not on real appliance logs.
Triage: Check the source, the appliance version and whether it was patched at that time. A match on an unpatched appliance points to an exploitation attempt, not proof of success. Preserve logs and a snapshot before upgrading. Hunting query, not an alert.
Limitations: Needs NetScaler syslog forwarded to Sentinel. Empty results do not prove an appliance is clean. Attackers can remove traces and other techniques are not covered. Field names depend on the syslog format and connector. Bare separators and short words can match legitimate messages, so tune the regex after reviewing real results.
The query reads Syslog and CommonSecurityLog and decodes URL encoding. It checks only the text after NSPPE, so plain heartbeat lines without shell syntax do not match. The matching logic was checked on sample strings only, not on real appliance logs.
Triage: Check the source, the appliance version and whether it was patched at that time. A match on an unpatched appliance points to an exploitation attempt, not proof of success. Preserve logs and a snapshot before upgrading. Hunting query, not an alert.
Limitations: Needs NetScaler syslog forwarded to Sentinel. Empty results do not prove an appliance is clean. Attackers can remove traces and other techniques are not covered. Field names depend on the syslog format and connector. Bare separators and short words can match legitimate messages, so tune the regex after reviewing real results.
Lists accounts that still sign in successfully with Authenticated SMTP over the last 30 days. Microsoft plans to disable Basic auth for SMTP AUTH by default for existing tenants at the end of December 2026.
Rows come from SigninLogs and AADNonInteractiveUserSignInLogs, grouped per account with source IP count, apps and first and last seen.
Triage: Find the owner of each account, then move the sender to OAuth or a mail relay before the change. Inventory query, not an alert.
Limitations: Covers only sign-ins that reach the logs. Cross check with the Exchange admin center SMTP AUTH Clients Submission Report, which keeps 90 days.
Rows come from SigninLogs and AADNonInteractiveUserSignInLogs, grouped per account with source IP count, apps and first and last seen.
Triage: Find the owner of each account, then move the sender to OAuth or a mail relay before the change. Inventory query, not an alert.
Limitations: Covers only sign-ins that reach the logs. Cross check with the Exchange admin center SMTP AUTH Clients Submission Report, which keeps 90 days.
Hunts for NetScaler Pitboss packet engine messages where the text after NSPPE carries shell syntax such as separators, command substitution or ${IFS}. Security vendors observed this pattern during exploitation of the NetScaler pre authentication command injection flaw patched in September 2026.
The query reads Syslog and CommonSecurityLog and decodes URL encoding. It checks only the text after NSPPE, so plain heartbeat lines without shell syntax do not match. The matching logic was checked on sample strings only, not on real appliance logs.
Triage: Check the source, the appliance version and whether it was patched at that time. A match on an unpatched appliance points to an exploitation attempt, not proof of success. Preserve logs and a snapshot before upgrading. Hunting query, not an alert.
Limitations: Needs NetScaler syslog forwarded to Sentinel. Empty results do not prove an appliance is clean. Attackers can remove traces and other techniques are not covered. Field names depend on the syslog format and connector. Bare separators and short words can match legitimate messages, so tune the regex after reviewing real results.
The query reads Syslog and CommonSecurityLog and decodes URL encoding. It checks only the text after NSPPE, so plain heartbeat lines without shell syntax do not match. The matching logic was checked on sample strings only, not on real appliance logs.
Triage: Check the source, the appliance version and whether it was patched at that time. A match on an unpatched appliance points to an exploitation attempt, not proof of success. Preserve logs and a snapshot before upgrading. Hunting query, not an alert.
Limitations: Needs NetScaler syslog forwarded to Sentinel. Empty results do not prove an appliance is clean. Attackers can remove traces and other techniques are not covered. Field names depend on the syslog format and connector. Bare separators and short words can match legitimate messages, so tune the regex after reviewing real results.
Hunts for NetScaler Pitboss packet engine messages where the text after NSPPE carries shell syntax such as separators, command substitution or ${IFS}. Security vendors observed this pattern during exploitation of the NetScaler pre authentication command injection flaw patched in September 2026.
The query reads Syslog and CommonSecurityLog and decodes URL encoding. It checks only the text after NSPPE, so plain heartbeat lines without shell syntax do not match. The matching logic was checked on sample strings only, not on real appliance logs.
Triage: Check the source, the appliance version and whether it was patched at that time. A match on an unpatched appliance points to an exploitation attempt, not proof of success. Preserve logs and a snapshot before upgrading. Hunting query, not an alert.
Limitations: Needs NetScaler syslog forwarded to Sentinel. Empty results do not prove an appliance is clean. Attackers can remove traces and other techniques are not covered. Field names depend on the syslog format and connector. Bare separators and short words can match legitimate messages, so tune the regex after reviewing real results.
The query reads Syslog and CommonSecurityLog and decodes URL encoding. It checks only the text after NSPPE, so plain heartbeat lines without shell syntax do not match. The matching logic was checked on sample strings only, not on real appliance logs.
Triage: Check the source, the appliance version and whether it was patched at that time. A match on an unpatched appliance points to an exploitation attempt, not proof of success. Preserve logs and a snapshot before upgrading. Hunting query, not an alert.
Limitations: Needs NetScaler syslog forwarded to Sentinel. Empty results do not prove an appliance is clean. Attackers can remove traces and other techniques are not covered. Field names depend on the syslog format and connector. Bare separators and short words can match legitimate messages, so tune the regex after reviewing real results.
Lists accounts that still sign in successfully with Authenticated SMTP over the last 30 days. Microsoft plans to disable Basic auth for SMTP AUTH by default for existing tenants at the end of December 2026.
Rows come from SigninLogs and AADNonInteractiveUserSignInLogs, grouped per account with source IP count, apps and first and last seen.
Triage: Find the owner of each account, then move the sender to OAuth or a mail relay before the change. Inventory query, not an alert.
Limitations: Covers only sign-ins that reach the logs. Cross check with the Exchange admin center SMTP AUTH Clients Submission Report, which keeps 90 days.
Rows come from SigninLogs and AADNonInteractiveUserSignInLogs, grouped per account with source IP count, apps and first and last seen.
Triage: Find the owner of each account, then move the sender to OAuth or a mail relay before the change. Inventory query, not an alert.
Limitations: Covers only sign-ins that reach the logs. Cross check with the Exchange admin center SMTP AUTH Clients Submission Report, which keeps 90 days.
Hunting query, not intended as a scheduled alert.
Tested in a live Sentinel tenant with a test file. Copilot Cowork and Claude Code folder conventions not validated with live events; the Tool column is a label only and does not filter results. Matches files named SKILL.md in OneDrive and SharePoint only; local-only files and marketplace plugin skills are not visible.
Tested in a live Sentinel tenant with a test file. Copilot Cowork and Claude Code folder conventions not validated with live events; the Tool column is a label only and does not filter results. Matches files named SKILL.md in OneDrive and SharePoint only; local-only files and marketplace plugin skills are not visible.
Lists accounts that still sign in successfully with Authenticated SMTP over the last 30 days. Microsoft plans to disable Basic auth for SMTP AUTH by default for existing tenants at the end of December 2026.
Rows come from SigninLogs and AADNonInteractiveUserSignInLogs, grouped per account with source IP count, apps and first and last seen.
Triage: Find the owner of each account, then move the sender to OAuth or a mail relay before the change. Inventory query, not an alert.
Limitations: Covers only sign-ins that reach the logs. Cross check with the Exchange admin center SMTP AUTH Clients Submission Report, which keeps 90 days.
Rows come from SigninLogs and AADNonInteractiveUserSignInLogs, grouped per account with source IP count, apps and first and last seen.
Triage: Find the owner of each account, then move the sender to OAuth or a mail relay before the change. Inventory query, not an alert.
Limitations: Covers only sign-ins that reach the logs. Cross check with the Exchange admin center SMTP AUTH Clients Submission Report, which keeps 90 days.
Hunting query, not intended as a scheduled alert.
Tested in a live Sentinel tenant with a test file. Copilot Cowork and Claude Code folder conventions not validated with live events; the Tool column is a label only and does not filter results. Matches files named SKILL.md in OneDrive and SharePoint only; local-only files and marketplace plugin skills are not visible.
Tested in a live Sentinel tenant with a test file. Copilot Cowork and Claude Code folder conventions not validated with live events; the Tool column is a label only and does not filter results. Matches files named SKILL.md in OneDrive and SharePoint only; local-only files and marketplace plugin skills are not visible.
Hunting query, not intended as a scheduled alert.
Tested in a live Sentinel tenant with a test file. Copilot Cowork and Claude Code folder conventions not validated with live events; the Tool column is a label only and does not filter results. Matches files named SKILL.md in OneDrive and SharePoint only; local-only files and marketplace plugin skills are not visible.
Tested in a live Sentinel tenant with a test file. Copilot Cowork and Claude Code folder conventions not validated with live events; the Tool column is a label only and does not filter results. Matches files named SKILL.md in OneDrive and SharePoint only; local-only files and marketplace plugin skills are not visible.
Hunting query, not intended as a scheduled alert.
Tested in a live Sentinel tenant with a test file. Copilot Cowork and Claude Code folder conventions not validated with live events; the Tool column is a label only and does not filter results. Matches files named SKILL.md in OneDrive and SharePoint only; local-only files and marketplace plugin skills are not visible.
Tested in a live Sentinel tenant with a test file. Copilot Cowork and Claude Code folder conventions not validated with live events; the Tool column is a label only and does not filter results. Matches files named SKILL.md in OneDrive and SharePoint only; local-only files and marketplace plugin skills are not visible.
Hunting query, not intended as a scheduled alert.
Tested in a live Sentinel tenant with a test file. Copilot Cowork and Claude Code folder conventions not validated with live events; the Tool column is a label only and does not filter results. Matches files named SKILL.md in OneDrive and SharePoint only; local-only files and marketplace plugin skills are not visible.
Tested in a live Sentinel tenant with a test file. Copilot Cowork and Claude Code folder conventions not validated with live events; the Tool column is a label only and does not filter results. Matches files named SKILL.md in OneDrive and SharePoint only; local-only files and marketplace plugin skills are not visible.
Flags direct registry staging of a Boot Bus Extender service (SERVICE_SYSTEM_START) whose Args value contains ':changelist', bypassing the Service Control Manager, where the driver image lies outside the Defender platform folder or uses a randomized 8-character filename — the SCM-bypass pattern used to stage BTR.sys for boot-time or immediate execution.
Detects Chrome/Chromium processes launched with the --remote-debugging-port flag (optionally combined with --remote-allow-origins or --headless), enabling Chrome DevTools Protocol (CDP) session hijacking as used by AmnesiaStealer's streaming module to remotely control an authenticated browser session. Excludes known automation frameworks (Puppeteer, Playwright, Selenium).
Detects the ClickFix-style Terminal dropper pattern: zsh/Terminal.app spawning bash with a piped base64-decode or curl-download command redirected through nohup, matching AmnesiaStealer's counterfeit GitHub 'Download for macOS' lure page execution chain.
Correlates a Sysmon DriverLoad event matching known BTR.sys hashes with a subsequent System-process (PID 4) deletion of specific Defender binaries or WdFilter/WinDefend registry keys within a 10-second window — the definitive Defender self-destruction signature of the kernel primitive.
Detects continuous low-frame-rate screenshot capture activity consistent with AmnesiaStealer's remote visual surveillance of a victim's authenticated browser session during live operator control.
Detects abuse of the macOS `security` CLI to unlock the login keychain and suppress interactive prompts, or to delete/recreate the 'Chrome Safe Storage' keychain entry with an attacker-chosen password, matching AmnesiaStealer's keychain and cookie-decryption technique.
Detects local validation of a phished password via dscl -authonly immediately followed by sudo -S -v in a short time window, matching AmnesiaStealer's technique for confirming captured credentials are valid before reuse.
Detects the AmnesiaStealer TCC-bypass chain: correlated Time Machine local snapshot creation/mounting (recycling CVE-2020-9771), hidden snapshot marker files, and direct SQLite injection into a mounted TCC.db copy to grant Full Disk Access, followed by killing tccd to force a reload.
Detects browser cookie theft via a cloned Chrome profile directory, CDP-based cookie export, and/or SQLite re-encryption of the cookie database using an attacker-known Safe Storage password, as used by AmnesiaStealer's streaming module.
Page 1 of 3