Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,151 detections
Filters
Last updated
All Time
Detection languages
2,297
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
2,854
2,017
813
521
213
Products / Services
1,334
1,144
831
576
366
MITRE Techniques
1,820
1,307
787
746
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
The following analytic detects the execution of a DNS query by a process to the associated Telegram API domain, which could indicate access via a Telegram bot commonly used by malware for command and control (C2) communications. By monitoring DNS queries related to Telegram's infrastructure, the detection identifies potential attempts to establish covert communication channels between a compromised system and external malicious actors. This behavior is often observed in cyberattacks where Telegram bots are used to receive commands or exfiltrate data, making it a key indicator of suspicious or malicious activity within a network.
This KQL query detects network traffic to or from suspicious ports by joining firewall logs (CommonSecurityLog) with an external, regularly updated list of known suspicious ports. It specifically looks for accepted or passed connections to these ports, indicating potential exploitation attempts or unauthorized communication channels used by threat actors.
This rule detects suspicious activities related to Remote Monitoring and Management (RMM) tools by querying various data sources. It identifies processes, file signatures, network connections, and firewall logs associated with known RMM tools and domains, helping to uncover potential security threats. The rule leverages an external IOC list for RMM tool names, file signatures, and associated domains.
This rule detects an unusually high volume of DNS queries originating from a single device within a one-hour window. This behavior can be indicative of various malicious activities such as DNS tunneling for command and control, data exfiltration, or extensive reconnaissance.
This rule detects successful Remote Desktop Protocol (RDP) connections by monitoring network events where the remote port is 3389 and the connection action type is 'ConnectionSuccess'. It aims to identify potential unauthorized access, lateral movement, or audit remote administration practices.
This Logic detects the presence of the malicious Chrome extension FreeVPN.One by identifying its unique extension ID across installed browsers. The logic further correlates this presence with network communications initiated by the extension to suspicious or untrusted domains. By combining extension enumeration with traffic analysis, the detection ensures high fidelity with minimal false positives. This layered approach strengthens visibility into malicious browser add-ons masquerading as VPN tools.
This rule detects communication with known malicious domains and IP addresses, as well as the presence or execution of files with known malicious MD5 or SHA256 hashes. It correlates threat intelligence with network and endpoint telemetry to identify compromised devices or accounts.
Detects defense evasion tactics used by UpCrypter, such as checking for forensic tools or sandbox environments.
This rule detects DNS queries to known malicious domains by joining IdentityQueryEvents with ThreatIntelligenceIndicator data. It specifically looks for matches between the queried domain (QueryTarget) and known malicious domains (DomainName) from threat intelligence feeds.
This rule detects attempts to exploit known CVEs on the network where the targeted device is identified as vulnerable to that specific CVE. It correlates network inspection signatures with vulnerability management data to identify high-confidence exploitation attempts.
This rule detects Tycoon and ODx AiTM phishing activity that bypasses MFA. It matches:
🔹 Network connections to known malicious domains, IP addresses, and URLs.
🔹 Email-URL clicks and Azure AD sign-in events involving those domains or specific malicious application IDs.
🔹 Sign-ins originating from suspect IP addresses or user-agent strings.
🔹 Network connections to known malicious domains, IP addresses, and URLs.
🔹 Email-URL clicks and Azure AD sign-in events involving those domains or specific malicious application IDs.
🔹 Sign-ins originating from suspect IP addresses or user-agent strings.
This rule detects RDP sessions initiated from managed devices to unmanaged devices or devices that do not have a Trusted Platform Module (TPM) enabled or supported. This can pose a security risk, especially when Windows Hello for Business credentials are used, as the keys might not be adequately protected on the destination device.
This detection rule identifies potential exploitation attempts of CVE-2024-36401, a JXPath injection vulnerability in GeoServer. Attackers can send malicious WFS, WMS, or WPS requests to achieve remote code execution. The rule looks for common GeoServer service paths and request types combined with Java code execution strings in web server or network logs.
This detection rule uses a WDAC audit policy to ingest missing DeviceImageLoad events in MDE, and check for suspicious processes using the ncrypt.dll and requesting an Entra ID Nonce. More information on the attack scenario this is detection is applicable for can be found in the references.
This rule detects activities associated with the RomCom threat group, including exploitation of CVE-2025-8088 (WinRAR path traversal), COM hijacking for persistence, anti-analysis techniques (RecentDocs check), C2 communication, and suspicious WMIC execution, potentially linked to a Mythic agent.
Detects suspicious activities related to CVE-2025-8088 WinRAR exploitation, including malicious file creation, COM hijacking, C2 communication, and anti-analysis techniques. Enhanced with ADS detection, command-line analysis, and refined false positive handling. This threat is now attributed to RomCom.
Detects potential Command and Control (C2) communication patterns based on ASIM-normalized network session data in Microsoft Sentinel. This detection covers three primary patterns:
1) Periodic beaconing with low jitter
2) Long-lived HTTP(S) long-polling sessions
3) Network traffic with very consistent payload sizes
Such patterns can indicate covert communication with compromised systems or malware infections.
1) Periodic beaconing with low jitter
2) Long-lived HTTP(S) long-polling sessions
3) Network traffic with very consistent payload sizes
Such patterns can indicate covert communication with compromised systems or malware infections.
Detects various Indicators of Compromise (IOCs) associated with UAT-7237 activity, including file hashes, IP addresses, domains, and URLs. This rule identifies suspicious process executions based on known malicious file hashes and network connections to malicious IP addresses or URLs.
Detects network traffic associated with the Tycoon and ODx phishing kits, which are used in Attacker-in-the-Middle (AiTM) phishing campaigns to bypass MFA. The rule identifies connections to known malicious domains, IP addresses, and specific URLs used by these kits.
Detects when the explorer.exe process makes a network connection over SMB to a remote host and subsequently creates an executable file. This behavior is indicative of CVE-2025-50154, where a specially crafted LNK file can cause explorer.exe to silently download a binary from a remote share without user interaction.
This rule detects successful network connections from external (internet) IP addresses to common Industrial Control System (ICS) ports, such as Modbus (502) and EtherNet/IP (44818). This activity could indicate unauthorized access attempts, reconnaissance, or exploitation of internet-exposed ICS assets. The rule specifically filters for allowed/accepted/permitted connections and excludes connections from RFC 1918 private IP addresses and a configurable list of authorized external IPs.
Page 212 of 246