Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,151 detections
Filters
Last updated
All Time
Detection languages
2,297
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
2,854
2,017
813
521
213
Products / Services
1,334
1,144
831
576
366
MITRE Techniques
1,820
1,307
787
746
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects execution of the Interlock RAT PHP variant and associated activity by looking for specific execution parameters, initial download commands, and known malicious file hashes, domains, and IP addresses.
This rule detects potential proxy bypass attempts by identifying network connections on common web ports (80, 443) that are allowed by the network firewall but do not appear in the proxy logs. It correlates network traffic from the Network_Traffic data model with proxy traffic from the Web data model. The rule specifically filters for external-bound traffic by excluding private and multicast IP addresses.
Detects a network connection initiated by a binary to "api.mega.co.nz".
Attackers were seen abusing file sharing websites similar to "mega.nz" in order to upload/download additional payloads.
Attackers were seen abusing file sharing websites similar to "mega.nz" in order to upload/download additional payloads.
Detects an executable that isn't dropbox but communicates with the Dropbox API
Detects network connections to Cloudflared tunnels domains initiated by a process on the system.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Detects an a non-browser process interacting with the Telegram API which could indicate use of a covert C2
This hunt looks for PowerShell being executed as a child or grandchild of mshta.exe or network events initiated by PowerShell as a child of mshta.exe.
There are two ways to approach this:
Look for device network events initiated by PowerShell with a parent of mshta.exe
Look for process events where PowerShell is executed with a parent process of mshta.exe
The search in this hunt leverages the second approach.
You could also look for PowerShell command lines making web requests but the obfuscation employed by known threat actors makes this more difficult to find by matching strings.
There are two ways to approach this:
Look for device network events initiated by PowerShell with a parent of mshta.exe
Look for process events where PowerShell is executed with a parent process of mshta.exe
The search in this hunt leverages the second approach.
You could also look for PowerShell command lines making web requests but the obfuscation employed by known threat actors makes this more difficult to find by matching strings.
This rule detects network connections or DNS queries to domains associated with the Tycoon 2FA phishing kit. The rule leverages an external data source containing a list of known malicious domains used by this phishing kit. Detection occurs if a device attempts to connect to or resolve any of these domains.
This rule detects activity from a list of specified malicious IP addresses across network connection events and sign-in attempts. It correlates `DeviceNetworkEvents` (network connections from devices) and `SigninLogs` (user authentication attempts) to identify instances where these IPs are involved. The rule is designed for hunting, looking back 30 days for any activity originating from the defined IP addresses.
This rule detects attempts to phish user credentials by identifying Base64 encoded User Principal Names (UPNs) or their domains within URLs clicked by users. Adversaries often encode sensitive information like UPNs in malicious URLs to bypass security controls or to make the links appear less suspicious. The rule specifically looks for partial Base64 encoded strings of the user's UPN or domain within the 'UrlChain' field of URL click events.
Detects mshta.exe executing with command-line arguments containing 'http', which is indicative of mshta.exe being used to download and execute remote HTA files or scripts. This procedure is known to be used in ClickFix attacks where threat actors use fake Captcha portals to download malware payloads.
Detects potential Active Directory enumeration via LDAP. This rule identifies suspicious LDAP search filters and distinguished name enumerations that are commonly used by reconnaissance tools like PowerView and SharpHound to gather information about users, groups, computers, and domain trusts within an Active Directory environment. The rule specifically looks for various 'groupType', 'sAMAccountType', 'objectCategory', 'objectClass', 'primaryGroupID', 'userAccountControl' attributes, and specific distinguished names or flags that indicate detailed AD reconnaissance.
Detects network connections to Cloudflare's trycloudflare.com domain by processes commonly abused by threat actors for payload delivery or command and control (C2), indicating potential misuse of Cloudflare Tunnels.
KQL Query
Generic rule content from file: LOLBAS - Execution - Outbound Traffic to Suspicious TLD
KQL Query from file: NauthNRPC Detection
Detects the creation of the Tor process from a specific directory using command line arguments indicative of controlling and logging ports.
KQL Query from file: DEVMAN ransomware detection
KQL Query
Analyze Mail Bomb Attack by ISP
Page 216 of 246