Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,875 detections
Filters
Last updated
All Time
Detection languages
2,950
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
3,743
1,857
1,076
782
160
Products / Services
2,237
1,434
1,273
746
582
MITRE Techniques
2,448
2,147
1,128
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
KQL Query
KQL Query
KQL Query from file: External connection to High Risk Countries
KQL Query from file: Detecting Twill Typhoon VSCode Exploit
KQL Query from file: Detecting Phishing Emails with Cloudflare R2 URLs
KQL Query
KQL Query from file: Discord Invite Hijacking Detection
KQL Query from file: KQLWiz PDF NTLM Leak Detector
KQL Query
KQL Query from file: Golden Chickens TerraStealerV2 Malware Detection
KQL Query
KQL Query
KQL Query from file: Tracking Proton66 Activity with KQL
KQL Query from file: CVE-2024-38200 NTLM Exposure Detection
KQL Query from file: CVE-2024-43452 PoC Detection
KQL Query from file: Hunting VEILDrive C2
KQL Query from file: Muddled Libra
'This rule identifies a web request with a user agent header known to belong PowerShell. <br>You can add custom Powershell indicating User-Agent headers using a watchlist, for more information refer to the [UnusualUserAgents Watchlist](https://aka.ms/ASimUnusualUserAgentsWatchlist).<br><br>
This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM WebSession schema (ASIM WebSession Schema)'
This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM WebSession schema (ASIM WebSession Schema)'
This analytic identifies anomalously high outbound network activity from processes within Kubernetes containerized workloads. It compares recent network metrics (TCP/UDP bytes, new sockets, packets) over the last hour against the average metrics from the past 30 days. Significant deviations may indicate data exfiltration, process modification, or container compromise, potentially leading to unauthorized data transfer or further attacks within the containerized environment.
The analytic detects the use of PowerShell's Invoke-RestMethod cmdlet to collect geolocation data from ipinfo.io or IP address information from api.ipify.org. This behavior leverages PowerShell Script Block Logging to identify scripts that gather external IP information and potential geolocation data. This activity is significant as it may indicate reconnaissance efforts, where threat actors are attempting to determine the geographical location or network details of a compromised system. While some legitimate software may use these services, this pattern is commonly observed in malware and post-exploitation toolkits like those used by Water Gamayun threat actors.
Detects network connections to known command and control (C2) domains associated with the 'Banana Squad' threat actor using specific domain patterns and URL paths.
Page 268 of 280