Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,746 detections
Filters
Last updated
All Time
Detection languages
1,334
86
80
79
79
Contributors
515
305
271
90
67
Categories
20,439
11,829
5,873
5,151
4,864
1,746
Platforms
1,483
338
159
7
7
Products / Services
937
167
117
79
56
MITRE Techniques
758
441
324
250
241
CVEs
5
5
5
5
5
IDS Classtypes
1
Detects repeated crashes of GitLab Ruby, Puma, Sidekiq, or bundle processes on Linux within a short time window. The detection looks for crash markers such as segfault, SIGSEGV, SIGABRT, or onigmo in the command line, which typically indicate exploitation attempts against Onigmo regex engine vulnerabilities.
Correlates a Webcam.dll image load with VM-detection commands (such as queries for VirtualBox, VMware, vbox, vmtoolsd, Win32_ComputerSystem, or Win32_BIOS) executed by the same RegSvcs.exe process, which is characteristic of XWorm malware behavior.
Detects service-initiated processes using cryptocurrency mining algorithms, pool configurations, or miner-specific execution parameters.
This detection flags a parent and child process pair on internet-facing Windows servers, where the parent is a web server process and the child is the process it launched. The web server processes covered are w3wp, httpd, nginx and Tomcat, including versioned Tomcat service executables such as tomcat9.exe and Tomcat running under java.exe, which is identified by the Catalina bootstrap class in its command line. A server is treated as internet-facing based on the most recent status recorded for it.
Instead of matching known web shell names, the query builds a baseline from the previous 30 days of process activity on each device and alerts when a pair appears in the latest window that has never been seen on that device before, so it can catch web shell activity it has never seen before. Because the baseline is held per device, a pair that is normal on one server does not hide the same pair appearing on another.
The rule runs every 24 hours, as this is the only Defender custom detection frequency with a 30-day lookback, and the alert window covers the last 25 hours so that a slightly delayed run does not leave a gap.
The baseline and alert windows are separated by ingestion time rather than event time, so events that arrive late are still evaluated.
Instead of matching known web shell names, the query builds a baseline from the previous 30 days of process activity on each device and alerts when a pair appears in the latest window that has never been seen on that device before, so it can catch web shell activity it has never seen before. Because the baseline is held per device, a pair that is normal on one server does not hide the same pair appearing on another.
The rule runs every 24 hours, as this is the only Defender custom detection frequency with a 30-day lookback, and the alert window covers the last 25 hours so that a slightly delayed run does not leave a gap.
The baseline and alert windows are separated by ingestion time rather than event time, so events that arrive late are still evaluated.
Detects when the same initiating process stops or deletes Windows services and subsequently deletes scheduled tasks or WMI event subscriptions within a 15-minute window on a single device, potentially indicating defense evasion or clean-up actions.
Detects non-root SSH execution performing remote port forwarding (-R) targeting a Unix socket bind on hosts running the tailscaled daemon, excluding known automation tools.
Correlates a running ProFTPD FTP server process listening on TCP port 21 with commands checking or loading the mod_copy module on the same Linux device using Microsoft Defender XDR telemetry.
Detects DNS queries to definitionupdates.microsoft.com or the go.microsoft.com fwlink redirect used for WD update downloads, when the querying process is not a Windows system component. BlueHammer utilizes these definition updates as part of its exploit chain.
Detects the trusted .NET host used in Blinder Tunnel to run an attacker-supplied AppDomainManager: a renamed signed Visual Studio hosting binary as RuntimeBroker.exe, or vshost32.exe for the Blackwood tunneling tool. The attacker’s <host>.exe .config names the malicious DLL, which loads before any host code. The genuine RuntimeBroker.exe only runs from System32, and the \Microsoft\RuntimeBrokers\ install folder does not exist on a clean Windows install. The path arm therefore still fires if the actor renames the host. A LaunchContext field separates first execution (MSBuild/devenv .csproj trigger or Inno Setup installer) from Explorer autostart.
Detects the creation of WordPress administrator accounts using MySQL or WP-CLI command-line tools on hosts, specifically looking for specific username prefixes or email domains associated with suspicious activities.
Sweeps file, process and image-load telemetry for known Kimsuky (APT-C-55) malware MD5 hashes. Exact hash matches carry very low false-positive risk.
Detects the presence of known MD5 file hashes associated with the TraderTraitor trojanized Terraform provider campaign (also known as FLATROOF/ROOFDECK). The query sweeps DeviceFileEvents, DeviceProcessEvents, and DeviceImageLoadEvents across the last 30 days.
Performs an IOC sweep for a known XMRig cryptojacking campaign exploiting a REDCap vulnerability (CVE-2026-90817), detecting matching network connections, file hashes, and process activities across endpoints.
Point-in-time sweep of the 16 published BraZetsu sample SHA-256 hashes across file, process and image-load telemetry. Hashes rotated across five versions, so absence of a hit does not rule out BraZetsu.
This rule detects indicator of compromise (IOC) sweep events associated with the AhsayCBS campaign (CVE-2026-105133 and CVE-2026-105134) involving XMRig cryptominer activity. It checks for specific file and process SHA256 hashes, remote IP addresses, and domain connections related to known mining pools or attacker infrastructure using Sentinel Device tables.
Sweeps file, process and image-load telemetry for known Kimsuky (APT-C-55) malware MD5 hashes. Exact hash matches carry very low false-positive risk.
Detects the AnyDesk Linux service running as root spawning a shell process (sh, bash, dash, zsh) or executing a command associated with the AnyPwn (CVE-2025-27918) post-exploitation behavior.
Correlates a Webcam.dll image load with VM-detection commands (such as queries for VirtualBox, VMware, vbox, vmtoolsd, Win32_ComputerSystem, or Win32_BIOS) executed by the same RegSvcs.exe process, which is characteristic of XWorm malware behavior.
Sweeps file, process and image-load telemetry for known Kimsuky (APT-C-55) malware MD5 hashes. Exact hash matches carry very low false-positive risk.
Detects the presence of known Candiru Windows DLL implant IOC hashes across device file events, process events, image loads, and email attachments.
Detects potential SSH agent hijacking where process command line activities reference SSH authentication sockets or environment variables, followed closely by a successful SSH connection to a remote host from the same device.
Page 3 of 84