Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,746 detections
Filters
Last updated
All Time
Detection languages
1,334
86
80
79
79
Contributors
515
305
271
90
67
Categories
20,443
11,831
5,875
5,151
4,864
1,746
Platforms
1,483
338
159
7
7
Products / Services
937
167
117
79
56
MITRE Techniques
758
441
324
250
241
CVEs
5
5
5
5
5
IDS Classtypes
1
Detects suspicious execution or persistence artifacts in /etc/rc.d/ or /usr/local/libexec/ipsec/ on edge firewalls, specifically indicating VerdantBamboo's BRICKSTORM malware on pfSense appliances. The rule looks for process command lines or folder paths containing "/usr/local/libexec/ipsec/blacklist" or modifications to "/etc/rc.d/cron" that include "blacklist".
Detects the specific threat string used by the Miasma/Shai-Hulud malware variant to wipe systems if a stolen token is revoked. This rule looks for the highly unique string 'IfYouInvalidateThisTokenItWillNukeTheComputerOfTheOwner' within process command lines.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
Detects processes attempting to scrape unmasked CI runner secrets from memory, specifically looking for techniques used by the Miasma worm to bypass GitHub Actions secret masking. This rule identifies suspicious command-line patterns indicative of secret extraction, such as searching for 'isSecret' or accessing '/proc/mem' with Python.
This rule detects an unusual frequency of inventory-related commands being executed on a device within a one-hour window. Specifically, it looks for `tasklist.exe`, `wmic.exe`, or `Get-HotFix` being run 5 or more times in an hour. This behavior can indicate an adversary performing system information discovery.
Detects the execution of common security scanning executables such as Microsoft Malicious Software Removal Tool (MSRT) and generic 'scan.exe'. This rule counts the occurrences of these executions per device per hour, which can indicate legitimate security operations or potential adversary activity if used for discovery or defense evasion.
Detects the execution of common security scanning executables such as Microsoft Malicious Software Removal Tool (MSRT) and generic 'scan.exe'. This rule counts the occurrences of these executions per device per hour, which can indicate legitimate security operations or potential adversary activity if used for discovery or defense evasion.
This rule detects attempts to stop services or tamper with security tools (Windows Defender, EventLog) using 'sc stop', 'net stop', 'wevtutil cl', 'Add-MpPreference', or 'Set-MpPreference' commands, specifically when initiated by 'explorer.exe'. This could indicate an adversary attempting to impair defenses or achieve persistence.
Detects PowerShell reading image files and loading their contents directly into memory as .NET assemblies, a stealth technique used to hide malicious payloads inside benign-looking files.
Detects the use of 'forfiles.exe' with the '/c' execution parameter, a technique that can be abused to launch arbitrary commands while potentially bypassing application controls. This activity is often associated with defense evasion tactics.
This rule detects the execution of 'net.exe' or 'net1.exe' with the command line containing 'time /domain' within 10 minutes after 'quickassist.exe' has been executed. This behavior can indicate an adversary performing system time discovery or domain reconnaissance after gaining initial access or establishing remote access via Quick Assist.
Detects the use of 'forfiles.exe' with the '/c' execution parameter, a technique that can be abused to launch arbitrary commands while potentially bypassing application controls. This activity is often associated with defense evasion tactics.
Detects instances of the Tor daemon executing with custom torrc configurations outside of the standard Tor Browser directory. This behavior is often associated with malware like IronWorm, which downloads the Tor expert bundle, writes its own torrc, and starts the daemon to tunnel C2 traffic.
Detects a hidden PowerShell process dynamically loading the Windows Forms assembly to inject base64-encoded keystrokes into foreground applications. This technique is used by the SStar Agent RAT for its remote 'type' functionality.
Detects the __DAEMONIZED=1 environment variable marker used by the vpmdhaj npm supply chain campaign (Mini Shai-Hulud) to spawn a detached credential-harvesting payload during npm install. This marker prevents re-entry when payload.bin is re-launched on subsequent require() calls. Microsoft explicitly recommends this detection, noting that the exact string __DAEMONIZED=1 has no legitimate npm ecosystem use, leading to near-zero false positives.
This rule detects various activities associated with the Nimbus Manticore implant, including its process execution with a specific argument, the creation of a scheduled task for persistence, and the staging of malicious files in a specific AppData directory. It looks for the execution of 'setup.exe' with 'doit' argument, the creation of a scheduled task containing 'BackupCheck', and the creation of specific files like 'setup.exe.config', 'TOTPGuard.dll', 'main.dll', and 'setup.exe' within the '\AppData\Roaming\2FAGuard\' folder.
Identifies ScreenConnect client service execution initiated by trusted system processes (dfsvc.exe, services.exe) while referencing suspicious top-level domains (.top, .info, .site, .tk, .xyz, .pw, .ml, .club, .cf, ws) in the command line. This activity may indicate unauthorized remote access deployment or abuse of legitimate remote access tools.
Detects regedit.exe being used to import a registry (.reg) file located in the C:\ProgramData\ directory. This technique is utilized in the Nimbus RAT attack chain, where users are socially engineered via Teams to manually import a pre-staged .reg file (e.g., InboxCorePro.reg) to establish persistence on the host.
AppArmor Profile Removed
Cortex XDR
This rule detects attempts to remove AppArmor profiles. AppArmor is a Linux security module that allows system administrators to restrict program capabilities with per-program profiles. An adversary might attempt to remove or disable AppArmor profiles to bypass restrictions and perform unauthorized actions.
This query identifies devices and users where the compromised Nx Console VS Code extension version 18.95.0 was observed in the local VS Code extensions directory or referenced in process command-line activity. The detection focuses only on the affected version: nrwl.angular-console-18.95.0. This query combines two evidence sources: DeviceFileEvents (confirms file or folder activity related to the extension path) and DeviceProcessEvents (confirms execution or command-line reference involving the extension).
KQL Query from file: VSCode Extension Inventory In Your MDE Tenant
Page 69 of 84