Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
72 detections
Filters
Last updated
All Time
Detection languages
32
17
14
8
1
Contributors
17
14
14
8
5
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
34
21
18
13
12
Products / Services
17
16
14
8
7
MITRE Techniques
27
21
15
13
13
CVEs
1
Correlate XDR Data with Alert ID
Cortex XDR
This rule correlates an existing alert (identified by alert_id) with XDR data based on hostname and a narrow time window (500 milliseconds before and after the alert time). It aims to find XDR events that occurred on the same host around the time an alert was generated.
Creating multiple detections without reviewing them over time to ensure they’re still effective can easily turn them into pure noise, adding nothing but fatigue to our day-to-day incident analysis.
The DOVE Model (Detection Overlap & Value Evaluation) evaluates detections across four main dimensions (https://zenodo.org/records/20011459):
1. Detection Type
IOC-based detections tend to have a shorter lifecycle, current TI sources are collecting a huge number of indicators based on new attack or threats which present a higher duplication risk.
IOA-based detections focus on behaviors, have a longer lifecycle, provide higher unique value and requires extended time to create corresponding detection.
2. System / Technology Coverage
Mainstream technologies (e.g., Windows, M365, macOS) are heavily monitored and widely covered by SIEM platforms, increasing duplication probability.
Non-mainstream or custom systems offer less coverage and therefore provide opportunities for more unique detections.
3. Threat Recency
Older or well-known threats are widely documented and likely already covered by existing detections.
New or emerging threats are less likely to be covered, reducing duplication risk and increasing detection value.
4. Source / Provider
Built-in or native detections are already integrated into SIEM platforms and often overlap with custom logic.
Custom or third-party detections introduce tailored logic and reduce overlap probability.
The following KQL query can evaluate how useful are our current detections with the aim to detect alerts that are showing the same assets within the same hour, which indicates potential overlap.
Custom detections added in current SIEM or XDR solutions can easily turn from useful detections into noise, so analyzing their results is crucial.
The DOVE Model (Detection Overlap & Value Evaluation) evaluates detections across four main dimensions (https://zenodo.org/records/20011459):
1. Detection Type
IOC-based detections tend to have a shorter lifecycle, current TI sources are collecting a huge number of indicators based on new attack or threats which present a higher duplication risk.
IOA-based detections focus on behaviors, have a longer lifecycle, provide higher unique value and requires extended time to create corresponding detection.
2. System / Technology Coverage
Mainstream technologies (e.g., Windows, M365, macOS) are heavily monitored and widely covered by SIEM platforms, increasing duplication probability.
Non-mainstream or custom systems offer less coverage and therefore provide opportunities for more unique detections.
3. Threat Recency
Older or well-known threats are widely documented and likely already covered by existing detections.
New or emerging threats are less likely to be covered, reducing duplication risk and increasing detection value.
4. Source / Provider
Built-in or native detections are already integrated into SIEM platforms and often overlap with custom logic.
Custom or third-party detections introduce tailored logic and reduce overlap probability.
The following KQL query can evaluate how useful are our current detections with the aim to detect alerts that are showing the same assets within the same hour, which indicates potential overlap.
Custom detections added in current SIEM or XDR solutions can easily turn from useful detections into noise, so analyzing their results is crucial.
Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.
Impossible Travel
Sigma
Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second.
Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser
Indicates user activity that is unusual for the user or consistent with known attack patterns.
Identifies when an account hasn't signed in during the past n number of days.
Monitoring Chrome Extension Installs
Cortex XDR
This query detects when a new Chrome browser extension is installed on a user’s system. Monitoring browser extension installations helps identify potential security risks, such as unauthorized or malicious extensions that could collect sensitive data, alter browser behavior, or compromise user privacy.
KQL Query from file: The Hunt for QR Phisher
KQL Query from file: Critical Monitor for Critical Assets
KQL Query from file: DefenderXDR MITRE ATT&CK Technique Analysis
'This detection identifies high-severity alerts across various Microsoft security products, including Microsoft Defender XDR and Microsoft Entra ID, and correlates them with instances of Google Cloud VM creation. It focuses on instances where VMs were created within a short timeframe of high-severity alerts, potentially indicating suspicious activity.'
This analytic leverages alerts from Microsoft Defender O365 Incidents. It aggregates and summarizes these alerts, extracting details such as destination, file name, severity, process command line, IP address, registry key, signature, description, and timestamps. The detection filters out alerts with a verdict of 'Clean' from Microsoft. It dynamically maps MITRE techniques from the alert data and assigns a risk score based on the alert's severity. This rule is designed to correlate Microsoft-provided alerts with other data for risk-based alerting, rather than detecting new activity from raw data.
Detects when a Google Cloud identity experiences a low severity event followed by medium severity event within 24 hours.
Amazon GuardDuty detects penetration testing activity from known offensive security distros such as KaliLinux, ParrotLinux or PentooLinux.
Amazon GuardDuty detects an Amazon EC2 instance or a container querying algorithmically generated domains (DGA).
Amazon GuardDuty detects an Amazon EC2 instance or a container attempting to communicate with a black hole IP address.
Amazon GuardDuty detects Command and control activity in Amazon EC2, AWS Lambda or Amazon EKS Runtimes.
Amazon GuardDuty detects CryptoCurrency activity in Amazon EC2, AWS Lambda or Amazon EKS Runtimes.
Amazon GuardDuty detects a Denial of Service (DoS) activity in an Amazon EC2 instance.
Amazon GuardDuty detects Tor Network activity in an AWS account.
Page 3 of 4