Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
197 detections
Filters
Last updated
All Time
Detection languages
87
73
22
4
4
Contributors
39
25
23
23
13
Categories
67
53
47
22
21
Platforms
124
41
12
11
8
Products / Services
31
28
24
21
17
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
3
3
1
1
1
IDS Classtypes
1
IDS Protocols
1
Detects when logs are cleared using the legitimate tool "wevtutil". This is usually done by threat actors to clear traces using LOLBins.
KQL Query
Detects anomalous system behavior that could indicate sophisticated threats deviating from normal activity. This includes unusual process-parent relationships, unexpected network connections from scripting engines, and attempts to modify registry keys related to AMSI or ETW configuration.
Detects power-on or reconfiguration events for virtual machines located in vCenter folders designated for decommissioned or orphaned assets. Threat groups like UNC3944 are known to use such forgotten VMs as staging points for attacks, such as mounting disks from critical systems for offline data theft. Activity on these VMs is highly anomalous and warrants investigation.
Detects DEVMAN ransomware, a variant of DragonForce, based on unique strings related to its mutex, deterministic file renaming, and internal functionalities observed in analysis.
This detection identifies the use of the `esxcli system auditrecords` commands, which can be used to tamper with logging on an ESXi host. This action may indicate an attempt to evade detection or hinder forensic analysis by preventing the recording of system-level audit events. The rule specifically looks for the use of these commands with 'remote' or 'local' arguments, excluding commands executed within a shell.
Detects attempts to remove traces of Remote Desktop Protocol (RDP) activity by clearing specific event logs, deleting registry keys, or removing cache files. This rule identifies command-line actions using 'wevtutil' to clear RDP operational logs, 'reg delete' for RDP client registry keys, and 'del' or 'remove-item' for RDP bitmap cache files. It also directly monitors registry events for RDP client key deletions and file events for RDP cache file deletions.
This detection identifies a significant change to the system clock on an ESXi host, which may indicate an attempt to manipulate timestamps and evade detection or forensic analysis. The rule parses syslog messages from ESXi to extract the stepped time, the delta of the change, and the direction (forward or backward).
This rule detects the presence of specific file hashes (MD5, SHA1, SHA256) across device file events, device process events, and email attachment information. It is designed to identify known malicious files or indicators of compromise (IOCs) within an environment.
DEVMAN Ransomware Detection
KQL Query from file: Detect Microsoft Graph API Abuse
KQL Query from file: Sentinel All-In-One IP ThreatHunt
KQL Query from file: Threat Intelligence Data from Sentinel UEBA
Detects the execution of DragonForce ransomware binary or its associated event log clearing batch script, as observed in attacks leveraging SimpleHelp vulnerabilities.
KQL Query
KQL Query from file: ATP Detection for Critical Identities
KQL Query
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan 05052025
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan 10032025
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan 24022025
Page 7 of 10