Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
504 detections
Filters
Last updated
All Time
Detection languages
250
123
32
26
24
Contributors
140
53
39
37
35
Categories
378
175
162
59
47
Platforms
384
98
29
17
10
Products / Services
142
107
48
40
20
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
3
3
2
2
1
IDS Classtypes
2
1
IDS Protocols
2
KQL Query
KQL Query from file: Remote code execution exploit chain in OpenVPN
KQL Query from file: Monitor Azure API Secrets Extraction
KQL Query from file: Detecting GOLDEN SAML Attack
KQL Query
KQL Query
KQL Query from file: Detecting BYOVDLL Abuse
KQL Query from file: MS Teams DLP Playbook
KQL Query from file: One-Click ANY RUN Storm-1747 KQL Scan
KQL Query from file: Hunting DragonForce with ANY.RUN Threat Intelligence
Detects initial execution patterns and stealer activities used by KimJongRAT PE and PowerShell variants, including LNK/HTA execution, certutil decoding, rundll32 execution, and PowerShell-based data collection.
KQL Query
KQL Query from file: Hunting NonEuclid RAT
KQL Query from file: MDE KQL to detect UAC bypass of Fickle Stealer
KQL Query from file: Detect CVE-2024-31497
Detects when a process attempts to delete its own executable file. This action is often difficult to perform directly and can be a tactic used by malware to remove its traces from a compromised system, making forensic analysis harder.
This analytic detects the use of `get-WebConfigurationProperty` and `Set-ItemProperty` commands in PowerShell to disable HTTP logging on Windows systems. This detection leverages PowerShell Script Block Logging, specifically looking for script blocks that reference HTTP logging properties and attempt to set them to "false" or "dontLog". Disabling HTTP logging is significant as it can be used by adversaries to cover their tracks and delete logs, hindering forensic investigations. If confirmed malicious, this activity could allow attackers to evade detection and persist in the environment undetected.
Detects files that have extensions commonly seen while SDelete is used to wipe files.
'Detect mass file deletion events within Azure File and Blob storage. deleteWindow controls
the period of time the deletions must occur in, whilst the deleteThreshold controls how many files
must be deleted within that threshold. Query works on a per-IP address basis, so will only detect a single
IP deleting multiple files.'
the period of time the deletions must occur in, whilst the deleteThreshold controls how many files
must be deleted within that threshold. Query works on a per-IP address basis, so will only detect a single
IP deleting multiple files.'
This query helps hunting for BEC - File sharing tactics - OneDrive or SharePoint
Detects execution of the "del" builtin command to remove files using greedy/wildcard expression. This is often used by malware to delete content of folders that perhaps contains the initial malware infection or to delete evidence.
Page 20 of 24