Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
The following analytic detects the use of the Background Intelligent Transfer Service (BITS) client application in allowed outbound connections. It leverages logs from Cisco Secure Firewall Threat Defense devices and identifies instances where BITS is used to initiate downloads from non-standard or unexpected domains. While BITS is a legitimate Windows service used for downloading updates, it is also commonly abused by adversaries to stealthily retrieve payloads or tools. This analytic filters out known Microsoft Edge update URLs and focuses on connections that may indicate suspicious or unauthorized file transfers. If confirmed malicious, this could represent a command and control (C2) channel or a download of malware or tooling as part of an attack chain.
Detects post-exploitation techniques used by the GoldMelody Initial Access Broker (also tracked as TGR-CRI-0045 and UNC961). This activity includes the use of a specific staging directory 'C:\Windows\Temp\111t' for custom tooling like 'updf.exe' for privilege escalation and 'txp.exe'/'txpm.exe' for port scanning.
Detects suspicious use of mshta.exe to execute HTA files followed by certutil.exe for potential data decoding operations related to executable file downloads.
Detects suspicious script download attempts initiated by a Java process, indicative of potential JDWP exploitation leading to Remote Code Execution (RCE). Attackers often leverage exposed JDWP interfaces to execute commands like downloading and running malicious scripts.
Detects suspicious command-line strings within the 'TypedPaths' registry key, specifically targeting entries associated with web browsers. This behavior is indicative of the "FileFix" technique, where users are tricked into pasting malicious commands into browser file upload dialogs. The rule looks for common command-line utilities like 'cmd', 'curl', 'powershell', 'bitsadmin', 'certutil', 'mshta', and 'regsvr32' within the 'url1' value of the 'TypedPaths' key, combined with the presence of a '#' character, which often signifies a comment or a separator in such malicious constructs.
Detects execution or download of known BERT Ransomware payload hosted at http://185.100.157.74/payload.exe or matching known hash indicators.
SPL Query
KQL Query
KQL Query from file: DefenderXDR Advanced Hunting All-In-One IP Search
KQL Query
KQL Query from file: Multi-Cloud DefenderXDR KQL Threat Detection
KQL Query
Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.
Detects a suspicious call to Invoke-WebRequest cmdlet where the and output is located in a suspicious location
KQL Query from file: Detect Power Pwn (aka LOLCopilot) Red Team Tool
KQL Query
Detects initial execution patterns and stealer activities used by KimJongRAT PE and PowerShell variants, including LNK/HTA execution, certutil decoding, rundll32 execution, and PowerShell-based data collection.
KQL Query from file: Sentinel Alerts & MITRE ATT&CK Analysis
KQL Query from file: Hunting IngressNightmare (CVSS 9.8)
The analytic identifies instances where the Windows Explorer process (explorer.exe) is executed with a URL in its command line. This behavior is uncommon and suspicious, as adversaries may abuse explorer.exe to open URLs with the default browser to download and execute malicious payloads. This detection leverages process execution logs from EDR agents.
KQL Query
Page 105 of 121