Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
84 detections
Filters
Last updated
All Time
Detection languages
35
33
7
3
2
Contributors
24
18
15
6
5
Categories
34
27
16
12
7
Platforms
52
19
6
6
5
Products / Services
20
13
7
5
5
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
2
IDS Classtypes
1
IDS Protocols
1
Detects MuddyWater Rust-based implants containing unstripped build artifacts, specifically the username 'Jacob' and other development environment paths.
Detects potential psexec command that initiate execution on a remote systems via common commandline flags used by the utility
Detects suspicious commandline flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights
Detects unknown program using commandline flags usually used by tools such as PsExec and PAExec to start programs with SYSTEM Privileges
This query helps calculate overall efficacy of MDO based on threats blocked pre-delivery, post-delivery cleanups, or were uncaught.
KQL Query
KQL Query
KQL Query from file: CVE-2024-3094 with CVSS Score 10
Detects specific process parameters as used by Mustang Panda droppers
This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the locations they are stored
This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the workload in which they are stored
This query visualises total files located on SharePoint, OneDrive and Teams with Malware detections over time summarizing the data daily.
This query visualises the daily amount of emails that had a post delivery action from zero-hour auto purge, summarizing by phish,spam or malware detection action
Detects the creation of an executable by another executable.
Detects specific process parameters as used by Mustang Panda droppers
Detects a command used by conti to find volume shadow backups
Detects suspicious commandline flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights
This query visualises total emails with Malware detections over time summarizing the data daily by Malware detection technologies/controls used for detecting unknown-unique malware.
Detects potential psexec command that initiate execution on a remote systems via common commandline flags used by the utility
Detects potential psexec command that initiate execution on a remote systems via common commandline flags used by the utility
'This query combines different Storage alerts with CommonSecurityLogs and StorageLogs helping analysts triage and investigate any
possible Storage related attacks faster thus reducing Mean Time To Respond'
possible Storage related attacks faster thus reducing Mean Time To Respond'
Page 2 of 4