Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12,587 detections
Filters
Last updated
All Time
Detection languages
5,139
3,901
1,034
828
478
Contributors
2,488
1,655
1,442
1,408
970
Categories
3,446
1,826
1,661
1,578
1,417
Platforms
8,041
1,889
1,335
1,053
778
Products / Services
1,979
1,796
1,633
1,096
1,041
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
21
21
21
19
14
IDS Classtypes
136
73
43
15
14
IDS Protocols
150
123
15
12
6
This rule detects GlobalProtect VPN login attempts originating from outside of Canada. This can help identify potential unauthorized access or policy violations where users are expected to connect from specific geographic regions.
This rule detects changes to user multi-factor authentication (MFA) configurations within Azure Active Directory. It identifies when MFA methods are added, removed, or changed for a user, providing details on the actor, target, and the specific changes made. This helps in auditing MFA configuration changes, detecting unauthorized modifications, supporting incident response, and ensuring compliance with security policies.
This detection rule identifies suspicious logins by service accounts on devices they haven't accessed in the last 14 days. This behavior could indicate a compromised service account being used for lateral movement within the environment. Service accounts typically have a static set of devices they authenticate to, making deviations easier to spot compared to user accounts. However, some service accounts (e.g., MDI service accounts) are known to dynamically log into devices, which may require environment-specific fine-tuning to reduce false positives.
This rule audits the state of service accounts in the environment by counting total, enabled, and disabled service accounts. This helps in identifying unused or stale service accounts, ensuring only necessary service accounts are active to reduce the attack surface, and supporting compliance and security posture assessments.
This detection rule flags events where conditional access policies are getting weaker, when modifications to CA inclusion or exclusion groups are happening, or when the effectiveness of a policy is disabled.
This rule identifies accounts that have been assigned administrative roles within the environment. It helps assess exposure risk by focusing on identities with elevated permissions, supports attack surface reduction by auditing role assignments, and enables proactive threat hunting for potential misuse of admin privileges.
This KQL query detects suspicious service activities (installation, modification, or deletion) by comparing events with a curated list of known suspicious Windows services. It extracts service names and accounts from device events and joins them with an external CSV list of suspicious services to identify matches. The query aims to alert on the presence or manipulation of services commonly associated with malicious activity.
This rule detects the creation or modification of registry values within common Auto-Start Extensibility Point (ASEP) Run keys. It specifically flags entries that point to suspicious file paths (e.g., C:\Users\Public\, C:\ProgramData\, temporary directories) or contain suspicious command-line interpreters (e.g., rundll32, mshta.exe, powershell.exe, wscript.exe, cscript.exe). The rule filters out modifications made by known legitimate processes to reduce false positives.
This rule detects the presence of potentially malicious or unwanted browser extensions and outbound network connections to known adware or tracking domains. It correlates extension presence with network behavior to identify threats.
This detection specifically flags credentials being added to the Connect Sync Application in Entra ID, a technique known to have persistance from On-premise AD DS to Entra ID. It tries to look at both certificate, client secret, and federated credentials being added, and tries to remove legitimate renewal processes. Since the legitimate renewal process first adds a new certificate only te remove the old one short after, we by default allow for a maximum of 1 minute between the certificate create and delete events.
This rule identifies all enabled service accounts in the environment. The goal is to audit the state of service accounts to identify unused or stale accounts, ensure only necessary service accounts are active, reduce the attack surface, and support compliance and security posture assessments. While not directly detecting malicious activity, it provides crucial visibility for security hygiene and can help identify potential accounts that could be abused by adversaries for persistence or defense evasion.
Detects the PHP variant of the CORNFLAKE.V3 backdoor, which is often dropped as 'config.cfg' and used for C2 communications and payload execution.
This detection flags any changes happening on the Connect Sync Application in Entra ID. Since this is a very interesting account for attackers to abuse when moving laterally between AD DS and Entra ID, any change to the account should be investigated. We try to exclude legitimate certificate renewal processes, and a new account onboarding in the detection rule.
This rule identifies all service accounts in the environment by querying IdentityInfo logs. The goal is to audit the state of these accounts, helping to identify unused or stale service accounts (especially if disabled), ensure only necessary service accounts are active to reduce the attack surface, and support compliance and security posture assessments. This rule does not detect malicious activity but rather provides an inventory for security auditing.
The analytic identifies the deletion or modification of registry keys that disable Local Security Authority (LSA) protection and Microsoft Defender Device Guard. This activity is significant because disabling these defenses can leave a system vulnerable to various attacks, including credential theft and unauthorized code execution. If confirmed malicious, this action could allow attackers to bypass critical security mechanisms, leading to potential system compromise and persistent access.
Detects the creation of a randomly named LaunchDaemon .plist file in /Library/LaunchDaemons/, a technique used by Odyssey Stealer for persistence.
This rule detects process events where `svchost.exe` or `schtasks.exe` are the initiating processes on specific devices. This is designed to identify unexpected or suspicious scheduled tasks, whether system-initiated or user-triggered, on monitored devices. It can be used for hunting or to investigate alerts from other security tools regarding suspicious scheduled tasks.
Enable Rdp Via Registry
YARA-L
Detects a registry modification to enable Remote Desktop Protocol (RDP) by setting the 'fDenyTSConnections' value to 0. This is a common technique used by threat actors, including those deploying KawaLocker, Medusa, and Crypto24 ransomware, to enable lateral movement or establish persistence.
Detects the creation of hidden configuration files used by the Odyssey Infostealer on macOS. These files are known to store sensitive data like passwords, C2 server details, and bot identifiers.
The following analytic identifies a process writing a .txt file to a world writable path. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on file creation events within specific directories. This activity is significant as adversaries often use such techniques to deliver payloads to a system, which is uncommon for legitimate processes. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a significant security risk.
The analytic identifies the execution of PowerShell scripts from the WindowsApps directory, which is a common technique used in malicious MSIX package execution. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process command lines and parent process paths. This activity is significant as adversaries have been observed using MSIX packages with embedded PowerShell scripts (particularly StartingScriptWrapper.ps1) to execute malicious code. If confirmed malicious, this could allow attackers to execute arbitrary code, establish persistence, or deliver malware while evading traditional detection mechanisms.
Page 458 of 600