Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,116 detections
Filters
Last updated
All Time
Detection languages
6,549
6,199
1,473
1,002
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,567
3,899
1,465
1,391
1,330
Platforms
13,722
1,392
1,318
824
738
Products / Services
3,828
3,129
2,448
912
908
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects execution of BlackX UEFI bootkit installer components, renamed helper binaries acting as payloads (such as jcef_helper.exe renamed to googleupdate.exe), or known malicious file hashes associated with BlackX campaigns.
Detects WinRAR or 7-Zip extracting an archive with a hard-coded password supplied via command line from a cmd.exe batch parent, using switch patterns associated with the RareWolf AnyDesk dropper.
Detects an inbound public network or remote interactive logon to a device, followed within 24 hours by credential-dumping activity, and subsequently within 7 days by email data staging (creation or modification of PST, OST, EML, or MBOX files) on the same device.
Detects process injection activities (such as remote thread creation, memory allocation, and writing to virtual memory) targeting common Windows background processes where the injecting process runs directly from the C:\Windows\ directory with a random or suspicious executable name.
Detects PowerShell execution spawning 7zr.exe to extract password-protected 7z archives using overwrite and password switches within a specified timeframe, or referencing specific malicious IOC file names and domains.
Detects a sequence where PowerShell downloads an .msi installer file from Azure Blob Storage, followed closely by msiexec.exe spawning a PowerShell process on the same device.
Detects mshta.exe launched with an inline javascript: one-liner that chains MSXML2.XMLHTTP to download, ADODB.Stream to write to disk, and WScript.Shell to execute. This identifies the ClickFix social engineering variant that fetches and executes payloads without using PowerShell.
Detects inbound emails where the sender claims to be from an internal or organization domain but has a null envelope sender address, lacks valid DKIM authentication, and does not match common legitimate automated messages (like DSNs or auto-replies), potentially indicating email spoofing or phishing attempts.
Detects PowerShell registering a logon scheduled task that executes a Trays.exe binary from an AppData Yandex Trays path with the -tray argument, or a scheduled task specifically named 'Microsoft apdate'. Associated with the RareWolf AnyDesk dropper batch script.
Correlates a CVE-2026-76504 encoded /%6a_security_check login POST with a follow-on /dataservice/admin/user request from the same client to the same vManage within 10 minutes. Summarized and sorted by follow-on count.
Detects the execution of fsquirt.exe spawned by INISAFECrossWebEXSvc.exe where fsquirt.exe subsequently loads an unsigned or untrusted DLL, indicative of a potential TechHub DLL side-loading technique.
MSI-backed loader execution chain
Cortex XDR
This query uses the process ID of each child to match the parent process's PID, then reconstructs the chain back to explorer.exe. It also checks for the encoded PowerShell, silent MSI installation, and embedded MSI execution behaviours described in the source article.
Important caveats
- Causality scope: This finds matching process events within a shared causality ID; it does not establish that each process directly launched the next.
- Explorer root: The root process may not share the same causality ID in every telemetry scenario. If this join removes otherwise valid results, investigate the root separately.
- Strict matching: Requiring every stage will miss partial chains and variants with different command-line arguments. Consider separate alerts for the encoded PowerShell and silent MSI behaviours.
- Validation: Confirm the field names, join syntax, and causality-ID population against your tenant before deploying this as a production detection.
Important caveats
- Causality scope: This finds matching process events within a shared causality ID; it does not establish that each process directly launched the next.
- Explorer root: The root process may not share the same causality ID in every telemetry scenario. If this join removes otherwise valid results, investigate the root separately.
- Strict matching: Requiring every stage will miss partial chains and variants with different command-line arguments. Consider separate alerts for the encoded PowerShell and silent MSI behaviours.
- Validation: Confirm the field names, join syntax, and causality-ID population against your tenant before deploying this as a production detection.
Detects browser cache smuggling (ClickFix/FileFix delivery mechanisms) where a non-browser script interpreter or LOLBin accesses a browser HTTP-cache directory and writes an executable or script payload outside the cache, followed shortly by the execution of a payload from a user staging directory.
Hunting query for the ConnectWise Cloud Backup (SkyKick) application credential abuse reported in October 2026. It returns three signals, sorted by a Priority column. First, sign-ins by the seven ConnectWise and SkyKick application IDs from a public IP address. ConnectWise states the Cloud Backup app normally signs in from Azure private IPv6 addresses. Second, service principals that sign in from a public IP address in a country not seen in their 14-day baseline. This signal evaluates apps with at least 20 prior sign-ins. Third, Entra audit events initiated by applications. These include an application adding itself or another non-user identity to a directory role, an application adding or changing credentials for the first time in the baseline window and any credential change by an application named ConnectWise or SkyKick. Role additions with an unidentified target appear with Review priority. Audit events initiated by applications carry no source IP, so the IP indicator applies to the sign-in signals only. Routine credential changes by Azure services can still appear with Review priority. The query follows the Microsoft Defender advanced hunting schemas and runs without errors in Advanced Hunting. The audit signal was exercised against live Entra audit events in a Microsoft 365 tenant. Indicator columns are short-lived and used for enrichment only.
Detects administrative access to the DLP console from an unfamiliar address. Console
access permits policy change, violation review and exception approval — everything
needed to make data loss invisible, in one place.
Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='TRELLIX-DLP' and action='LOGIN'
| groupby user, srcip, authproto
access permits policy change, violation review and exception approval — everything
needed to make data loss invisible, in one place.
Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='TRELLIX-DLP' and action='LOGIN'
| groupby user, srcip, authproto
Identifies available cross-process memory and thread manipulation telemetry events in DeviceEvents, tracking actions such as remote thread creation, virtual memory allocation, and process hollowing indicators before constructing process injection correlations.
Detects Microsoft Entra ID sign-ins to specific third-party applications related to Updraft (TeamUpdraft, UpdraftCentral, UpdraftVault, UpdraftClone, UpdraftPlus) with anomalous characteristics such as multi-IP access, distinct countries, or failed-then-successful access attempts, indicating possible credential compromise or misuse.
Detects ABNotify.exe, running from the standard AOMEI Backupper installation path,
spawning any executable located in the html\ rendering hierarchy. This directory is
intended for rendering assets, not executables; a child process launched from here
indicates a hijacked upgrade workflow triggered through the AOMEI notification agent
with no user interaction.
spawning any executable located in the html\ rendering hierarchy. This directory is
intended for rendering assets, not executables; a child process launched from here
indicates a hijacked upgrade workflow triggered through the AOMEI notification agent
with no user interaction.
Detects successful administrative login events originating from IP addresses outside of configured trusted management networks on Fortinet devices.
Detects Trays.exe started with the -tray argument from a Trays subfolder or a batch script, as observed in the RareWolf BAT dropper ahead of a silent AnyDesk installation.
Detects observable hiding actions targeting ScreenConnect (ConnectWise Control) clients, such as modifying registry keys to hide uninstall entries, using attrib.exe to set hidden attributes, or launching management tools with hidden window styles.
Page 2 of 863