Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,116 detections
Filters
Last updated
All Time
Detection languages
6,549
6,199
1,473
1,002
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,567
3,899
1,465
1,391
1,330
Platforms
13,722
1,392
1,318
824
738
Products / Services
3,828
3,129
2,448
912
908
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects installation of Tiflux RMM components delivered through phishing campaigns. Threat actors abuse Tiflux to establish persistent remote access and subsequently deploy additional remote management tools.
Detects suspicious modifications to Notepad++ configuration files (config.xml or shortcuts.xml) by processes other than Notepad++ itself. This behavior may indicate an attempt to exploit vulnerabilities (e.g., CVE-2026-48778 or CVE-2026-48800) by injecting unvalidated interpreter commands, leading to arbitrary code execution or other malicious activities.
This rule detects the loading of known vulnerable drivers (BYOVD) or drivers from suspicious user-writable paths, combined with the termination of security products. This combination of events is highly indicative of an adversary attempting to gain kernel-level privileges and disable defenses.
This rule detects a highly suspicious sequence of events in Microsoft Entra ID (formerly Azure AD) audit logs: a self-service password reset, followed by the registration of new security information, and then the deletion of existing security information, all performed by the same user within a short time window. This pattern is indicative of an attacker taking over an account, resetting the password, establishing their own MFA/security info, and then removing the legitimate user's security info to lock them out. This behavior has been observed in campaigns like Storm-2949.
Detects the execution of specific file names and directory combinations used by the GRAT malware (Cyber Isnaad Front) to masquerade as legitimate tools before deploying ransomware or wiper modules. Specifically looks for 'Checker.exe.exe', 'WindowsUpdater.exe' in 'C:\ProgramData\', and 'SpellChecker.exe' in '\AppData\Roaming\Microsoft\Spelling\'.
This rule detects the execution of 'vsce-sign.exe' with command-line arguments indicating the verification of cached VS Code extensions. This activity is part of the normal VS Code extension installation and update process, where extensions are verified for integrity and authenticity. While this is a legitimate process, monitoring it can be useful for identifying anomalies or potential supply chain compromises if unexpected extensions are being verified or if the verification process itself is being abused.
Identifies potentially malicious client-side redirects or forced OAuth flows initiating from the Outlook Web Access (OWA) interface, characterized by 302 statuses and redirect parameters. This activity may indicate post-exploitation actions related to CVE-2026-42897.
Identifies package managers (like npm or yarn) executing suspiciously placed setup binaries from hidden or unconventional folders (e.g., tools/setup, .github/scripts/precheck) indicative of IronWorm preinstall hooks.
This rule detects the download of JavaScript (.js) or HTML Application (.hta) files followed by the execution of scripting interpreters like mshta, cscript, wscript, node, or powershell with encoded commands on the same device within a one-hour window. It assigns a score based on the count of downloaded files and executed scripts, triggering an alert if the combined score exceeds 2. This behavior is indicative of potential malicious script execution, often seen in initial access or execution phases of an attack.
KQL Query from file: Email Bombing and Teams Impersonation Detection
Detects modifications to the Windows registry that disable the
Microsoft Vulnerable Driver Blocklist by setting
VulnerableDriverBlocklistEnable to 0. This technique is used by threat actors,
such as the PoisonX RAT, to load vulnerable drivers (BYOVD) and evade or blind
EDR sensors.
Microsoft Vulnerable Driver Blocklist by setting
VulnerableDriverBlocklistEnable to 0. This technique is used by threat actors,
such as the PoisonX RAT, to load vulnerable drivers (BYOVD) and evade or blind
EDR sensors.
Detects the use of `conhost.exe` with the `--headless` flag to stealthily execute the Deno runtime (`deno.exe`). This technique is utilized by the DinDoor backdoor to establish hidden persistence on compromised endpoints.
Detects the Deno runtime executing an in-memory script passed as a Base64-encoded Data URI, effectively bypassing disk monitoring. This technique is utilized by threat actors (e.g., DinDoor) to execute fileless malware payloads.
Detects PowerShell executing certutil.exe to decode base64 files, specifically when a hidden window style is used. This behavior is indicative of the JSE dropper routine employed by the Kimsuky threat group to decode malicious payloads to disk.
Detects the DLL sideloading primitive used by the ValleyRAT (SilverFox APT)
campaign documented by K7 Labs: a legitimate signed Windows binary executing
from C:\ProgramData\ (typically C:\ProgramData\client\) that has been weaponized
to sideload an attacker-controlled DLL. The K7 analysis documents GameBox.exe
(Tencent) as the carrier in this campaign, but ValleyRAT operators rotate
sideloading carriers across campaigns - AntiyAVL.exe, DXVZ.exe, DXOPT.exe,
VPNclient.exe, and various Chinese-language application binaries have all been
observed as carriers. The stable detection target is the technique: any
binary executing from ProgramData OR utility.dll being loaded from ProgramData.
campaign documented by K7 Labs: a legitimate signed Windows binary executing
from C:\ProgramData\ (typically C:\ProgramData\client\) that has been weaponized
to sideload an attacker-controlled DLL. The K7 analysis documents GameBox.exe
(Tencent) as the carrier in this campaign, but ValleyRAT operators rotate
sideloading carriers across campaigns - AntiyAVL.exe, DXVZ.exe, DXOPT.exe,
VPNclient.exe, and various Chinese-language application binaries have all been
observed as carriers. The stable detection target is the technique: any
binary executing from ProgramData OR utility.dll being loaded from ProgramData.
Detects variable splitting technique in cmd.exe to obfuscate PowerShell invocation.
This rule detects the use of Azure Managed Identity tokens originating from non-Azure IP spaces. This scenario is indicative of token theft, likely via the Instance Metadata Service (IMDS) endpoint (169.254.169.254), followed by an external replay of the stolen token from an attacker's infrastructure. Legitimate Managed Identity calls are expected to originate from Azure infrastructure IPs. The rule filters out legitimate Microsoft/Azure ASNs and RFC1918 private IP ranges to reduce false positives. It also categorizes the potential attack stage based on the operation name, including Key Vault access, Storage access, VM Code Execution, Privilege Escalation, and Directory Enumeration.
Detects the execution of mshta.exe attempting to download and execute a remote payload masquerading as an msixbundle file.
Detects chmod usage that sets SUID or SGID bits, which can be abused for privilege escalation.
2 is the special bit for SGID
4 is the special bit for SetUID
6 combines the special bits for SetUID and SGID
2 is the special bit for SGID
4 is the special bit for SetUID
6 combines the special bits for SetUID and SGID
This rule detects the creation of scheduled tasks (`schtasks.exe /create`) where the command line arguments contain suspicious executables or paths commonly associated with malicious activity. This indicates a potential persistence mechanism being established by an adversary.
Detects the creation of scheduled tasks that explicitly call mshta.exe, matching the persistence mechanism of the CountLoader payload launcher.
Page 474 of 863