Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,008 detections
Filters
Last updated
All Time
Detection languages
735
639
208
129
126
Contributors
374
315
226
187
119
Categories
566
420
368
284
264
Platforms
1,428
229
198
197
100
Products / Services
442
284
281
147
129
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
2,008
CVEs
10
9
9
8
8
IDS Classtypes
51
43
10
5
4
IDS Protocols
83
29
8
4
1
The following analytic detects the creation and deletion of scheduled tasks within a short time frame (less than 30 seconds) using Windows Security EventCodes 4698 and 4699. This behavior is identified by analyzing Windows Security Event Logs. Such activity is significant as it may indicate lateral movement or remote code execution attempts by adversaries. If confirmed malicious, this could lead to unauthorized access, data exfiltration, or execution of malicious payloads, necessitating prompt investigation and response by security analysts.
The analytic identifies an unusual number of Kerberos service ticket requests (Event ID 4769) originating from a single client address and account. It uses statistical analysis, specifically standard deviation and the 3-sigma rule, to detect anomalies. This activity is significant as it may indicate malicious behavior such as lateral movement, malware staging, or reconnaissance, potentially leading to unauthorized access to multiple endpoints and further compromise.
The following analytic detects the execution of `powershell.exe` using the `Invoke-WmiMethod` cmdlet to start a process on a remote endpoint via WMI. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process telemetry. This activity is significant as it indicates potential lateral movement or remote code execution attempts by adversaries. If confirmed malicious, this could allow attackers to execute arbitrary code on remote systems, leading to further compromise and persistence within the network.
The analytic detects the execution of a Windows Scheduled Task on demand via the shell or command line. It leverages process-related data, including process name, parent process, and command-line executions, sourced from endpoint logs. The detection focuses on 'schtasks.exe' with an associated 'run' command. This activity is significant as adversaries often use it to force the execution of their created Scheduled Tasks for persistent access or lateral movement within a compromised machine. If confirmed malicious, this could allow attackers to maintain persistence or move laterally within the network, potentially leading to further compromise.
Alerts when an authorization token originating from GKE activity is subsequently used within a command line on an endpoint system, suggesting potential credential exfiltration and reuse.
This detection rule identifies the creation of a Windows service with a suspicious or known malicious name, as logged by Windows Event ID 7045 (`A service was installed in the system`). Threat actors often create services to achieve persistence, lateral movement, remote execution, or privilege escalation. Detection of such activity is critical for identifying early-stage post-compromise behavior.
This rule detects the execution of known Proof-of-Concept (PoC) executables for the ZeroLogon vulnerability (CVE-2020-1472). It specifically looks for `cmd.exe` spawning executables named `cool.exe` or `zero.exe` with command-line arguments indicating administrative context and execution flags. Additionally, it identifies subsequent actions such as `taskkill` commands or `powershell` execution, which are common post-exploitation activities after successful ZeroLogon exploitation.
Detects an RDP connection originating from a domain controller. This activity is highly suspicious as domain controllers should not typically initiate RDP connections to other machines. Such an event could indicate lateral movement by an attacker who has compromised the domain controller. The rule specifically filters out connections made by "Microsoft.Tri.Sensor.exe", which is associated with Microsoft Defender for Identity, to avoid false positives from legitimate security operations.
This rule identifies attempts to use expired or revoked OAuth refresh tokens to sign in to Entra ID (formerly Azure AD). This could indicate an adversary attempting to use a previously compromised token that is no longer valid, or a legitimate user whose token has expired due to inactivity (90 days) or revocation. The rule specifically looks for login events from 'Azure Activity' with a 'BLOCK' action and an action detail code of '50173', which corresponds to an expired or invalid refresh token.
This rule detects persistent login activity to the Azure AD PowerShell application. Specifically, it looks for successful user logins to the application identified by the product object ID '1b730954-1685-4b74-9bfd-dac224a7b894' (which corresponds to Azure AD PowerShell) by the same user ID over a 24-hour period. The rule is designed to flag continuous access to this administrative tool, which is not considered a security best practice and warrants further investigation.
This YARA rule detects the Sshdinjector backdoor on Linux systems. It identifies specific byte patterns associated with the backdoor's functionalities, including killing and restarting daemons, network communication, reading the /etc/shadow file (for credential dumping), and listing running services.
Identify Entra ID OAuth refresh tokens are attempted to be used but have expired. This could be because the token hasn't been used for 90 days or it has been revoked
Continual logins to Azure AD PowerShell app are not a security best practice, if this is observed, additional investigation is needed
This rule detects suspicious activity involving an initial successful authentication to Office 365, followed by a non-interactive sign-in to Azure Activity (Entra ID) from the same user and IP address, but with different session IDs, applications, and user agents. This pattern is indicative of token theft and reuse, potentially using tools like GraphRunner, where an adversary uses a stolen token to perform non-interactive actions. The rule specifically looks for a mismatch in session ID, application, and user agent between the initial interactive login and the subsequent non-interactive login, while the user and IP remain consistent. The user agent strings are specifically chosen to align with those used by the GraphRunner tool.
This rule identifies API requests made to the Microsoft Graph API to access user mailboxes and retrieve a specified number of messages. It specifically looks for GET requests to the `/v1.0/users/*/mailFolders/*/messages?$top=` endpoint with a successful HTTP 200 response. This activity could indicate an attacker attempting to exfiltrate emails from a compromised mailbox.
This rule identifies when the HTTP DELETE method is used within the Microsoft Graph API. This can indicate administrative activities such as deleting users, groups, or other resources. The rule specifically looks for network HTTP events where the product event type is 'Microsoft Graph Activity' and the HTTP method is 'DELETE'. It excludes IP addresses within a specific Azure CIDR range (20.151.0.0/16) to reduce noise from internal Azure operations. Further tuning can be applied to target specific API endpoints or user agents.
This rule detects requests to the Microsoft Graph API's '/v1.0/users' endpoint with a GET method and a successful 200 response code. This API call is used to enumerate users within an Azure Active Directory environment. The rule is designed to identify potential reconnaissance activities where an attacker might be collecting a listing of users. It notes that this can be a 'chatty' API call, meaning it might generate a high volume of legitimate traffic.
Detects instances where an SMB service on an OpenCanary honeypot node has received a file open request. This indicates an adversary is interacting with the honeypot's SMB share, potentially attempting to discover or access files.
Detects instances where a VNC service on an OpenCanary node has had a connection attempt. This indicates an adversary attempting to connect to a VNC service, likely for remote access or reconnaissance.
This rule detects when an Entra ID application has a significant increase in the number of assigned permissions within a short timeframe (5 minutes). This could indicate a "greedy permission grab" by an attacker attempting to escalate privileges or gain broader access to resources. The rule specifically looks for an increase of more than 8 permissions compared to the previous state. It does not compare the specific permissions, only the count.
Detects multiple failed requests to access different applications within a short timeframe from the same network session. This could indicate an adversary attempting to bypass authentication mechanisms, potentially using stolen session cookies or brute-forcing access to various applications after an initial compromise. The rule also incorporates risk scoring based on behavioral anomalies (e.g., new geo-location, new device, new IP) and access attempts from high-risk countries.
Page 88 of 96