Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
696 detections
Filters
Last updated
All Time
Detection languages
332
134
106
55
25
Contributors
115
100
66
62
55
Categories
136
129
107
104
84
Platforms
324
178
85
83
80
Products / Services
134
112
104
52
47
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
2
2
2
2
1
IDS Classtypes
48
29
11
7
6
IDS Protocols
66
20
11
6
3
This rule detects the creation of Scalable Vector Graphics (SVG) files on a system, particularly those initiated by common applications like Outlook, web browsers, or archive utilities. It then correlates this file creation with subsequent network activity from a browser process within a 5-minute window. The network activity is further scrutinized for suspicious URLs, specifically those using Cloudflare Workers domains with a specific pattern or URLs containing an '@' symbol, which can indicate obfuscation or malicious redirection attempts. This behavior is indicative of SVG smuggling techniques used to deliver malicious payloads or redirect users to phishing sites.
This analytic detects suspicious Python package installations where the package name resembles popular Python libraries but may be typosquatted or slightly altered. Typosquatting is a common technique used by attackers to trick users into installing malicious packages that mimic legitimate ones. This detection leverages Cisco NVM flow telemetry and checks for pip or poetry package managers with the "install" or "add" flags, making outbound connections to package repository such as `pypi.org` with known or suspected typo package names.
Detects potential psexec command that initiate execution on a remote systems via common commandline flags used by the utility
Detects the creation of files in a deceptive directory 'C:\Windows \System32\' (with a space after 'Windows'). This technique is used by a Zephyr/XMRig cryptomining campaign to stage files for DLL search order hijacking of 'printui.exe'.
This rule detects suspicious bulk file downloads from SharePoint by correlating successful sign-in events with subsequent file download activities. It specifically looks for sign-ins that are not from registered devices, followed by multiple file downloads (at least 3) within a short time window (up to 10 minutes) from the same IP address. The rule flags scenarios where a user downloads a significant number of unique files (at least 2) or has a high download count (5 or more), or a combination of moderate downloads (3 or more) within a very short duration (1 minute). This pattern can indicate data exfiltration attempts.
This rule detects the execution of commands that include the ' -accepteula' flag. This flag is commonly used by Sysinternals tools to automatically accept their End User License Agreement (EULA), allowing for non-interactive execution. The presence of this flag in a command line can indicate the use of Sysinternals utilities, which are legitimate administrative tools but are also frequently leveraged by adversaries for various post-exploitation activities.
This rule identifies devices that are missing recommended security updates based on data from Microsoft Defender for Endpoint's TVM (Threat and Vulnerability Management) capabilities. It joins vulnerability information with knowledge base articles to pinpoint specific missing updates.
Detects command lines that contain the 'accepteula' flag which could be a sign of execution of one of the Sysinternals tools
Detects suspicious commandline flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights
Detects unknown program using commandline flags usually used by tools such as PsExec and PAExec to start programs with SYSTEM Privileges
This rule detects suspicious ad click traffic that routes through Google Ad Services It specifically looks for URLs containing Google Click Identifier (gclid), an ad URL, and a placement ID, while excluding legitimate ad routing services. This could indicate ad fraud or malvertising.
Most but not all clicks on Google ads are routed this way.
Most but not all clicks on Google ads are routed this way.
š Description
Threat actors frequently register lookalike domains to support malicious activities such as phishing attacks, drive-by compromises, and command-and-control (C2) operations. This KQL hunting query is designed to help identify potential phishing and typosquatting domains that may be targeting your organization or its third-party vendors.
š Threat Intelligence Feed
The hunting query utilizes data from the SANS Internet Storm Center (ISC) API, which provides access to newly registered domains.
API Endpoint:
https://isc.sans.edu/api/recentdomains/today?json
Use Cases:
Threat intelligence enrichment
Detection of suspicious or malicious domains
Security log correlation
Returned Data Fields:
Domain name
Registration date
IP address
Type
Additional metadata (if available)
Query by Date (Optional):
Example: https://isc.sans.edu/api/recentdomains/2025-07-08?json
šÆ ATT&CK Framework Mapping
Technique: Acquire Infrastructure: Domains
ID: T1583.001
Reference: MITRE ATT&CK
Threat actors frequently register lookalike domains to support malicious activities such as phishing attacks, drive-by compromises, and command-and-control (C2) operations. This KQL hunting query is designed to help identify potential phishing and typosquatting domains that may be targeting your organization or its third-party vendors.
š Threat Intelligence Feed
The hunting query utilizes data from the SANS Internet Storm Center (ISC) API, which provides access to newly registered domains.
API Endpoint:
https://isc.sans.edu/api/recentdomains/today?json
Use Cases:
Threat intelligence enrichment
Detection of suspicious or malicious domains
Security log correlation
Returned Data Fields:
Domain name
Registration date
IP address
Type
Additional metadata (if available)
Query by Date (Optional):
Example: https://isc.sans.edu/api/recentdomains/2025-07-08?json
šÆ ATT&CK Framework Mapping
Technique: Acquire Infrastructure: Domains
ID: T1583.001
Reference: MITRE ATT&CK
This detection identifies known malicious file hashes associated with SharePoint exploitation campaigns. These hashes correspond to web shells and post-exploitation tools observed in attacks by threat actors like Storm-2603.
Detects active network communication associated with known malware that is being allowed by the Palo Alto Networks firewall. This may indicate an ongoing security threat, where malicious traffic is bypassing firewall protections, potentially leading to system compromise, data exfiltration, or further infiltration within the network.
This detection identifies network traffic to domains known to be used as command and control (C2) infrastructure in recent SharePoint exploitation campaigns. Communication with these domains is a strong indicator of compromise.
The analytic identifies instances where a Duo administrator creates or updates a policy to allow the use of outdated Flash components, specifically by detecting policy changes with the `flash_remediation=no remediation` attribute. This behavior is significant because permitting old Flash increases the attack surface due to known vulnerabilities. Attackers may exploit such policy changes to bypass security controls, introduce malware, or escalate privileges. Detecting these modifications helps prevent potential exploitation and reduces organizational risk. Immediate investigation is recommended to determine if the change was authorized or indicative of malicious activity.
This rule detects the presence of specific file hashes (MD5, SHA1, SHA256) across device file events, device process events, and email attachment information. It is designed to identify known malicious files or indicators of compromise (IOCs) within an environment.
This query helps calculate overall efficacy of MDO based on threats blocked pre-delivery, post-delivery cleanups, or were uncaught.
KQL Query
Generic rule content from file: Initial Access - Probable Rogue ScreenConnect Session
KQL Query from file: Azure Cloud Security Monitoring
Page 19 of 34