Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,676 detections
Filters
Last updated
All Time
Detection languages
10,192
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,284
2,977
2,237
1,833
1,458
Platforms
10,387
1,109
809
155
98
Products / Services
10,676
9,759
6,693
4,421
3,749
MITRE Techniques
3,817
3,132
1,799
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
This rule detects suspicious, obfuscated PowerShell commands by analyzing the command line for long string literals with low character diversity and high frequency of a single character. It extracts strings enclosed in single quotes, double quotes, or backticks, and then calculates the ratio of distinct characters to total length and the ratio of the most frequent character's count to total length. If these ratios fall below and above certain thresholds, respectively, the command is flagged as suspicious.
This rule detects suspicious process activity originating from Windows Server Update Services (WSUS) processes (wsusservice.exe or w3wp.exe with 'wsuspool' in its command line) that then execute known Living Off The Land Binaries (LOLBINs) associated with ingress tool transfer (T1105) or common Windows execution binaries such as cmd.exe, powershell.exe, or certutil.exe. This behavior could indicate the exploitation of a Remote Code Execution vulnerability in WSUS, such as CVE-2025-59287.
This detection identifies command-line activity consistent with attempts to stop, uninstall, or otherwise tamper with the CrowdStrike Falcon agent. It looks for specific commands and utilities (sc.exe, net.exe, powershell.exe, falconctl.exe, taskkill) used in conjunction with CrowdStrike-related keywords to detect attempts to disable, uninstall, or terminate the agent's processes or services.
NTDS theft
KQL
Microsoft has observed compromises related to Bazacall resulting in theft of the Active Directory database using ntdsutil.exe.
This rule detects the execution of command-line interpreters (cmd.exe or powershell.exe) by either the w3wp.exe process (IIS worker process) or the wsusservice.exe process (Windows Server Update Services). This behavior can indicate a compromise, potentially leveraging vulnerabilities in web applications or WSUS to achieve remote code execution.
To detect sensitive or confidential information sent by email from our users, I discovered that DefenderXDR is registering events when some user or services is reading files tagged or marked as sensitive. Basically, it has a "SensitiveFileRead" ActionType in the DeviceFileEvents table which indicates that a process on the monitored device has accessed a file classified as sensitive. This could include files with personally identifiable information (PII), intellectual property, or other data deemed sensitive based on the organization’s data protection policies or Microsoft’s predefined rules. This event type is essential for tracking access to sensitive data, helping to identify potential data leakage or unauthorized access attempts.
This query is oriented to identify and classify browser extensions by group and risk severity based on a well-known list of browser extension.
A critical remote code execution vulnerability, CVE-2025-59287, affects Windows Server Update Services (WSUS), enabling unauthenticated attackers to execute arbitrary code via unsafe deserialization in the AuthorizationCookie.
Actively exploited since October 2025, this flaw targets WSUS servers on ports 8530/8531, often leaving forensic artifacts like modified SoftwareDistribution.log files and suspicious process chains involving w3wp.exe or wsusservice.exe spawning cmd.exe, powershell.exe, or net.exe.
The provided KQL query for Microsoft Defender XDR correlates network, file, and process events to detect exploitation attempts.
Actively exploited since October 2025, this flaw targets WSUS servers on ports 8530/8531, often leaving forensic artifacts like modified SoftwareDistribution.log files and suspicious process chains involving w3wp.exe or wsusservice.exe spawning cmd.exe, powershell.exe, or net.exe.
The provided KQL query for Microsoft Defender XDR correlates network, file, and process events to detect exploitation attempts.
This rule detects the presence of percent-encoded Bi-Directional (BiDi) control characters in URLs within network events. Specifically, it looks for '%E2%80%AE' (Right-to-Left Override - RLO), '%E2%80%8E' (Left-to-Right Mark - LRM), and '%E2%80%8F' (Right-to-Left Mark - RLM). These characters can be used to obfuscate URLs, making malicious links appear benign to users and potentially bypass security controls.
Detects when the Windows Server Update Services (WSUS) process (wsusservice.exe) or its associated IIS worker process (w3wp.exe with 'wsuspool' in its command line) spawns cmd.exe or powershell.exe. This activity is highly suspicious as WSUS services typically do not need to execute command-line interpreters, and could indicate an attempt to exploit a vulnerability or execute arbitrary commands on the system.
This rule detects the creation of common Windows command-line interpreters and utilities (cmd.exe, powershell.exe, pwsh.exe, powershell_ise.exe, whoami.exe, net.exe, net1.exe) when initiated by 'w3wp.exe'. The 'w3wp.exe' process is the IIS worker process, and the execution of these utilities from an IIS worker process can be indicative of web shell activity, compromise of the web server, or other malicious activity.
Detection based on: https://malwaretech.com/2025/10/exif-smuggling.html
This rule detects suspicious PowerShell execution patterns that might indicate an 'Exif smuggling FileFix Technique' or similar obfuscated command execution. It specifically looks for 'conhost.exe' launching PowerShell ('powershell.exe', 'pwsh.exe', 'pwsh.dll') with an encoded command ('-e' or '-EncodedCommand'), containing more than 5 spaces, and including a UNC path. This combination of indicators suggests an attempt to execute obfuscated PowerShell code, potentially from a remote source.
This rule detects suspicious PowerShell execution patterns that might indicate an 'Exif smuggling FileFix Technique' or similar obfuscated command execution. It specifically looks for 'conhost.exe' launching PowerShell ('powershell.exe', 'pwsh.exe', 'pwsh.dll') with an encoded command ('-e' or '-EncodedCommand'), containing more than 5 spaces, and including a UNC path. This combination of indicators suggests an attempt to execute obfuscated PowerShell code, potentially from a remote source.
This detection monitors the CommonSecurityLog (which adheres to the Common Event Format - CEF) for indications of malicious network activity. Specifically, it flags outgoing HTTP requests originating from system utilities such as curl, wget, and PowerShell. These requests are often leveraged by attackers for data theft (exfiltration) or establishing command-and-control channels.
Review the full user agent string and destination hostname. Investigate the source IP and user context. Check whether the tool usage aligns with expected behavior for the host or user. Correlate with other indicators such as unusual process execution, file access, or authentication anomalies. Escalate if the destination is unknown or suspicious. Remove the KQL summarise line to view more details.
UA_Check and SafeHosts will require tuning for your specific environment setup and traffic.
Review the full user agent string and destination hostname. Investigate the source IP and user context. Check whether the tool usage aligns with expected behavior for the host or user. Correlate with other indicators such as unusual process execution, file access, or authentication anomalies. Escalate if the destination is unknown or suspicious. Remove the KQL summarise line to view more details.
UA_Check and SafeHosts will require tuning for your specific environment setup and traffic.
This rule detects when a high number of downloads have been performed by a user from SharePoint. This could indicate an insider threat collecting data before sending it outside of the company.
This rule detects modifications to the HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CLSID}\InProcServer32 registry key where the RegistryValueData ends with ".dll" and does not point to common system directories (%systemroot%, C:\Program Files (x86)\, C:\Program Files\). This behavior is indicative of CLSID hijacking, a technique used by adversaries to achieve persistence or privilege escalation by redirecting legitimate COM object calls to a malicious DLL.
This rule detects a sequence of events indicative of a potential macOS ClickFix attack. It looks for a base64 encoded command executed by 'bash' or 'zsh', immediately followed (within 10 seconds) by a 'curl' command that initiates a network connection to a URL. The rule specifically excludes a whitelisted curl command to reduce false positives. The correlation of base64 execution, a subsequent curl command, and a successful network connection to the domain extracted from the curl command suggests an attempt to download and execute malicious content, possibly after decoding it.
KQL Query
Monitoring the execution of auditpol.exe can be crutial to detect first-stage of a real attack because they will be shown as previous steps to obfuscate the next execution such a ransomware.
KQL Query
This rule detects the installation of AppX or MSIX packages, specifically looking for installations initiated by PowerShell that are either developer-signed (EventID 855) or unsigned (EventID 603 with specific flags). It filters out known legitimate Microsoft packages to reduce false positives. The rule correlates PowerShell process events with device events related to AppX/MSIX installations within a 30-seconds window.
This rule detects the creation of executable files (.exe, .dll, .pyd) within browser extension folders (Chrome, Edge, Firefox) followed by a related registry modification within a one-hour window. This behavior is indicative of malicious browser extension installation or modification, often used for persistence or data exfiltration.
Page 463 of 509