Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
Detects PowerShell commands that attempt to modify Windows Defender preferences to add exclusions for paths, extensions, or processes. This activity is often indicative of an adversary attempting to disable or bypass security controls. Also seen by XWorm Malware.
The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem data model to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in uncommon directories (e.g., \windows\fonts\, \users\public\). This activity is significant as adversaries often use these paths to evade detection and maintain persistence. If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.
KQL Query
Detects the use of the rclone tool with data transfer commands (copy, move, sync, copyto, moveto) originating from a GoAnywhere server process or common interactive shell processes (cmd.exe, powershell.exe). This activity is highly suspicious and could indicate data exfiltration.
This KQL query detects the activation or modification of Guest accounts or Guest group memberships, which may indicate unauthorized access attempts or privilege escalation.
Analysts should review the initiating user (SubjectUserName) and process context. Confirm whether the Guest account is expected to be active on the system. Investigate the host for signs of lateral movement or privilege abuse. Correlate with logon events and group membership changes. Escalate if Guest account activation is unexpected or unauthorized.
Analysts should review the initiating user (SubjectUserName) and process context. Confirm whether the Guest account is expected to be active on the system. Investigate the host for signs of lateral movement or privilege abuse. Correlate with logon events and group membership changes. Escalate if Guest account activation is unexpected or unauthorized.
Detects the execution of NeutralinoJS framework components ('neutralino.exe', 'node.exe') from non-standard directories. This behavior is associated with the EvilAI campaign, where threat actors leverage the NeutralinoJS framework to execute arbitrary JavaScript code for covert data access and process spawning. The detection specifically looks for the '--load-dir-res' argument, which is a strong indicator of a NeutralinoJS application launch, and filters out executions from standard application installation directories to focus on anomalous locations, which can indicate malware masquerading as a portable app or running from a temporary/user location.
This rule detects various activities associated with the InterLock Ransomware (UNC5774). It identifies anti-VM checks performed via PowerShell, specifically looking for commands that query for QEMU, memory less than 4GB or 1.5GB, or specific desktop naming conventions. It also detects local group and Service Principal Name (SPN) enumeration using PowerShell cmdlets like 'Get-LocalGroupMember', 'Get-LocalGroup', or ADSI queries for 'samAccountName' and 'servicePrincipalName'. Persistence mechanisms are covered by monitoring registry Run/RunOnce keys for entries that launch 'node' or 'php' executables. Furthermore, the rule looks for suspicious staging of 'node.exe' or 'php.exe' within the AppData\Roaming directory when initiated by PowerShell processes. The rule leverages 'DeviceProcessEvents', 'DeviceRegistryEvents', and 'DeviceEvents' (specifically PowerShellCommand action type) to capture these activities.
A DefenderXDR Custom Detection for CVE-2025-56383
This specialized KQL query is designed to hunt for a particularly dangerous class of malicious activity: the deliberate disabling of Endpoint Detection and Response (EDR) security controls. It specifically targets the use of tools like EDR Silencer, which attackers deploy to "blind" security tools and operate stealthily on a compromised host. The logic focuses on high-confidence indicators, searching for the tool's executable itself or its distinctive command-line flags (blockedr, unblockall, etc.) when launched by common system interpreters like PowerShell or CMD. By filtering out noisy, legitimate activity related to document processing, this query provides security analysts with a prioritized list of potential EDR tampering incidents, enabling rapid investigation and response to this critical threat.
When two accounts from the same Entra tenant are signed into the same browser app, the device authentication (the PRT) belonging to the primary account is implicitly applied to the second account. That means the second account can inherit device-based Conditional Access, effectively bypassing intended device checks and weakening protection for privileged accounts.
Based on this behavior, I created a KQL query that detects any account assigned a privileged role signing in with private/incognito browser sessions on a device where potentially another account is already signed in โ a pattern that helps to detect the mentioned PRT/device-trust bypass. Even lower-privileged accounts are concerning when they browse in private mode so I am not filtering by just admin ones. However, to target specific roles, add:
| ๐ธ๐ฉ๐ฆ๐ณ๐ฆ ๐ต๐ฐ๐ด๐ต๐ณ๐ช๐ฏ๐จ(๐๐ด๐ด๐ช๐จ๐ฏ๐ฆ๐ฅ๐๐ฐ๐ญ๐ฆ๐ด) ๐ค๐ฐ๐ฏ๐ต๐ข๐ช๐ฏ๐ด "๐ข๐ฅ๐ฎ๐ช๐ฏ"
Based on this behavior, I created a KQL query that detects any account assigned a privileged role signing in with private/incognito browser sessions on a device where potentially another account is already signed in โ a pattern that helps to detect the mentioned PRT/device-trust bypass. Even lower-privileged accounts are concerning when they browse in private mode so I am not filtering by just admin ones. However, to target specific roles, add:
| ๐ธ๐ฉ๐ฆ๐ณ๐ฆ ๐ต๐ฐ๐ด๐ต๐ณ๐ช๐ฏ๐จ(๐๐ด๐ด๐ช๐จ๐ฏ๐ฆ๐ฅ๐๐ฐ๐ญ๐ฆ๐ด) ๐ค๐ฐ๐ฏ๐ต๐ข๐ช๐ฏ๐ด "๐ข๐ฅ๐ฎ๐ช๐ฏ"
Detects probable exploitation of the reported Notepad++ plugin DLL hijack by correlating DLL loads from Notepad++\plugins with recent file changes or swap-style renames, prioritising user-writable locations (Users/AppData/OneDrive) and weak trust. Outputs a Verdict and SuspicionScore for quick triage.
Detects PowerShell execution patterns consistent with the 'FileFix' social engineering technique. This technique tricks users into pasting and running a malicious command, often from the Run dialog or File Explorer address bar, which results in explorer.exe being the parent process. The command typically involves downloading and executing a remote script.
This rule identifies Cisco network devices within Microsoft Defender for Endpoint (MDE) telemetry that are running Cisco IOS or Cisco XE operating systems, excluding version '17.15.4a'. The exclusion of a specific OS version suggests the rule is designed to pinpoint devices that may be vulnerable to a known security flaw, potentially CVE-2025-20352 as indicated by the rule's title. It helps in mapping exposure to specific vulnerabilities by identifying potentially unpatched or vulnerable network infrastructure components.
This rule detects instances of 'WerFaultSecure.exe' being spawned by an unusual or unexpected parent process. 'WerFaultSecure.exe' is a legitimate Windows component responsible for error reporting and crash dumping. Adversaries may abuse this process, particularly for memory dumping (e.g., LSASS dumping) to evade defenses and escalate privileges. The rule identifies parent processes that are not part of a predefined list of legitimate parents (wermgr.exe, svchost.exe, csrss.exe, WerFault.exe). It assigns a suspicion score and risk level based on the initiating process's filename (e.g., PowerShell, CMD, Explorer) and folder path (e.g., Temp, AppData, Users). It also extracts the target Process ID (PID) and dump type from the command line, and checks for suspicious parameters, to provide a comprehensive risk assessment.
NOTE: Big kudos to "Steven Lim @KQLWizard" as he developed the detection and i just adapted the extract regex. at my tests -p was not enough as the parameter was /pid is used.
Changed timestamps into one variable as i do not see the need for a bigger lookback (e.g. 30d) if i just check for the process ids of a day.
Tested with https://github.com/TwoSevenOneT/EDR-Freeze, tests was not successfull as Files could not be suspended. Reason not verified.
-- original description from @KQLWizard --
DR-Freeze abuses WerFaultSecure.exe to suspend AV/EDR via MiniDumpWriteDump โ no BYOVD needed.
Changed timestamps into one variable as i do not see the need for a bigger lookback (e.g. 30d) if i just check for the process ids of a day.
Tested with https://github.com/TwoSevenOneT/EDR-Freeze, tests was not successfull as Files could not be suspended. Reason not verified.
-- original description from @KQLWizard --
DR-Freeze abuses WerFaultSecure.exe to suspend AV/EDR via MiniDumpWriteDump โ no BYOVD needed.
This query groups all files by their originating fileโsuch as a ZIP archive or from a Websiteโand includes all the files that were extracted from it. Among the benefits of Correlating File Events Using InitiatingProcessUniqueId field we can identify:
- Provides full visibility into all files related to a single action (e.g., ZIP extraction).
- Helps detect hidden or secondary malicious files that may not trigger alerts.
- Traces the origin of filesโwhether downloaded or extracted from another source.
- Strengthens root cause analysis and incident investigation.
- Enhances detection of multi-stage payloads or complex delivery methods.
- Builds context around suspicious activity for better decision-making.
On the other hand, we can enhance this detection by adding additional checks โ for example, identifying when one of the extracted or downloaded files has a high-risk file extension.
| where FileExtension in ("exe","cmd","bat","ps1","js","vbs")
- Provides full visibility into all files related to a single action (e.g., ZIP extraction).
- Helps detect hidden or secondary malicious files that may not trigger alerts.
- Traces the origin of filesโwhether downloaded or extracted from another source.
- Strengthens root cause analysis and incident investigation.
- Enhances detection of multi-stage payloads or complex delivery methods.
- Builds context around suspicious activity for better decision-making.
On the other hand, we can enhance this detection by adding additional checks โ for example, identifying when one of the extracted or downloaded files has a high-risk file extension.
| where FileExtension in ("exe","cmd","bat","ps1","js","vbs")
Detects potential abuse of LOLBAS techniques (e.g., WerFaultSecure.exe, rundll32.exe, comsvcs.dll) associated with EDR-Freeze attacks. These attacks suspend EDR or AV processes by exploiting Windows Error Reporting to create a race condition, leaving the system unmonitored.
The rule triggers when a known LOLBAS executable is run and the device stops reporting telemetry, with no legitimate shutdown or logoff activity recorded, suggesting the endpoint security agent may have been suspended.
The rule triggers when a known LOLBAS executable is run and the device stops reporting telemetry, with no legitimate shutdown or logoff activity recorded, suggesting the endpoint security agent may have been suspended.
This rule detects instances where 'WerFaultSecure.exe' is launched by an unusual parent process. 'WerFaultSecure.exe' is a legitimate Windows error reporting tool, but its execution by non-standard parent processes can indicate malicious activity, such as process injection, credential dumping, or defense evasion. The rule assigns a suspicion score based on the parent process and command-line parameters, filtering for medium to critical risk levels. It also extracts the target PID and identifies suspicious parameters or dump types.
Detects attempts to suspend or terminate Endpoint Detection and Response (EDR) agent processes by targeting their Process IDs (PIDs). The rule identifies suspicious command-line arguments and tools (e.g., procdump, WerFault) used to interact with processes, specifically looking for these actions against a predefined list of common EDR agent executable names. It correlates process creation events with process ID resolution to identify the targeted EDR agent.
This rule detects phishing attempts by identifying emails containing URLs and endpoint network connections to domains known to be associated with phishing campaigns. It leverages an external Indicator of Compromise (IOC) list of phishing domains. The rule scans email events for inbound messages with URLs matching these domains and also monitors endpoint network events for successful connections or HTTP inspections to these malicious domains. The results from both email and endpoint sources are then combined to provide a correlated view of potential phishing activity.
This hunting query detects adversaries attempting to impair or disable power-related functions in Windows environments. It covers explicit powercfg.exe commands, registry tampering of HibernateEnabled, deletion/modification of the hiberfil.sys file, and suspicious PowerShell usage. Such activity is often leveraged by attackers to maintain persistence or disrupt forensic evidence.
Page 466 of 509