Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
Detects network connections to known XWorm Command and Control (C2) infrastructure (IPs and domains) and the creation of processes with filenames associated with XWorm malware. This rule combines network and process-based indicators to identify potential XWorm infections.
This KQL Query focuses on summarising the number of devices attempting to connect to exposed servers, categorised by vendor, by decoding their MAC addresses. This information can help you to identify unexpected devices vendors, detect virtual devices or correlate specific manufacturers with known threats.
Amcache.hve is a Windows registry file that logs details about executed programs, including file paths, hashes, timestamps, and metadata. It helps reconstruct what was run on a system—even if the original file is gone. On the other hand, Shimcache is a memory-resident registry artifact that records executables seen or run by the system. It stores file paths and last modified timestamps, making it useful for tracking historical program execution—even after deletion. Attackers aware of forensic techniques could try to delete or alter these files to remove the evidences of their attacks:
Deleting or wiping Amcache.hve Overwriting or tampering with the SYSTEM hive to destroy Shimcache Using tools like SDelete, cipher /w:, or direct registry access to tamper logs
Deleting or wiping Amcache.hve Overwriting or tampering with the SYSTEM hive to destroy Shimcache Using tools like SDelete, cipher /w:, or direct registry access to tamper logs
Detects the execution of command-line interpreters (cmd.exe, powershell.exe, wscript.exe, cscript.exe) from the Netlogon or Sysvol shares. This activity is highly suspicious as these shares are typically used for Group Policy and logon scripts, not for direct execution of interactive shells or scripting engines by users or processes. This could indicate an adversary attempting to execute malicious code or scripts from a central, often replicated, location within a Windows domain environment, potentially for lateral movement, persistence, or privilege escalation.
The ZoneMap key under Internet Settings is used to define security zones for specific domains. By setting a value under ZoneMap\Domains, you are configuring how Windows handles security and permissions for that domain so it is really helpful to identify if some site has been added via cli manually or by some malicious script to whitelist some domains and bypass some defense.
KQL Query
The following query is oriented to extend information about the potential threats associated with distinct HTTP status code. This allows me to quickly work with other KQL queries to identify potential threats. Consider this KQL query as a "Pivot Table" for multiple queries that can be triggered based on your criteria.
This rule detects various activities associated with the NotDoor malware, including the copying of malicious files to Outlook macro folders, C2 beaconing attempts using nslookup or curl to suspicious domains, registry modifications to disable Outlook macro security or enable macro loading on boot, and the creation of staging files in temporary directories for potential exfiltration. These behaviors are indicative of NotDoor installation, persistence, defense evasion, and data staging.
Mustang Panda conducted a phishing campaign against Myanmar entities using a compromised embassy email. The lure involved a PDF with an embedded URL that delivered a ZIP archive containing a trojanized executable and malicious DLL. The malware disguised itself as a PDF, sideloaded the DLL, established persistence, and executed further payloads. It performed system reconnaissance, data exfiltration via SFTP, and defense evasion.
This rule detects the connection of specific USB devices that are commonly associated with IP KVM (Keyboard, Video, Mouse) devices. It identifies these devices by checking the 'Manufacturer' field for 'PiKVM' or 'tinypilot', the 'vendorid' for a specific hexadecimal string ('6b65796d696d6670690'), or the 'SerialNumber' for 'CAFEBABE'. The rule monitors various USB device connection events such as 'USBDeviceConnected', 'UsbDriveMounted', 'UsbDriveUnmounted', 'UsbDeviceDisconnected', 'DeviceDisplayConnected', and 'PnpDeviceConnected' within 'DeviceEvents'. The presence of such devices can indicate remote access or potential compromise, as IP KVMs allow network-based control of a computer.
This detection looks at emails being sent from a users company email address to their personal email through comparing the sender and recipient email addresses to see if they contain similar strings. Users who are close to leaving the company and working their notice period etc should be monitored more closely and an increased number of emails being sent to a personal email can indicate data exfiltration.
This KQL query analyzes driver load events on Windows endpoints to detect malicious activity. It specifically looks for drivers (.sys files) being loaded from non-standard, user-writable directories.
The query checks for DriverLoad events and filters for files ending with .sys. It then narrows the results to drivers loaded from suspicious folders like \Users\, \AppData\, and \Temp\. The query uses a comprehensive exclusion list to filter out known legitimate drivers from these locations, such as those related to Windows Defender, specific gaming anti-cheat software, or hardware utilities like CPU-Z, which often operate from temporary directories. The final output is a list of suspicious driver load events that may indicate a malicious driver being executed on the system.
The query checks for DriverLoad events and filters for files ending with .sys. It then narrows the results to drivers loaded from suspicious folders like \Users\, \AppData\, and \Temp\. The query uses a comprehensive exclusion list to filter out known legitimate drivers from these locations, such as those related to Windows Defender, specific gaming anti-cheat software, or hardware utilities like CPU-Z, which often operate from temporary directories. The final output is a list of suspicious driver load events that may indicate a malicious driver being executed on the system.
This rule detects network connections to known dynamic DNS (DDNS) subdomains. Adversaries often use dynamic DNS services to maintain persistent command and control (C2) communication channels, as these services allow them to frequently change the IP address associated with a static hostname, making it harder for defenders to block or track their infrastructure. These providers also have established domain reputation, and provide legitimate services making blanket IOC rules impossible. The rule identifies connections to specific DDNS providers such as DuckDNS, No-IP, PublicVM, and others.
Detecting networks shared by phones with key words in their Names such as "FREE", "AIRPORT" "OPEN", can be potential cases of Evil Twin Attack where malicious actors can intercept network traffic, steal login credentials, capture sensitive data, or launch further attacks like Man-in-the-Middle (MitM) attacks.
This KQL Query helps to identify when a connection is shared by an IPhone device and for that we can use a default Gateway assigned when a connection is shared from these Apple phones which is "172.20.10.1".
This KQL Query helps to identify when a connection is shared by an IPhone device and for that we can use a default Gateway assigned when a connection is shared from these Apple phones which is "172.20.10.1".
Detects the creation of a symbolic link in the Windows Defender Platform directory. This is a technique used to hijack the execution flow of Windows Defender, forcing it to run from an attacker-controlled location upon service restart or update.
Detects the initial PowerShell download cradle associated with ClickFix/CORNFLAKE.V3 campaigns. This activity is often the result of a user being tricked into pasting and running a command from a malicious website.
This detection identifies the installation of known malicious Chrome extensions associated with the "Madgicx Plus" campaign, which targets Meta advertisers to steal credentials and hijack sessions. The rule looks for registry modifications that include the specific IDs of these malicious extensions.
This rule detects the creation of Scalable Vector Graphics (SVG) files on a system, particularly those initiated by common applications like Outlook, web browsers, or archive utilities. It then correlates this file creation with subsequent network activity from a browser process within a 5-minute window. The network activity is further scrutinized for suspicious URLs, specifically those using Cloudflare Workers domains with a specific pattern or URLs containing an '@' symbol, which can indicate obfuscation or malicious redirection attempts. This behavior is indicative of SVG smuggling techniques used to deliver malicious payloads or redirect users to phishing sites.
This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. Threat actors like Static Tundra have been observed configuring TFTP servers to make device configuration files accessible for exfiltration after gaining initial access. The detection specifically looks for commands that expose critical configuration files such as startup-config, running-config, and other sensitive system information through TFTP. This activity is particularly concerning as it may represent an attempt to steal credentials, network topology information, and other sensitive data stored in device configurations.
KQL Query
This rule detects potential C2 communication patterns associated with the NightshadeC2 botnet. It looks for outbound TCP connections from non-browser processes to specific ports used by the malware, or connections to Steam community pages which are used to host C2 addresses. It also identifies initial geo-IP lookups from non-browser processes.
Page 468 of 509