Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
Purpose: Hunts for risky OAuth applications in Microsoft 365 with overly permissive Microsoft Graph permissions.
Key Actions:
Finds enabled OAuth apps and retrieves their latest state (arg_max).
Expands permissions and flags sensitive ones (e.g., Mail.Send, Files.ReadWrite.All, User.ReadWrite.All, Sites.ReadWrite.All).
Notes publisher verification, origin, and last modification date.
Marks risky apps via HasRiskyPermissions flag.
Use Cases: Detects malicious consent grant phishing, overprivileged third-party apps, and integrations that could enable data theft or long-term access.
Key Actions:
Finds enabled OAuth apps and retrieves their latest state (arg_max).
Expands permissions and flags sensitive ones (e.g., Mail.Send, Files.ReadWrite.All, User.ReadWrite.All, Sites.ReadWrite.All).
Notes publisher verification, origin, and last modification date.
Marks risky apps via HasRiskyPermissions flag.
Use Cases: Detects malicious consent grant phishing, overprivileged third-party apps, and integrations that could enable data theft or long-term access.
This rule detects Waiting Thread Hijacking (WTH) by identifying sequences of API calls indicative of process injection. It includes three main detection logics: a basic sequence of OpenThread, Allocate, and Write operations; a more specific API sequence that checks for THREAD_GET_CONTEXT access and two separate write operations; and a split execution variant where multiple processes target a single victim process with memory allocation, write, and protect operations. The rule aims to catch malicious code injection into remote processes.
This query identifies browser extensions with a low global prevalence, which could indicate a malicious or unwanted extension. It specifically looks for .crx files created in "Webstore Downloads" folders and enriches the data with file prevalence information.
This rule detects potential DLL sideloading attempts by monitoring the loading of specific DLLs (version.dll and rtworkq.dll) from non-standard Windows system directories. It specifically looks for these DLLs being loaded by 'icardagt.exe' or 'mfpmp.exe' processes outside of 'C:\Windows\System32\' or 'C:\Windows\SysWOW64\'. This behavior is indicative of an adversary attempting to execute malicious code by tricking legitimate applications into loading their malicious DLLs instead of the legitimate ones.
Detects .lnk (shortcut) files launched by scripting engines (e.g., PowerShell, CMD, WScript) exhibiting suspicious traits like hidden execution, embedded commands, or admin privilege requests. Common in phishing, LOLBin abuse, and initial access.
Detects DNS queries to domains that are suspiciously similar to trusted ones, which may indicate typosquatting, phishing, or user deception tactics. The detection compares unknown domains to a known safe allowlist using a fuzzy character-difference heuristic.
This KQL query hunts for suspicious activities in Microsoft Defender for Endpoint that may indicate attempts to disable or manipulate Windows Event Logging, such as clearing logs, stopping the Event Log service, or modifying audit policies. It targets processes and commands associated with MITRE ATT&CK technique T1562.002 to identify potential defense evasion tactics.
The following analytic detects the creation or connection of anonymous pipes for inter-process communication (IPC) within a Windows environment. Anonymous pipes are commonly used by legitimate system processes, services, and applications to transfer data between related processes. However, adversaries frequently abuse anonymous pipes to facilitate stealthy process injection, command-and-control (C2) communication, credential theft, or privilege escalation. This detection monitors for unusual anonymous pipe activity, particularly involving non-system processes, unsigned executables, or unexpected parent-child process relationships. While legitimate use cases exist—such as Windows services, software installers, or security tools—unusual or high-frequency anonymous pipe activity should be investigated for potential malware, persistence mechanisms, or lateral movement techniques.
Identifies Ingress Tool Transfer's.
Vidar is a sophisticated infostealer operating as Malware-as-a-Service (MaaS). Written in C++, it’s designed to harvest a wide range of sensitive data from infected systems and exfiltrate it to attacker controlled infrastructure.
🧬 Script Inception: PowerShell scripts nested within PowerShell scripts, layered with 2–3 rounds of Base64 encoding.
📦 RAR Payloads: Password protected RAR files downloaded via direct-to-IP HTTP requests over TCP port 80. Passwords are embedded in encoded scripts and passed via command line to a downloaded copy of "unrar.exe".
🧬 Script Inception: PowerShell scripts nested within PowerShell scripts, layered with 2–3 rounds of Base64 encoding.
📦 RAR Payloads: Password protected RAR files downloaded via direct-to-IP HTTP requests over TCP port 80. Passwords are embedded in encoded scripts and passed via command line to a downloaded copy of "unrar.exe".
This detection identifies instances where PowerShell is executed using a legacy engine version (e.g., v2.0), which lacks support for AMSI and script block logging. Attackers often downgrade PowerShell to avoid modern security controls and to evade detection during payload execution.
PowerShell version information is captured from the DeviceEvents table with ActionType `PowerShellEngineVersion`. Any engine version starting with "2." or "1." is treated as suspicious in this detection.
PowerShell version information is captured from the DeviceEvents table with ActionType `PowerShellEngineVersion`. Any engine version starting with "2." or "1." is treated as suspicious in this detection.
This rule detects processes that are taking an unusually high number of screenshots within a defined timeframe. It identifies screenshot activity by looking for specific action types like "ScreenshotTaken", file creations with common image extensions (.png, .jpg, .jpeg, .bmp, .gif, .tiff), and process command lines containing common Windows API calls related to screen capturing (e.g., BitBlt, GetDC, PrintWindow, CopyFromScreen). The rule aggregates these events per device and triggers an alert if the total number of screenshots exceeds a configurable threshold.
Vidar is a sophisticated infostealer operating as Malware-as-a-Service (MaaS). Written in C++, it’s designed to harvest a wide range of sensitive data from infected systems and exfiltrate it to attacker controlled infrastructure.
🧬 Script Inception: PowerShell scripts nested within PowerShell scripts, layered with 2–3 rounds of Base64 encoding.
📦 RAR Payloads: Password protected RAR files downloaded via direct-to-IP HTTP requests over TCP port 80. Passwords are embedded in encoded scripts and passed via command line to a downloaded copy of "unrar.exe".
🧬 Script Inception: PowerShell scripts nested within PowerShell scripts, layered with 2–3 rounds of Base64 encoding.
📦 RAR Payloads: Password protected RAR files downloaded via direct-to-IP HTTP requests over TCP port 80. Passwords are embedded in encoded scripts and passed via command line to a downloaded copy of "unrar.exe".
This detection identifies instances where a Windows service is installed with a file path that contains spaces but is not enclosed in quotation marks. Such misconfigurations can be exploited by attackers for privilege escalation using unquoted service path vulnerabilities. This detection helps administrators identify and remediate potentially insecure service installations.
Vidar is a sophisticated infostealer operating as Malware-as-a-Service (MaaS). Written in C++, it’s designed to harvest a wide range of sensitive data from infected systems and exfiltrate it to attacker controlled infrastructure.
🧬 Script Inception: PowerShell scripts nested within PowerShell scripts, layered with 2–3 rounds of Base64 encoding.
📦 RAR Payloads: Password protected RAR files downloaded via direct-to-IP HTTP requests over TCP port 80. Passwords are embedded in encoded scripts and passed via command line to a downloaded copy of "unrar.exe".
🧬 Script Inception: PowerShell scripts nested within PowerShell scripts, layered with 2–3 rounds of Base64 encoding.
📦 RAR Payloads: Password protected RAR files downloaded via direct-to-IP HTTP requests over TCP port 80. Passwords are embedded in encoded scripts and passed via command line to a downloaded copy of "unrar.exe".
Detects the use of encoded PowerShell commands often associated with obfuscated or malicious script execution. The rule targets executions of 'powershell.exe' containing suspicious keywords like 'IEX', 'Invoke-WebRequest', or 'FromBase64String', and attempts to decode any Base64-encoded payloads. Common in malware delivery and post-exploitation activity.
This rule detects when an email with a detected threat (e.g., malware, phishing) has an attachment that is subsequently observed on an endpoint device. This indicates that a malicious attachment from an email was downloaded and executed or saved on a device.
This rule detects files associated with Qilin (aka Agenda) ransomware based on known malicious file hashes. It monitors for file creation or process execution events where the SHA1, SHA256, or MD5 hash matches a predefined list of Qilin ransomware hashes.
Vidar is a sophisticated infostealer operating as Malware-as-a-Service (MaaS). Written in C++, it’s designed to harvest a wide range of sensitive data from infected systems and exfiltrate it to attacker controlled infrastructure.
🧬 Script Inception: PowerShell scripts nested within PowerShell scripts, layered with 2–3 rounds of Base64 encoding.
📦 RAR Payloads: Password protected RAR files downloaded via direct-to-IP HTTP requests over TCP port 80. Passwords are embedded in encoded scripts and passed via command line to a downloaded copy of "unrar.exe".
🧬 Script Inception: PowerShell scripts nested within PowerShell scripts, layered with 2–3 rounds of Base64 encoding.
📦 RAR Payloads: Password protected RAR files downloaded via direct-to-IP HTTP requests over TCP port 80. Passwords are embedded in encoded scripts and passed via command line to a downloaded copy of "unrar.exe".
This rule detects suspicious process and file activity that may be indicative of a crypto-miner or other malware. Specifically, it looks for the execution of VBScript files with a specific naming convention ('x#######.vbs') via wscript, or batch files with a similar naming convention initiated by wscript. Additionally, it unions these process events with file events where 'printui.exe' or 'printui.dll' are found in 'C:\Windows \System32\'. The rule then summarizes these events by device and flags if both process and file events are observed on the same device within the specified timeframes, suggesting a multi-stage activity.
This rule detects the creation of JavaScript files in the `AppData\Local\Temp` directory with a specific naming convention that resembles a GUID followed by a short alphanumeric e.g. or string and the '.js' eb2262cf-d737-4d55-9b98-84324ade4763ro.js.
This pattern is often used by malicious scripts or droppers that generate temporary files with randomised names to evade detection.
This pattern is often used by malicious scripts or droppers that generate temporary files with randomised names to evade detection.
Page 472 of 509