Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,225 detections
Filters
Last updated
All Time
Detection languages
1,118
30
19
17
15
Contributors
391
236
131
85
62
Categories
313
252
228
185
166
Platforms
651
438
268
228
200
Products / Services
10,670
9,758
6,693
4,421
3,749
1,225
MITRE Techniques
264
259
234
217
208
CVEs
8
8
6
6
6
IDS Classtypes
2
2
1
1
1
IDS Protocols
2
1
Hunts telemetry for published NeedyMantis indicators: three known SHA-256 hashes (WinSparkle.dll first-stage loader and its encrypted archive, plus the older libcurl archive), the C2 domain corp.tripswithengine[.]com, and the C2 URL path /library/zip/ on that domain. Domain/URL matching parses the actual host out of RemoteUrl and requires an EXACT match (not substring 'has/contains'), so a different domain that merely contains 'corp.tripswithengine.com' as a suffix of a longer label (e.g. 'notcorp.tripswithengine.com') or as a prefix of an unrelated domain (e.g. 'corp.tripswithengine.com.evil.net') cannot match. No malicious IP address has been published for this campaign, so IP-based matching is intentionally not included.
This rule detects activity involving known malicious indicators of compromise (IOCs), including specific IP addresses, domains, and file hashes. It monitors network connections, file system activity, process execution, and email attachments, filtering out common security tools to reduce noise.
Detects a multi-stage exfiltration sequence consisting of: (1) bulk file archival/compression using common utilities, (2) suspicious OAuth grant or service principal authorization, and (3) abnormal network egress volume to common ports. This pattern suggests an adversary is preparing data, establishing or leveraging an identity/application for cloud access, and subsequently exfiltrating data.
This rule performs a point-in-time sweep for known Indicators of Compromise (IOCs) associated with the NeedyMantis threat actor group. The detection logic searches for specific file, process, and image-load SHA256 hashes, communication with a known C2 domain (tripswithengine.com), and the use of a hard-coded user-agent string (Firefox/21.0) across various telemetry sources within the last 30 days.
This rule detects potential post-compromise activity related to a campaign using MSP360-masqueraded installers and ScreenConnect remote access tools. It performs an IOC sweep across device file events for known malicious file hashes (associated with installers and post-compromise utilities) and device network events for connections to known malicious domains used for command and control.
This rule detects potential lateral movement by identifying processes spawned via WMI (e.g., wmic.exe, WmiPrvSE.exe) or PowerShell Remoting (WinRM, Invoke-Command, Enter-PSSession) that occur shortly after a successful network or remote interactive logon on the same host.
This rule monitors for indicators of compromise (IOCs) associated with the TrustSink rogue MFA provider, specifically tracking the domain 'trident-sip-filter.ngrok-free.dev' and its associated OIDC discovery path. It aggregates signals from sign-in logs, audit logs, DNS queries, and network proxy traffic to identify attempts to interact with this malicious infrastructure.
Detects anomalous bursts of deletion activity targeting Azure Site Recovery and Backup resources, including management locks and backup policies. This behavior is consistent with an adversary attempting to inhibit system recovery capabilities, often a precursor to destructive activities such as ransomware deployment. The rule also correlates this activity with the deletion of other critical infrastructure components like databases or storage accounts.
This rule detects the presence of command line artifacts, filenames, and strings associated with the SilverFox malware. These strings indicate the execution of a malicious desktop monitoring component ('active_desktop_launcher.exe') or the use of specific IPC/configuration markers ('@@RAPID_CFG_START@@') characteristic of this threat's tradecraft.
Detects alerts that reference specific CVEs historically exploited by the threat group QTFY against internet-facing applications, including common vulnerabilities in Pulse Secure, FortiOS, Citrix ADC, Exchange, F5 BIG-IP, Log4Shell, and others, when the alert severity is Medium or High and contains indicators of exploit or initial access.
Hunts network, HTTP, and email-URL telemetry for known ARToken infrastructure (operator backend IPs and phishing/panel domains). Bounded to a 30-day lookback and tiers matches by confidence: domain hits are high-confidence (attacker-registered infrastructure), while IP hits are medium-confidence since the IPs sit on shared DigitalOcean hosting that can be reassigned to unrelated tenants once ARToken's infrastructure is taken down. Empty/unparsed indicator fields are excluded to avoid spurious matches in the HTTP event parsing branch. No known file hashes are associated with this intel.
This rule detects network communication attempts to a specific set of domains associated with the AgtaBackup Remote Access Trojan (RAT). It monitors DeviceNetworkEvents for outbound connections directed toward known command-and-control (C2) infrastructure used by this threat actor.
Detects msiexec.exe initiating network connections to or executing packages from endpoints containing 'capher.php' and token parameters. This behavior is associated with the 'ClickFix' delivery chain, where adversaries use malicious websites or scripts to trick users into downloading and executing installer files.
Detects suspicious HTTP requests directed at SharePoint applications containing a malformed Register directive. The rule identifies attempts to leverage the 'publishingribbon' Tagprefix combined with unauthorized namespaces (e.g., System.Xaml, System.Windows.Data) to bypass the EditingPageParser.InitializeRegisterTable safelist check, a common technique for SharePoint remote code execution.
This rule detects when a user registers or adds a new device in Entra ID within a short timeframe (two hours) of experiencing a risky sign-in or a password reset. It specifically flags registrations involving potentially unmanaged, non-compliant, or unusually trusted devices, which may indicate an attempt to establish persistent access or bypass Conditional Access policies.
Detects instances where an administrator or user grants an application consent with highly sensitive permissions in Azure AD (Microsoft Entra ID). This activity is often associated with OAuth application phishing, where an adversary lures a user into granting excessive permissions to a malicious application, potentially leading to long-term persistence or unauthorized access to directory data and conditional access policies.
Detects high-risk administrative actions within a Kubernetes environment, specifically: users executing or attaching to running pods (potential container access), the creation of privileged pods (potential container escape), or modifications to Role-Based Access Control (RBAC) objects such as roles and role bindings which could lead to privilege escalation.
Detects high or medium severity security alerts related to Kerberos Golden Ticket forgery, as identified by Microsoft Defender for Identity. This rule filters for specific alert names indicative of forged TGTs minted from the krbtgt account, excluding generic or informational ticket anomalies.
Detects high-risk activities related to SAML token-signing certificates, including certificate export from Active Directory Federation Services (AD FS) or Active Directory Certificate Services (AD CS) and unauthorized configuration changes to enterprise application certificate management. These activities are potential precursors to Golden SAML attacks, where an adversary attempts to forge authentication tokens.
Detects the assignment of high-privilege directory roles (e.g., Global Administrator) to a user account, where the initiator's sign-in session is identified as anomalous. Anomalous indicators include non-interactive sign-in, unknown/untrusted device state, elevated risk score, or activity occurring outside of configured business hours.
Detects the assignment of high-privilege directory roles (e.g., Global Administrator) to a user account, where the initiator's sign-in session is identified as anomalous. Anomalous indicators include non-interactive sign-in, unknown/untrusted device state, elevated risk score, or activity occurring outside of configured business hours.
Page 7 of 59