Detection rules

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

11,450
detections

Search detections

Filters

Showing 30 of 11,450

The following analytic detects Zeek HTTP requests using methods outside a configurable allowlist of standard and commonly used HTTP methods. Unusual methods can indicate protocol abuse, exploitation attempts, or command-and-control traffic. Review the method, source, destination, and URI to assess the activity.

T1071.001T1190

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Unusual SSH Client Banner

The following analytic detects SSH connections presenting client banners that do not match known, common SSH client software by leveraging Zeek ssh logs. Unusual or unknown SSH client banners may indicate custom tooling, offensive frameworks, tunneling utilities, or malware using SSH for command-and-control or lateral movement.

T1021.004T1572

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

HTTP POST Request with Encoded Payload

The following analytic detects HTTP POST requests containing heavily encoded data in the post body, specifically looking for sequences of hex-encoded bytes or base64-encoded strings. It leverages Zeek HTTP logs to identify POST requests where the body contains eight or more consecutive hex escape sequences or sixteen or more consecutive base64 character groups.

T1071.001T1132.001

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Windows Wermgr Alternate Data Stream in Temp Dir

The following analytic detects the wermgr.exe process creating an alternate stream in the temp directory. It leverages Sysmon EventID 15 to identify these actions. This activity is significant because wermgr.exe is typically associated with error reporting, not file creation. Such activity is significant as it may indicate RoguePlanet malware, which creates an alternate stream in the temp directory to execute malicious code.

T1564.004

Written by: Teoderick ContrerasAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Windows Non-System Process Querying Definition Update

Detects DNS queries to definitionupdates.microsoft.com or the go.microsoft.com fwlink redirect used for WD update downloads, when the querying process is not a Windows system component. BlueHammer utilizes these definition updates as part of its exploit chain.

T1068T1071.001

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Windows NirSoft Utilities

The following analytic identifies the execution of commonly used NirSoft utilities on Windows systems. This activity is significant for a SOC because NirSoft utilities, while legitimate, can be used by adversaries for malicious purposes like credential theft or system reconnaissance. If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further system compromise.

T1588.002

Written by: Michael HaagAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Windows NirSoft Tool Bundle File Created

The following analytic detects the creation of files associated with the NirSoft tool bundles on Windows endpoints. NirSoft is a well-known provider of free, portable utilities that can be used for various system and network tasks. However, threat actors often leverage these tools for malicious purposes, such as credential harvesting, network reconnaissance, and data exfiltration.

T1588.002

Written by: Nasreddine BencherchaliAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Windows Cloud Files Filter Loaded by Uncommon Process

The following analytic detects "cldapi.dll" being loaded by a process not associated with legitimate cloud sync activity. The Windows Cloud Files API (cldapi.dll) is abused by several local privilege escalation exploits.

T1543.003

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

MediumSplunk security content

Windows NirSoft AdvancedRun

The following analytic detects the execution of AdvancedRun.exe, a tool with capabilities similar to remote administration programs like PsExec. It identifies the process by its name or original file name and flags common command-line arguments. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. Monitoring this activity is crucial as AdvancedRun can be used for remote code execution and configuration-based automation.

T1588.002

Written by: Michael HaagAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

MediumSplunk security content

Possible Browser Pass View Parameter

The following analytic identifies processes with command-line parameters associated with web browser credential dumping tools, specifically targeting behaviors used by Remcos RAT malware. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and specific file paths. This activity is significant as it indicates potential credential theft, a common tactic in broader cyber-espionage campaigns.

T1555.003

Written by: Teoderick ContrerasAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Ollama Suspicious Prompt Injection Jailbreak

Detects potential prompt injection or jailbreak attempts against Ollama API endpoints by identifying requests with abnormally long response times. Attackers often craft complex, layered prompts designed to bypass AI safety controls, which typically result in extended processing times as the model attempts to parse and respond to these malicious inputs.

T1059T1190

Written by: Rod SotoAttributed by Splunk security content
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Ollama Possible RCE via Model Loading

Detects Ollama server errors and failures during model loading operations that may indicate malicious model injection, path traversal attempts, or exploitation of model loading mechanisms to achieve remote code execution. Adversaries may attempt to load specially crafted malicious models or exploit vulnerabilities in the model loading process to execute arbitrary code on the server.

T1190

Written by: Rod SotoAttributed by Splunk security content
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Ollama Possible Model Exfiltration Data Leakage

Detects data leakage and exfiltration attempts targeting Ollama model metadata and configuration endpoints. Adversaries repeatedly query /api/show, /api/tags, and /api/v1/models to systematically extract sensitive model information including architecture details, fine-tuning parameters, system paths, Modelfile configurations, and proprietary customizations.

T1048

Written by: Rod SotoAttributed by Splunk security content
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Ollama Abnormal Service Crash Availability Attack

Detects critical service crashes, fatal errors, and abnormal process terminations in Ollama that may indicate exploitation attempts, resource exhaustion attacks, malicious input triggering unhandled exceptions, or deliberate denial of service attacks designed to disrupt AI model availability and degrade system stability.

T1489

Written by: Rod SotoAttributed by Splunk security content
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Detection of tools built by NirSoft

The following analytic identifies the execution of tools built by NirSoft by detecting specific command-line arguments such as "/stext" and "/scomma". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This activity is significant because NirSoft tools, while legitimate, can be exploited by attackers for malicious purposes such as credential theft or system reconnaissance.

T1072

Written by: Bhavin PatelAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

MediumSplunk security content

Detect Large ICMP Traffic

The following analytic identifies ICMP traffic to external IP addresses with total bytes (sum of bytes in and bytes out) greater than 1,000 bytes. It leverages the Network_Traffic data model to detect large ICMP packet that aren't blocked and are directed toward external networks. We use All_Traffic.bytes in the detection to capture variations in inbound versus outbound traffic sizes, as significant discrepancies or unusually large ICMP exchanges can indicate information smuggling, covert

T1095

Written by: Rico ValdezAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

ASL AWS ECR Container Upload Unknown User

The following analytic detects unauthorized container uploads to AWS Elastic Container Service (ECR) by monitoring AWS CloudTrail events. It identifies instances where a new container is uploaded by a user not previously recognized as authorized.

T1204.003

Written by: Patrick BareissAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

MediumSplunk security content

PingID New MFA Method After Credential Reset

The following analytic identifies the provisioning of a new MFA device shortly after a password reset. It detects this activity by correlating Windows Event Log events for password changes (EventID 4723, 4724) with PingID logs indicating device pairing. This behavior is significant as it may indicate a social engineering attack where a threat actor impersonates a valid user to reset credentials and add a new MFA device.

T1098.005T1556.006T1621

Written by: Steven DickAttributed by Splunk security content
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Ollama Possible Memory Exhaustion Resource Abuse

Identifies high Ollama runner counts and large model buffer allocations as possible resource pressure indicators. Memory values vary with model size and hardware, and these operational logs do not establish malicious intent; validate against host capacity and workload baselines.

T1499

Written by: Rod SotoAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Ollama Possible API Endpoint Scan Reconnaissance

Detects API reconnaissance and endpoint scanning activity against Ollama servers by identifying sources probing multiple API endpoints within short timeframes, particularly when using HEAD requests or accessing diverse endpoint paths, which indicates systematic enumeration to map the API surface, discover hidden endpoints, or identify vulnerabilities before launching targeted attacks.

T1595

Written by: Rod SotoAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Ollama Excessive API Requests

Detects high Ollama API request volumes from a single client in a short time window. A burst may indicate automated abuse or contribute to resource contention, but GIN access logs do not establish malicious intent or service impact; validate the client and workload against local usage baselines.

T1498

Written by: Rod SotoAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 14, 2026

MediumMicrosoft Sentinel analytics

WhoisFreaks - parked threat domains

Identifies threat-listed domains that are currently parked and may be used for staging.

T1583

Licence: MIT License
Published: Oct 14, 2026

HighMicrosoft Sentinel analytics

WhoisFreaks - newly registered domain seen in threat feed

Identifies newly registered domains that are later observed in WhoisFreaks threat feeds.

T1566T1583

Licence: MIT License
Published: Oct 14, 2026

HighMicrosoft Sentinel analytics

WhoisFreaks - high confidence threat domains

Identifies high-confidence malware, phishing, and spam domains from WhoisFreaks threat feeds.

T1071T1566

Licence: MIT License
Published: Oct 14, 2026

LowMicrosoft Sentinel analytics

WhoisFreaks - burst of newly registered domains

Identifies unusually large NRD ingest volume that may indicate bulk registration campaigns.

T1583

Licence: MIT License
Published: Oct 14, 2026

HighMicrosoft Sentinel analytics

Silverfort - Lateral movement target discovery

Identifies Silverfort incidents involving bursts of authentications from one host to many other hosts. This behavior may indicate reconnaissance to identify targets for lateral movement.

T1018T1046

Licence: MIT License
Published: Oct 14, 2026

HighMicrosoft Sentinel analytics

Silverfort - UserBruteForce Incident

Identifies Silverfort incidents involving repeated attempts to authenticate to a user account. This behavior may indicate a brute-force attempt to gain unauthorized access.

T1110

Licence: MIT License
Published: Oct 14, 2026

HighMicrosoft Sentinel analytics

Silverfort - Denied MFA with risk indicators

Identifies Silverfort incidents involving denied MFA requests accompanied by additional risk indicators, such as a new host or impossible travel. This behavior may indicate a user rejecting an unauthorized authentication attempt.

T1621

Licence: MIT License
Published: Oct 14, 2026

HighMicrosoft Sentinel analytics

Silverfort - SMB share enumeration

Identifies Silverfort incidents involving unusually frequent access to CIFS servers. This behavior may indicate reconnaissance of shared resources before lateral movement.

T1135

Licence: MIT License
Published: Oct 14, 2026

HighMicrosoft Sentinel analytics

Silverfort - Domain controller log cleared

Identifies Silverfort incidents involving a security log being cleared on a domain controller. Clearing this log may remove evidence of account activity and indicate an attempt to evade investigation.

T1070.001

Licence: MIT License
Published: Oct 14, 2026

Load more detections

Loading detection rules

Back to results

MediumElastic detection rules Elastic

Entra ID Unusual Cloud Device Registration

Description

Detects a sequence of events in Microsoft Entra ID indicative of suspicious cloud-based device registration via automated tooling like ROADtools or similar frameworks. This behavior involves adding a device via the Device Registration Service, followed by the assignment of registered users and owners — a pattern consistent with techniques used to establish persistence or acquire a Primary Refresh Token (PRT). ROADtools and similar tooling leave distinct telemetry signatures such as the `Microsoft.OData.Client` user agent. These sequences are uncommon in typical user behavior and may reflect abuse of device trust for session hijacking or silent token replay.

Detection logic

Its licence does not clear it for publishing here

Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.

Detection requirements

Platform: Containers ESXi IaaS Identity Provider Linux macOS Network Devices Office Suite SaaS Windows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
Log source category: event_index

MITRE ATT&CK mappings

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.

Persistence

T1098Account ManipulationAlso under Privilege Escalation.409 detections cover this technique
- T1098.005Device Registration 28 detections cover this technique

References

Links the source published beside this detection. Reference is the link the source wrote, unmodified. Class is decided by this catalogue from the host and path, not stated by the source. Cited by counts published detections citing the same resource, including this one, and the sources beneath it count the repositories this catalogue ingests, which is not the same as independent research.
Reference	Class	Cited by
dirkjanm.io/introducing-roadtools-token-exchange-roadtx/	Unclassified	3
github.com/dirkjanm/ROADtools	Tool	16from 2 sources
www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/	Threat report	19

From the source

At source: Open at source
Upstream identifier: 90efea04-5675-11f0-8f80-f661ea17fbcd
Tagged by the source as: Data Source: AzureData Source: Microsoft Entra IDData Source: Microsoft Entra ID Audit LogsDomain: CloudDomain: IdentityNoise: LowPerformance: FastPlatform: Entra IDResources: Investigation GuideRule Type: Event Correlation (EQL)Tactic: PersistenceUse Case: Identity and Access Audit

Licence

Published under: Elastic License 2.0Read the licence
Attribution: Required

Authorship

Written by: Elastic
Published: Sep 20, 2026
Version: 3