Detection rules

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

11,497
detections

Search detections

Filters

Showing 30 of 11,497

Windows DNS Query Request by Telegram Bot API

The following analytic detects the execution of a DNS query by a process to the associated Telegram API domain, which could indicate access via a Telegram bot commonly used by malware for command and control (C2) communications. By monitoring DNS queries related to Telegram's infrastructure, the detection identifies potential attempts to establish covert communication channels between a compromised system and external malicious actors.

T1071.004T1102.002

Written by: Teoderick ContrerasAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 19, 2026

InformationalSplunk security content

Windows Process Outbound Connection To Social Media Domain

This analytic detects outbound network connections from a Python process running from suspicious or non-standard directories to social media related domains. It leverages Sysmon Event ID 3 to surface this anomalous behavior. Legitimate Python applications rarely originate from paths such as "C:\Users\Public\", Windows font or debug folders, or the Recycle Bin, making direct outbound calls to social media infrastructure from these locations a strong indicator of compromise.

T1586.001

Written by: Teoderick ContrerasAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 19, 2026

InformationalSplunk security content

Windows Password Managers Discovery

The following analytic identifies command-line activity that searches for files related to password manager software, such as "*.kdbx*" and "*credential*". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This activity is significant because attackers often target password manager databases to extract stored credentials, which can be used for further exploitation.

T1555.005

Written by: Teoderick ContrerasAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 19, 2026

InformationalSplunk security content

Windows DNS Query Request To TinyUrl

The following analytic detects a process located in a potentially suspicious location making DNS queries to known URL shortening services, specifically tinyurl. URL shorteners are frequently used by threat actors to obfuscate malicious destinations, including phishing pages, malware distribution sites, or command-and-control (C2) endpoints. While tinyurl.

T1105

Written by: Teoderick ContrerasAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 19, 2026

InformationalSplunk security content

Windows Boot or Logon Autostart Execution In Startup Folder

The following analytic detects the creation of files in the Windows %startup% folder, a common persistence technique. It leverages the Endpoint.Filesystem data model to identify file creation events in this specific directory. This activity is significant because adversaries often use the startup folder to ensure their malicious code executes automatically upon system boot or user logon.

T1547.001

Written by: Teoderick ContrerasAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 19, 2026

InformationalSplunk security content

PowerShell Download from Code Hosting Service

This analytic detects PowerShell Script Block Logging (Event ID 4104) events that use common download methods to retrieve files directly from raw-content URLs on GitHub, GitLab, or Codeberg. These code hosting services can be abused to stage payloads, but administrators and developers also download files from them. A match identifies a download attempt; it does not establish that the file was successfully retrieved or executed.

T1059.001T1105

Written by: Teoderick ContrerasAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 19, 2026

InformationalSplunk security content

Non Firefox Process Access Firefox Profile Dir

The following analytic detects non-Firefox processes accessing the Firefox profile directory, which contains sensitive user data such as login credentials, browsing history, and cookies. It leverages Windows Security Event logs, specifically event code 4663, to monitor access attempts. This activity is significant because it may indicate attempts by malware, such as RATs or trojans, to harvest user information.

T1555.003

Written by: Teoderick ContrerasAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 19, 2026

InformationalSplunk security content

Executables Or Script Creation In Temp Path

The following analytic identifies the creation of executables or scripts in temporary file paths on Windows systems. It leverages the Endpoint.Filesystem data set to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in temporary directories (e.g., \windows\Temp\, \AppData\Local\Temp\). This activity can be significant as adversaries often use these paths to evade detection and maintain persistence.

T1036

Written by: Teoderick ContrerasAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 19, 2026

InformationalSplunk security content

Executables Or Script Creation In Suspicious Path

The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem dataset to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in uncommon directories (e.g., \windows\fonts\, \users\public\). This activity can be significant as adversaries often use these paths to evade detection and maintain persistence.

T1036

Written by: Teoderick ContrerasAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 19, 2026

MediumSplunk security content

Download Files Using Telegram

The following analytic detects suspicious file downloads by the Telegram application on a Windows system. It leverages Sysmon EventCode 15 to identify instances where Telegram.exe creates files with a Zone.Identifier, indicating a download. This activity is significant as it may indicate an adversary using Telegram to download malicious tools, such as network scanners, for further exploitation.

T1105

Written by: Teoderick ContrerasAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 19, 2026

MediumSplunk security content

AWS Repeated CloudWatch Logs Read Operations

The following analytic detects a high volume of Amazon CloudWatch Logs read operations performed by the same AWS principal and account within a five-minute period. It identifies more than 500 DescribeLogGroups, DescribeLogStreams, DownloadLogEvents, FilterLogEvents, GetLogEvents, or GetQueryResults API calls. This activity may indicate automated discovery or collection of operational, application, or security telemetry from CloudWatch Logs.

T1530

Written by: Maria Jose ErquiagaAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 19, 2026

MediumSplunk security content

AWS IAM Role Created with External Trust

Detects a successful AWS IAM CreateRole event whose trust policy allows sts:AssumeRole by a principal in another AWS account or by a wildcard principal. This configuration may provide persistent access if the principal can assume the role. The event alone does not establish that the role was assumed or that its creation was unauthorized.

T1098.003

Written by: Maria Jose ErquiagaAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 19, 2026

MediumSplunk security content

AWS EC2 Startup Script Modified on Stopped Instance

A successful EC2 StopInstances request was followed within one hour by a successful ModifyInstanceAttribute request targeting userData on the same instance, by the same IAM principal. This may indicate an attempt to change instance startup behavior or establish persistence. These CloudTrail events do not confirm that the modified user-data script executed.

T1578.005

Written by: Maria Jose ErquiagaAttributed by Splunk security content
Licence: Apache License 2.0
Published: Oct 19, 2026

MediumSplunk security content

AWS EC2 Multiple SSH Public Keys Uploaded by a Single Identity

Detects an AWS identity making 10 or more successful EC2 Instance ConnectSendSSHPublicKey API calls within the configured search interval. EC2 Instance Connect temporarily makes an SSH public key available to an operating-system user on an EC2 instance. A burst of these calls may indicate automated attempts to establish access or move laterally using compromised AWS credentials.

T1021.004T1021.008

Written by: Maria Jose ErquiagaAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 19, 2026

LowSplunk security content

AWS Anomalous Secrets Manager Batch Retrieval

The following analytic detects an AWS principal making more than 10 distinct successful Secrets Manager BatchGetSecretValue API calls within one hour. It groups calls by AWS account and user identity ARN and deduplicates CloudTrail events by event ID. Repeated batch retrieval may indicate bulk access to secrets using a compromised identity, although legitimate automation can produce similar activity.

T1555.006

Written by: Maria Jose ErquiagaAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 19, 2026

MediumSigmaHQ

Disable Internal Tools or Feature in Registry

Detects registry modifications that change features of internal Windows tools (malware like Agent Tesla uses this technique)

T1112

Written by: frack113Attributed by SigmaHQand 2 more authors
Licence: Detection Rule License 1.1
Published: Oct 18, 2026

HighSigmaHQ

Suspicious Windows Service Tampering

Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts

T1489T1685

Written by: Nasreddine Bencherchali (Nextron Systems)Attributed by SigmaHQand 2 more authors
Licence: Detection Rule License 1.1
Published: Oct 18, 2026

MediumSigmaHQ

Rundll32 Execution With Uncommon DLL Extension

Detects the execution of rundll32 with a command line that doesn't contain a common extension

T1218.011

Written by: Tim SheltonAttributed by SigmaHQand 2 more authors
Licence: Detection Rule License 1.1
Published: Oct 18, 2026

MediumSigmaHQ

Registry Tampering Of Internal Tools Settings

Detects registry modifications that tamper with internal Windows tools settings, commonly used by malware to disable security features or system tools

T1112

Written by: Swachchhanda Shrawan Poudel (Nextron Systems)Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 18, 2026

MediumSigmaHQ

Shell Spawned by Celery Worker Process

Detects a system shell interpreter being spawned directly by a Celery worker process. This behavior indicates a Python background task execution framework is evaluating raw string input through a shell execution context, which is highly indicative of successful command or prompt injection exploitation against an LLM agent task.

T1059.004

Written by: Jennifer BatinaAttributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 18, 2026

UnknownMicrosoft Sentinel analytics

Suspicious Enumeration using Adfind Tool

Query detects Adfind tool use for domain reconnaissance, regardless of executable name, focusing on DC and ADFS servers, to spot potential adversary activity.

T1059T1069T1074T1087T1201+1 more

Licence: MIT License
Published: Oct 17, 2026

UnknownMicrosoft Sentinel analytics

New Child Process of W3WP.exe

Hunting Query detects unusual child processes of w3wp.exe not seen in 14 days, signaling potential web server compromise and web shell installation.

T1203

Licence: MIT License
Published: Oct 17, 2026

HighMicrosoft Sentinel analytics

Scheduled Task Hide

Identifies malware hiding scheduled tasks by deleting the SD (Security Descriptor) value, making tasks disappear from schtasks /query and Task Scheduler. Enable registry auditing policy and auditing on HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree. Reference: https://www.microsoft.com/en-us/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/ Reference: https://learn.microsoft.

T1562

Licence: MIT License
Published: Oct 17, 2026

MediumMicrosoft Sentinel analytics

AD FS Remote Auth Sync Connection

Identifies suspicious AD FS authentication by correlating Security events from "AD FS Auditing" with Windows Filtering Platform (WFP) events for incoming port 80 traffic. This may indicate a threat actor abusing AD FS replication services to obtain configuration settings and sensitive information such as AD FS certificates. Enable AD FS auditing on the AD FS server before using this query. References: https://learn.microsoft.

T1005

Licence: MIT License
Published: Oct 17, 2026

LowMicrosoft Sentinel analytics

SSH - Potential Brute Force

Identifies an IP address that had 15 failed attempts to sign in via SSH in a 4 hour block during a 24 hour time period. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.

T1110

Licence: MIT License
Published: Oct 17, 2026

LowMicrosoft Sentinel analytics

Squid proxy events for ToR proxies

Check for Squid proxy events associated with common ToR proxies. This query presumes the default squid log format is being used. http://www.squid-cache.org/Doc/config/access_log/

T1008T1090

Licence: MIT License
Published: Oct 17, 2026

LowMicrosoft Sentinel analytics

Squid proxy events related to mining pools

Checks for Squid proxy events in Syslog associated with common mining pools. This query presumes the default Squid log format is being used. http://www.squid-cache.org/Doc/config/access_log/

T1102

Licence: MIT License
Published: Oct 17, 2026

MediumMicrosoft Sentinel analytics

SFTP File transfer folder count above threshold

Identifies SFTP File Transfers with distinct folder count above certain threshold in a 15min time period. It requires SFTP VERBOSE loglevel to be enabled. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel.

T1020

Licence: MIT License
Published: Oct 17, 2026

MediumMicrosoft Sentinel analytics

SFTP File transfer above threshold

Identifies SFTP File Transfers above certain threshold in a 15min time period. It requires SFTP VERBOSE loglevel to be enabled. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel.

T1020

Licence: MIT License
Published: Oct 17, 2026

LowMicrosoft Sentinel analytics

NRT Squid proxy events related to mining pools

Checks for Squid proxy events in Syslog associated with common mining pools .This query presumes the default Squid log format is being used. http://www.squid-cache.org/Doc/config/access_log/

T1102

Licence: MIT License
Published: Oct 17, 2026

Load more detections

Loading detection rules

Back to results

HighElastic detection rules Elastic

Potential Evasion via Boot Time Removal Tool

Description

Identifies creation of a ":changelist" NTFS alternate data stream or a Windows service Args registry value pointing to a ":changelist" path. Microsoft Defender's Boot-Time Removal (BTR.sys) driver reads an RC4-encrypted transaction blob from a driver ADS named ":changelist", referenced by HKLM\SYSTEM\*ControlSet*\Services\*\Args. Adversaries can reproduce this staging outside Defender to abuse BTR.sys as a signed kernel primitive for arbitrary file and registry operations. This rule focuses on non-System writers and excludes Microsoft-signed MRT.exe running as SYSTEM, which may perform related remediation staging.

Detection logic

Its licence does not clear it for publishing here

Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.

Detection requirements

Platform: Containers ESXi IaaS Identity Provider Linux macOS Network Devices Office Suite Windows
The rule states no platform. This is derived from the 4 ATT&CK techniques it maps to.

MITRE ATT&CK mappings

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.

Persistence

T1112Modify RegistryAlso under Defense Impairment.207 detections cover this technique
T1543Create or Modify System ProcessAlso under Privilege Escalation.118 detections cover this technique
- T1543.003Windows Service 87 detections cover this technique

Stealth

T1564Hide Artifacts56 detections cover this technique
- T1564.004NTFS File Attributes 33 detections cover this technique

Defense Impairment

T1685Disable or Modify ToolsMapped as T1562 and T1562.001, withdrawn by ATT&CK.278 detections cover this technique

References

Links the source published beside this detection. Reference is the link the source wrote, unmodified. Class is decided by this catalogue from the host and path, not stated by the source. Cited by counts published detections citing the same resource, including this one, and the sources beneath it count the repositories this catalogue ingests, which is not the same as independent research.
Reference	Class	Cited by
github.com/Dump-GUY/BTR_CLI	Tool	Only this detection cites it
research.checkpoint.com/2026/btr-reforged-weaponizing-defenders-remediation-driver-as-a-kernel-operation-primitive/	Unclassified	Only this detection cites it

From the source

At source: Open at source
Upstream identifier: 942c8f59-f01c-4dc0-a05f-2f5bba836ad8
Tagged by the source as: Data Source: Elastic DefendDomain: EndpointOS: WindowsPlatform: WindowsResources: Investigation GuideRule Type: ES|QLTactic: Defense EvasionTactic: PersistenceUse Case: Threat Detection

Licence

Published under: Elastic License 2.0Read the licence
Attribution: Required

Authorship

Written by: Elastic
Published: Sep 20, 2026
Version: 2