Detection rules

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

11,490
detections

Search detections

Filters

Showing 30 of 11,490

Disable Internal Tools or Feature in Registry

Detects registry modifications that change features of internal Windows tools (malware like Agent Tesla uses this technique)

T1112

Written by: frack113Attributed by SigmaHQand 2 more authors
Licence: Detection Rule License 1.1
Published: Oct 18, 2026

HighSigmaHQ

Suspicious Windows Service Tampering

Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts

T1489T1685

Written by: Nasreddine Bencherchali (Nextron Systems)Attributed by SigmaHQand 2 more authors
Licence: Detection Rule License 1.1
Published: Oct 18, 2026

MediumSigmaHQ

Rundll32 Execution With Uncommon DLL Extension

Detects the execution of rundll32 with a command line that doesn't contain a common extension

T1218.011

Written by: Tim SheltonAttributed by SigmaHQand 2 more authors
Licence: Detection Rule License 1.1
Published: Oct 18, 2026

MediumSigmaHQ

Registry Tampering Of Internal Tools Settings

Detects registry modifications that tamper with internal Windows tools settings, commonly used by malware to disable security features or system tools

T1112

Written by: Swachchhanda Shrawan Poudel (Nextron Systems)Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 18, 2026

MediumSigmaHQ

Shell Spawned by Celery Worker Process

Detects a system shell interpreter being spawned directly by a Celery worker process. This behavior indicates a Python background task execution framework is evaluating raw string input through a shell execution context, which is highly indicative of successful command or prompt injection exploitation against an LLM agent task.

T1059.004

Written by: Jennifer BatinaAttributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 18, 2026

UnknownMicrosoft Sentinel analytics

Suspicious Enumeration using Adfind Tool

Query detects Adfind tool use for domain reconnaissance, regardless of executable name, focusing on DC and ADFS servers, to spot potential adversary activity.

T1059T1069T1074T1087T1201+1 more

Licence: MIT License
Published: Oct 17, 2026

UnknownMicrosoft Sentinel analytics

New Child Process of W3WP.exe

Hunting Query detects unusual child processes of w3wp.exe not seen in 14 days, signaling potential web server compromise and web shell installation.

T1203

Licence: MIT License
Published: Oct 17, 2026

HighMicrosoft Sentinel analytics

Scheduled Task Hide

Identifies malware hiding scheduled tasks by deleting the SD (Security Descriptor) value, making tasks disappear from schtasks /query and Task Scheduler. Enable registry auditing policy and auditing on HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree. Reference: https://www.microsoft.com/en-us/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/ Reference: https://learn.microsoft.

T1562

Licence: MIT License
Published: Oct 17, 2026

MediumMicrosoft Sentinel analytics

AD FS Remote Auth Sync Connection

Identifies suspicious AD FS authentication by correlating Security events from "AD FS Auditing" with Windows Filtering Platform (WFP) events for incoming port 80 traffic. This may indicate a threat actor abusing AD FS replication services to obtain configuration settings and sensitive information such as AD FS certificates. Enable AD FS auditing on the AD FS server before using this query. References: https://learn.microsoft.

T1005

Licence: MIT License
Published: Oct 17, 2026

LowMicrosoft Sentinel analytics

SSH - Potential Brute Force

Identifies an IP address that had 15 failed attempts to sign in via SSH in a 4 hour block during a 24 hour time period. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.

T1110

Licence: MIT License
Published: Oct 17, 2026

LowMicrosoft Sentinel analytics

Squid proxy events for ToR proxies

Check for Squid proxy events associated with common ToR proxies. This query presumes the default squid log format is being used. http://www.squid-cache.org/Doc/config/access_log/

T1008T1090

Licence: MIT License
Published: Oct 17, 2026

LowMicrosoft Sentinel analytics

Squid proxy events related to mining pools

Checks for Squid proxy events in Syslog associated with common mining pools. This query presumes the default Squid log format is being used. http://www.squid-cache.org/Doc/config/access_log/

T1102

Licence: MIT License
Published: Oct 17, 2026

MediumMicrosoft Sentinel analytics

SFTP File transfer folder count above threshold

Identifies SFTP File Transfers with distinct folder count above certain threshold in a 15min time period. It requires SFTP VERBOSE loglevel to be enabled. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel.

T1020

Licence: MIT License
Published: Oct 17, 2026

MediumMicrosoft Sentinel analytics

SFTP File transfer above threshold

Identifies SFTP File Transfers above certain threshold in a 15min time period. It requires SFTP VERBOSE loglevel to be enabled. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel.

T1020

Licence: MIT License
Published: Oct 17, 2026

LowMicrosoft Sentinel analytics

NRT Squid proxy events related to mining pools

Checks for Squid proxy events in Syslog associated with common mining pools .This query presumes the default Squid log format is being used. http://www.squid-cache.org/Doc/config/access_log/

T1102

Licence: MIT License
Published: Oct 17, 2026

MediumMicrosoft Sentinel analytics

Failed logon attempts in authpriv

Identifies failed logon attempts from unknown users in Syslog authpriv logs. The unknown user means the account that tried to log in isn't provisioned on the machine. A few hits could indicate someone attempting to access a machine they aren't authorized to access. If there are many of hits, especially from outside your network, it could indicate a brute force attack. Default threshold for logon attempts is 15.

T1110

Licence: MIT License
Published: Oct 17, 2026

LowMicrosoft Sentinel analytics

Rare Windows Firewall Rule updates using Netsh

This query searches for rare firewall rule changes using netsh utility by comparing rule names and program names from the previous day.

T1204

Licence: MIT License
Published: Oct 17, 2026

UnknownMicrosoft Sentinel analytics

Download of New File Using Curl

Threat actors may use tools such as Curl to download additional files, communicate with C2 infrastructure, or exfiltrate data. This query looks for new files being downloaded using Curl.

T1071

Licence: MIT License
Published: Oct 17, 2026

MediumMicrosoft Sentinel analytics

Windows Binaries Lolbins Renamed

This query detects the execution of renamed Windows binaries (Lolbins). This is a common technique used by adversaries to evade detection. Ref: https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/execution-of-renamed-lolbin

T1059

Licence: MIT License
Published: Oct 17, 2026

MediumMicrosoft Sentinel analytics

WDigest downgrade attack

When the WDigest Authentication protocol is enabled, plain text passwords are stored in the Local Security Authority Subsystem Service (LSASS) exposing them to theft. This setting will prevent WDigest from storing credentials in memory. Ref: https://www.microsoft.com/en-us/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/

T1003

Licence: MIT License
Published: Oct 17, 2026

LowMicrosoft Sentinel analytics

Subscription moved to another tenant

This detection uses AzureActivity logs (Security category) to identify when a subscription is moved to another tenant. A threat actor may move a subscription into their own tenant to circumvent local resource deployment and logging policies. Once moved, threat actors may deploy resources and perform malicious activities such as crypto mining. This is a technique known as "subscription hijacking". More information can be found here: https://techcommunity.microsoft.

T1496

Licence: MIT License
Published: Oct 17, 2026

MediumElastic detection rules

OpenAI ChatGPT Enterprise User Invite Sent

Detects ChatGPT Enterprise audit events that invite a new user into the workspace. An adversary who compromises an administrator can invite a mailbox they control to gain durable access.

T1136T1136.003

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

HighElastic detection rules

OpenAI ChatGPT Enterprise Domain Created

Detects ChatGPT Enterprise audit events that create a workspace domain boundary entry. Domain changes can expand who is allowed to join or access the tenant and may establish persistence for attacker-controlled domains.

T1098

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

MediumElastic detection rules

OpenAI ChatGPT Enterprise Custom Agent Trigger Changed

Detects ChatGPT Enterprise custom-agent events that create or update a trigger. Triggers can schedule or event-drive agent runs without interactive user presence, enabling persistence and automation abuse.

T1053

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

MediumElastic detection rules

OpenAI ChatGPT Enterprise Custom Agent Published

Detects ChatGPT Enterprise custom-agent publish events (`agent_published`). Publishing an agent with connectors, skills, or store visibility can establish durable automation and broaden data access beyond the original user.

T1176

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

MediumElastic detection rules

OpenAI ChatGPT Enterprise Unusual Codex Plugin Installed

Detects the first ChatGPT Enterprise Codex plugin install for a given plugin display name and plugin name pair within the rule history window. Newly installed Codex plugins expand the tools and data sources available inside agent sessions; adversaries can enable unexpected connectors to persist access to mail, chat, or file systems after initial compromise.

T1176T1213

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

MediumElastic detection rules

OpenAI ChatGPT Enterprise Codex Access Token Created

Detects ChatGPT Enterprise Codex events that create an access token. Codex access tokens enable automated CLI or environment access and can be abused for persistence or lateral automation after account compromise. Treat tokens with a missing `expires_at` as higher priority during triage.

T1098

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

MediumElastic detection rules

OpenAI ChatGPT Enterprise App Authentication Linked

Detects ChatGPT Enterprise app authentication events that link a third-party app to a user or workspace. Linking apps establishes durable OAuth-style access that adversaries can use to persist connectors after initial compromise.

T1098

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

HighElastic detection rules

OpenAI ChatGPT Enterprise Account Owner Role Assigned

Detects ChatGPT Enterprise audit events where a user role is updated to account-owner. Account owners control workspace membership, connectors, usage limits, and other security-sensitive settings. An adversary who promotes a compromised account to owner gains durable control-plane access.

T1098T1098.003

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

MediumElastic detection rules

OpenAI ChatGPT Enterprise Authentication from a Suspicious User Agent

Detects successful ChatGPT Enterprise authentication events where the user agent looks scripted (for example Python, curl, Go HTTP clients, aiohttp, scrapers, or headless browsers) rather than a normal browser. Adversaries and automation often reuse stolen sessions or tokens with non-browser clients.

T1078T1078.004

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

Load more detections

Loading detection rules

Back to results

HighMicrosoft Sentinel analytics

PRODAFT USTA - Compromised credential used in successful sign-in

Description

Correlates corporate credentials exposed in PRODAFT USTA Account Takeover Prevention tickets with successful Microsoft Entra ID sign-ins for the same user. A successful sign-in by an account whose credentials are known to be compromised is a strong signal of account takeover. Requires the Microsoft Entra ID (SigninLogs) connector. Username matching is best-effort (case-insensitive) because USTA may record either an email or a bare username.

Detection logic

Detection requirements

Platform: Containers ESXi IaaS Identity Provider Linux macOS Network Devices Office Suite SaaS Windows
The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.
Log source product: azureactivedirectory prodaftustaatpccpdefinition
Log source service: prodaftustacompromisedcredentials_cl signinlogs

MITRE ATT&CK mappings

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.

Initial Access

T1078Valid AccountsAlso under Persistence, Privilege Escalation, and Stealth.704 detections cover this technique

Credential Access

T1555Credentials from Password Stores 86 detections cover this technique

No references are available for this detection.

From the source

At source: Open at source
Upstream identifier: 5da571b5-54f6-42c2-8c3e-27edd987ceec
Tagged by the source as: CredentialAccessInitialAccess

Licence

Published under: MIT LicenseRead the licence
Attribution: Required
Obtained under: MITRead the origin licence

Authorship

Published: Sep 1, 2026
Version: 1