Detection rules

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

11,609
detections

Search detections

Filters

Showing 30 of 11,609

Identifies threat-listed domains that are currently parked and may be used for staging. The feed reports parked state in the is_parked column as t or f.

T1583

Licence: MIT License
Published: Oct 27, 2026

HighMicrosoft Sentinel analytics

WhoisFreaks - newly registered domain seen in threat feed

Identifies newly registered domains that are later observed in WhoisFreaks threat feeds. The rule runs hourly and matches threat rows ingested in the last hour against domains seen in the NRD feeds during the previous seven days, so each threat row is alerted on once.

T1566T1583

Licence: MIT License
Published: Oct 27, 2026

HighMicrosoft Sentinel analytics

WhoisFreaks - high confidence threat domains

Identifies high-confidence malware, phishing, and spam domains from WhoisFreaks threat feeds. The feed reports confidence as a decimal between 0 and 1; this rule alerts on domains with a confidence of 0.8 or higher.

T1071T1566

Licence: MIT License
Published: Oct 27, 2026

LowMicrosoft Sentinel analytics

WhoisFreaks - burst of newly registered domains

Identifies unusually large NRD ingest volume that may indicate bulk registration campaigns. The NRD feeds are polled once a day, so the rule compares the last 24 hours of distinct domains against the average of the previous seven daily loads and alerts only when the current load is at least 50% above that average and more than three standard deviations from it.

T1583

Licence: MIT License
Published: Oct 27, 2026

MediumMicrosoft Sentinel analytics

DDoS Attack IP Addresses - Percent Threshold

Identifies IP addresses that generate over 5% of traffic during DDoS attack mitigation

T1498

Licence: MIT License
Published: Oct 27, 2026

MediumMicrosoft Sentinel analytics

DDoS Attack IP Addresses - PPS Threshold

Identifies IP addresses that generates maximal traffic rate over 10k PPS during DDoS attack mitigation

T1498

Licence: MIT License
Published: Oct 27, 2026

HighMicrosoft Sentinel analytics

PHP Worker Process Spawning Shell/Recon Tool

[Unvalidated] Identifies a shell or reconnaissance tool spawned directly under a PHP worker process (php-fpm, lsphp, or Apache mod_php, where PHP runs in-process inside the apache2/httpd worker). This is a generic PHP child-process-monitoring indicator, useful against any PHP RCE regardless of root cause - it does not itself detect or confirm exploitation of CVE-2026-109618 or CVE-2026-109619 specifically.

T1059T1059.004T1190

Written by: rjmendezAttributed by Microsoft Sentinel analytics
Licence: MIT License
Published: Oct 27, 2026

MediumElastic detection rules

Suspicious IDE Extension Installation from VSIX

Detects installation of an IDE extension from a local VSIX ("--install-extension" with a ".vsix" path) when that path is in a staging directory, or the parent is a script host or installer. VS Code and compatible editors (Cursor, VSCodium, Windsurf) use this CLI to sideload extensions outside the marketplace.

T1176T1176.002

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 27, 2026

MediumElastic detection rules

Suspicious Command Execution from Visual Studio Code

Detects Visual Studio Code ("Code.exe" on Windows or "Code Helper" on macOS) spawning a shell or downloader whose command line contains an encoded command, a download cradle, or a reverse-shell pattern. Malicious IDE extensions use the editor process to run these commands after install.

T1059T1059.001T1059.003T1059.004T1176+1 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 27, 2026

HighElastic detection rules

Package Runtime Secret File Access Followed by IMDS Request

Identifies a Python, Node.js, Bun, Deno, Ruby, PHP or Perl runtime, or a binary executing from a package install location, that opens a developer secret (SSH keys, package registry tokens, source control credentials or AI coding assistant credentials) and then connects to a cloud instance metadata service (IMDS) endpoint within one minute.

T1195T1195.001T1552T1552.001T1552.004+1 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 27, 2026

HighElastic detection rules

Multiple Credential Access by VS Code or Cursor IDE Descendant

Detects a process descended from Visual Studio Code or Cursor opening at least two distinct sensitive files, such as browser credential stores, cloud tokens, or SSH and package-manager secrets. Malicious IDE extensions use the editor process tree to harvest more than one credential store in a single session.

T1176T1176.002T1552T1552.001T1555+1 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 27, 2026

HighMicrosoft Sentinel analytics

Public TLS certificate with classical signature on Application Gateway

An Application Gateway or Front Door is presenting a TLS certificate signed with a classical algorithm (RSA / ECDSA) that is quantum-vulnerable. If the certificate's validity extends past the plausible arrival of cryptographically-relevant quantum computers, replace with a PQ-hybrid certificate now.

T1190

Licence: MIT License
Published: Oct 24, 2026

MediumMicrosoft Sentinel analytics

Quantum-vulnerable key detected in Key Vault

A key in Azure Key Vault has been classified as quantum-vulnerable (RSA or elliptic-curve). These key types are broken by Shor's algorithm on a sufficiently large fault-tolerant quantum computer. Rotate to a PQ-hybrid key (ML-KEM, ML-DSA) or plan migration before the harvest-now-decrypt-later window closes for long-lived data.

T1565

Licence: MIT License
Published: Oct 24, 2026

HighMicrosoft Sentinel analytics

Quantum-vulnerable certificate on Entra app registration

An Entra ID (Azure AD) app registration or service principal has a certificate credential using a classical algorithm (RSA or elliptic-curve) that is vulnerable to Shor's algorithm. These certificates authenticate workloads and service-to-service flows -- a compromised cert allows impersonation of the application identity. Rotate to a PQ-hybrid certificate or shorten the validity window.

T1552

Licence: MIT License
Published: Oct 24, 2026

InformationalMicrosoft Sentinel analytics

New quantum-vulnerable resource appeared

A resource with quantum-vulnerable posture appeared that was not observed in the previous 24-hour scan cycle. Investigate whether this is a new deployment that should have been provisioned with PQ-hybrid cryptography from the start.

T1082

Licence: MIT License
Published: Oct 24, 2026

HighMicrosoft Sentinel analytics

Certificate expiring after 2030 still uses classical signature

A TLS or Key Vault certificate has an expiry date after 2030-01-01 and is signed with a quantum-vulnerable classical algorithm. Long-lived certificates are the primary harvest-now- decrypt-later risk vector. Reissue with a PQ-hybrid signature or shorten validity window.

T1556

Licence: MIT License
Published: Oct 24, 2026

MediumMicrosoft Sentinel analytics

App Service using TLS < 1.3

An Azure App Service is configured to accept inbound TLS below 1.3. Only TLS 1.3 supports the negotiation of hybrid PQ key exchange (X25519MLKEM768 etc.); legacy versions cannot be upgraded to PQ without a client protocol change.

T1190

Licence: MIT License
Published: Oct 24, 2026

HighElastic detection rules

Web Shell Detection: Script Process Child of Common Web Processes

Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access.

T1047T1059T1059.001T1059.003T1059.005+4 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

HighElastic detection rules

Persistence via Microsoft Office AddIns

Detects attempts to establish persistence on an endpoint by abusing Microsoft Office add-ins.

T1137T1137.006

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

HighElastic detection rules

Unusual Child Process of dns.exe

Identifies an unexpected process spawning from dns.exe, the process responsible for Windows DNS server services, which may indicate activity related to remote code execution or other forms of exploitation.

T1190T1210

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

HighElastic detection rules

Suspicious SolarWinds Web Help Desk Java Module Load or Child Process

Identifies the SolarWinds Web Help Desk Java process loading an untrusted or remote native module (DLL) or spawning a suspicious child process such as cmd, PowerShell, or rundll32. This behavior is uncommon for the Web Help Desk server and may indicate successful exploitation of deserialization vulnerabilities (CVE-2025-40536, CVE-2025-40551), which allow attackers to load malicious SQLite extensions and achieve remote code execution.

T1059T1059.001T1059.003T1129T1190+2 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

HighElastic detection rules

Suspicious Windows Command Shell Arguments

Identifies the execution of the Windows Command Shell process (cmd.exe) with suspicious argument values. This behavior is often observed during malware installation.

T1027T1059T1059.003T1105T1218+2 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

LowElastic detection rules

Whoami Process Activity

Identifies suspicious use of whoami.exe which displays user, group, and privileges information for the user who is currently logged on to the local system.

T1033T1069

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

HighElastic detection rules

Script Execution via Microsoft HTML Application

Identifies the execution of scripts via HTML applications using Windows utilities rundll32.exe or mshta.exe. Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed binaries.

T1059T1059.005T1059.007T1218T1218.005+1 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

HighElastic detection rules

Suspicious Microsoft Diagnostics Wizard Execution

Identifies potential abuse of the Microsoft Diagnostics Troubleshooting Wizard (MSDT) to proxy malicious command or binary execution via malicious process arguments.

T1036T1036.003T1218

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

MediumElastic detection rules

MsiExec Service Child Process With Network Connection

Identifies the execution of an MsiExec service child process followed by network or dns lookup activity. Adversaries may abuse Windows Installers for initial access and delivery of malware.

T1218T1218.007

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

HighElastic detection rules

Suspicious Microsoft HTML Application Child Process

Identifies Mshta.exe spawning a suspicious child process. This may indicate adversarial activity, as Mshta is often leveraged by adversaries to execute malicious scripts and evade detection.

T1059T1059.001T1059.003T1218T1218.005+2 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

HighElastic detection rules

Proxy Execution via Console Window Host

Identifies abuse of the Console Window Host (conhost.exe) to execute commands via proxy. This behavior is used as a defense evasion technique to blend-in malicious activity with legitimate Windows software.

T1059T1059.001T1059.003T1202

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

HighElastic detection rules

Network Activity to a Suspicious Top Level Domain

Identifies DNS queries to commonly abused Top Level Domains by common LOLBINs or executables running from world writable directories or unsigned binaries. This behavior matches on common malware C2 abusing less formal domain names.

T1071T1071.004T1127T1127.001T1218

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

HighElastic detection rules

Potential NetScaler Log Poisoning Command Injection Attempt

Detects shell syntax in NetScaler Pitboss records or in Citrix records that combine Pitboss, packet-engine, or core terminology with shell syntax. This may indicate that attacker-controlled data poisoned an appliance log consumed by a privileged script. The behavior includes CVE-2026-88771, but the detection is intended to identify similar NetScaler log-poisoning command-injection attempts without requiring a specific vulnerability, failure phrase, or command.

T1059T1059.004T1190

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 24, 2026

Load more detections

Loading detection rules

Back to results

HighMicrosoft Sentinel analytics

SpyCloud identity access record exposure

#DONT_CORR# 'Identifies exposure of identity access material such as session cookies, OAuth tokens, or SSO credentials. This material can grant direct account access without a password, so it bypasses password resets…

Description

Detection logic

Detection requirements

Platform: Containers IaaS Identity Provider Linux macOS Office Suite SaaS Windows
The rule states no platform. This is derived from the 3 ATT&CK techniques it maps to.
Log source product: spycloudenterpriseprotectionccf
Log source service: spycloudbreachwatchlistv2_cl

MITRE ATT&CK mappings

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.

Credential Access

T1528Steal Application Access Token 93 detections cover this technique
T1539Steal Web Session Cookie 24 detections cover this technique

Lateral Movement

T1550Use Alternate Authentication Material 83 detections cover this technique

No references are available for this detection.

From the source

At source: Open at source
Upstream identifier: cd8ec49c-b654-49be-b040-e552b8eba7c8
Tagged by the source as: CredentialAccessDefenseEvasion

Licence

Published under: MIT LicenseRead the licence
Attribution: Required
Obtained under: MITRead the origin licence

Authorship

Published: Sep 12, 2026
Version: 1