Detection Library
Battle-tested detection rules for real SOC environments. KQL, Sigma, and Splunk — curated by practitioners, mapped to MITRE ATT&CK.
Every rule in this library is production-ready. Written by security operators, tested in real environments, and mapped to MITRE ATT&CK techniques. Copy, paste, detect.
Free rules are fully visible. Premium rules show description and metadata — unlock the full query with SCW Premium.
RULES Detection Rules
Brute Force – Failed Logons Spike
FREET1110.001 — Brute Force: Password Guessing
Detects more than 10 failed sign-in attempts from a single IP within 5 minutes. Classic brute force indicator.
SigninLogs
| where ResultType != "0"
| summarize FailedCount = count() by IPAddress, bin(TimeGenerated, 5m)
| where FailedCount > 10
| project TimeGenerated, IPAddress, FailedCount💡 Note: Tune the threshold based on your environment. Consider excluding known VPN IPs.
Suspicious PowerShell Execution
FREET1059.001 — Command and Scripting Interpreter: PowerShell
Flags PowerShell processes with encoded commands, download cradles, or bypass flags — common in initial access and execution stages.
DeviceProcessEvents
| where FileName == "powershell.exe" or FileName == "pwsh.exe"
| where ProcessCommandLine has_any (
"-enc", "-encodedcommand", "bypass", "hidden",
"downloadstring", "invoke-webrequest", "iex",
"invoke-expression", "Net.WebClient"
)
| project TimeGenerated, DeviceName, AccountName,
ProcessCommandLine, InitiatingProcessFileName💡 Note: High noise in dev environments. Combine with user risk score for better signal.
New Service Created via sc.exe
FREET1543.003 — Create or Modify System Process: Windows Service
Detects service creation using sc.exe — a common persistence mechanism used by attackers and malware.
title: New Service Created via sc.exe
status: experimental
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: '\sc.exe'
CommandLine|contains: 'create'
condition: selection
level: medium💡 Note: Filter out known deployment tools (SCCM, Intune) to reduce false positives.
Outbound Data Transfer Spike
FREET1048 — Exfiltration Over Alternative Protocol
Identifies hosts transferring unusually large amounts of data outbound — potential exfiltration.
CommonSecurityLog
| where DeviceAction == "allow"
| where DestinationIP !startswith "10." and DestinationIP !startswith "192.168."
| summarize TotalBytes = sum(SentBytes) by SourceIP, bin(TimeGenerated, 1h)
| where TotalBytes > 500000000
| project TimeGenerated, SourceIP, TotalBytesMB = TotalBytes / 1048576💡 Note: 500MB threshold — adjust for your baseline. Exclude known backup and update servers.
Azure AD Impossible Travel
FREET1078 — Valid Accounts
Detects sign-ins from geographically distant locations within a short time window — indicates compromised credentials.
SigninLogs
| where ResultType == "0"
| extend City = tostring(LocationDetails.city),
Country = tostring(LocationDetails.countryOrRegion)
| summarize Locations = make_set(Country),
Cities = make_set(City),
Count = count()
by UserPrincipalName, bin(TimeGenerated, 30m)
| where array_length(Locations) > 1💡 Note: Enrich with VPN/proxy IP lists to reduce false positives from corporate VPN.
Ransomware – Mass File Encryption Pattern
🔒 PROT1486 — Data Encrypted for Impact
Detects rapid file rename operations with known ransomware extensions — indicates active encryption in progress.
DeviceFileEvents
| where ActionType == "FileRenamed"
| where FileName has_any...💡 Note: Critical severity — trigger immediate SOC escalation. Pair with network isolation automation.
Lateral Movement – PsExec Remote Execution
🔒 PROT1021.002 — Remote Services: SMB/Windows Admin Shares
Detects PsExec-style remote service creation — the most common lateral movement technique in enterprise breaches.
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("psexec.exe","psex...💡 Note: High confidence. PsExec in production is almost always suspicious. Whitelist IT tooling explicitly.
Privilege Escalation – Token Manipulation
🔒 PROT1134.001 — Access Token Manipulation: Token Impersonation
Detects access token impersonation techniques commonly used to escalate from user to SYSTEM.
title: Token Impersonation via Known Tools
status: experimental
logsource:
...💡 Note: Near-zero false positive rate. Detection of these tools almost always indicates compromise.
Phishing – OAuth Consent Grant Attack
🔒 PROT1528 — Steal Application Access Token
Detects when a user grants consent to a suspicious OAuth application — common in modern phishing campaigns.
AuditLogs
| where OperationName == "Consent to application"
| extend AppName ...💡 Note: Critical — consent grants can give full mailbox access. Investigate immediately and revoke if unauthorized.
Cloud – S3 Bucket Made Public
🔒 PROT1530 — Data from Cloud Storage
Detects when an S3 bucket ACL is changed to public — immediate data exposure risk.
index=aws sourcetype=aws:cloudtrail
eventName=PutBucketAcl OR eventName=Put...💡 Note: Immediate response required. Auto-remediate with Lambda if possible.
Credential Dumping – LSASS Access
🔒 PROT1003.001 — OS Credential Dumping: LSASS Memory
Detects processes accessing LSASS memory — the primary technique for credential harvesting on Windows.
DeviceProcessEvents
| where FileName in~ ("mimikatz.exe","procdump.exe",
...💡 Note: High confidence. Any LSASS access outside of AV/EDR is suspicious. Trigger immediate investigation.
Defense Evasion – Disable Windows Defender
🔒 PROT1562.001 — Impair Defenses: Disable or Modify Tools
Detects attempts to disable or tamper with Windows Defender via PowerShell, registry, or Group Policy.
DeviceProcessEvents
| where ProcessCommandLine has_any (
"Set-MpPreferenc...💡 Note: Almost always malicious unless done by authorized IT during maintenance windows.
Lateral Movement – RDP from Unusual Source
🔒 PROT1021.001 — Remote Services: Remote Desktop Protocol
Detects RDP connections from internal hosts that don't normally initiate RDP — potential lateral movement.
index=windows EventCode=4624 LogonType=10
| stats count by src_ip, dest, Acco...💡 Note: Requires building an RDP baseline lookup first. High value once baseline is established.
Persistence – Scheduled Task via schtasks
🔒 PROT1053.005 — Scheduled Task/Job: Scheduled Task
Detects creation of scheduled tasks via command line — common persistence technique across all threat actors.
title: Scheduled Task Creation via schtasks.exe
status: stable
logsource:
c...💡 Note: Filter SYSTEM-created tasks to reduce noise. Focus on tasks created by regular user accounts.
Unlock the full Detection Library.
Get access to all 14 detection rules — production-ready queries you can deploy today across KQL, Sigma, and Splunk.