Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
268 detections
Filters
Last updated
All Time
Detection languages
166
53
14
9
9
Contributors
57
40
38
37
29
Categories
20,401
11,795
5,864
5,145
4,864
Platforms
253
15
11
5
5
Products / Services
160
108
35
14
14
MITRE Techniques
116
85
80
53
41
CVEs
6
2
1
1
1
IDS Classtypes
3
IDS Protocols
2
This rule detects if the Antivirus (AV) mode on a Windows device, as reported by DeviceTvmInfoGathering, is not set to '0'. A non-zero AvMode could indicate that the antivirus is not in a default or expected state, potentially suggesting a disabled or misconfigured AV.
Detection looks for Powershell used with various cmdlets used to add certain filetypes to Defender AV exclusion, they would normally be blocked upon execution in certain ways. Allows an actor to execute their own files that normally would be blocked.
KQL Query from file: Threat Intelligence Data from Sentinel UEBA
KQL Query from file: defendnot detection
KQL Query
This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams over time summarizing the data by the various Malware families detected focusing on built-in SharePoint AV detections
Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects a highly relevant Antivirus alert that reports ransomware.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
The query for malicious file creations via TOCTOU Vulnerability in Leading Endpoint Detection and Response (EDR) and Antivirus (AV) Solutions.
- Microsoft Defender (CVE-2022-37971)
- Defender for Endpoint (CVE-2022-37971)
- SentinelOne EDR
- TrendMicro Apex One (CVE-2022-45797)
- Avast Antivirus (CVE-2022-4173)
- AVG Antivirus (CVE-2022-4173)
- Microsoft Defender (CVE-2022-37971)
- Defender for Endpoint (CVE-2022-37971)
- SentinelOne EDR
- TrendMicro Apex One (CVE-2022-45797)
- Avast Antivirus (CVE-2022-4173)
- AVG Antivirus (CVE-2022-4173)
Query for SmartScreen application blocks on files with "Malicious" reputation, where the user has decided to run the malware nontheless.
Read more about SmartScreen here: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.
Data availability: These events are available only on Windows 10 version 1703 and onwards.
Tags: #SmartScreen.
Read more about SmartScreen here: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.
Data availability: These events are available only on Windows 10 version 1703 and onwards.
Tags: #SmartScreen.
This query will provide a report of many of the best practice configurations for Defender ATP deployment. Special Thanks to Gilad Mittelman for the initial inspiration and concept.
Any tests which are reporting "BAD" as a result imply that the associated capability is not configured per best practice recommendation.
Any tests which are reporting "BAD" as a result imply that the associated capability is not configured per best practice recommendation.
Detects a highly relevant Antivirus alert that reports a password dumper.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects a highly relevant Antivirus alert that reports an exploitation framework.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects an Antivirus alert in a highly relevant file path or with a relevant file name.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Graph of MDO detections trended over time
Pivot from downloads detected by Windows Defender Antivirus to other files downloaded from the same sites.
To learn more about the download URL info that is available and see other sample queries,.
Check out this blog post: https://techcommunity.microsoft.com/t5/Threat-Intelligence/Hunting-tip-of-the-month-Browser-downloads/td-p/220454.
To learn more about the download URL info that is available and see other sample queries,.
Check out this blog post: https://techcommunity.microsoft.com/t5/Threat-Intelligence/Hunting-tip-of-the-month-Browser-downloads/td-p/220454.
Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 .
Detects a highly relevant Antivirus alert that reports a web shell.
It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big WebShell repository from e.g. github and checking the matches.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big WebShell repository from e.g. github and checking the matches.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This query make a best-guess detection regarding which removable media device caused an AV detection.
The query is best run over 30 days to get the full USB history.
Get a list of USB AV detections. This assumes any path not beginning with C is a removable/USB device.
The query is best run over 30 days to get the full USB history.
Get a list of USB AV detections. This assumes any path not beginning with C is a removable/USB device.
Query for Microsoft Defender Antivirus detections.
Query #1: Query for Antivirus detection events.
Query #1: Query for Antivirus detection events.
'This query looks for Microsoft Defender AV detections related to Europium actor.
In Microsoft Sentinel the SecurityAlerts table includes only the Device Name of the affected device, this query joins the DeviceInfo table to clearly connect other information such as Device group, ip, etc. This would allow the Microsoft Sentinel analyst to have more context related to the alert, if available.
Reference: https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government '
In Microsoft Sentinel the SecurityAlerts table includes only the Device Name of the affected device, this query joins the DeviceInfo table to clearly connect other information such as Device group, ip, etc. This would allow the Microsoft Sentinel analyst to have more context related to the alert, if available.
Reference: https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government '
Page 10 of 13