Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
268 detections
Filters
Last updated
All Time
Detection languages
166
53
14
9
9
Contributors
57
40
38
37
29
Categories
20,401
11,795
5,864
5,145
4,864
Platforms
253
15
11
5
5
Products / Services
160
108
35
14
14
MITRE Techniques
116
85
80
53
41
CVEs
6
2
1
1
1
IDS Classtypes
3
IDS Protocols
2
'Identifies anomolies in signin events based on the volume of signin events over time. Use this to identify suspicious authentication patterns such as spikes in activity or out of hours events.
Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor'
Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor'
'This query looks for Microsoft Defender AV detections related to Hive Ransomware.
In Microsoft Sentinel the SecurityAlerts table includes only the Device Name of the affected device, this query joins the DeviceInfo table to clearly connect other information such as Device group, ip, logged on users etc. This would allow the Microsoft Sentinel analyst to have more context related to the alert, if available.'
In Microsoft Sentinel the SecurityAlerts table includes only the Device Name of the affected device, this query joins the DeviceInfo table to clearly connect other information such as Device group, ip, logged on users etc. This would allow the Microsoft Sentinel analyst to have more context related to the alert, if available.'
This rule detects when the ASR rule AsrRansomwareBlocked or AsrRansomwareAudited is triggered.
No alert is generated by default. This could be the start of a ransomware attack.
Additional information available by Microsoft:
https://docs.microsoft.com/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide#use-advanced-protection-against-ransomware
No alert is generated by default. This could be the start of a ransomware attack.
Additional information available by Microsoft:
https://docs.microsoft.com/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide#use-advanced-protection-against-ransomware
This query will identify the Microsoft Defender Antivirus Engine version and Microsoft Defender Antivirus Security Intelligence version (and timestamp), Product update version (aka Platform Update version) as well as the Microsoft Defender Antivirus Mode on the endpoint (Active, Passive, etc.).
StrRAT is a Java-based remote access tool which steals browser credentials, logs keystrokes and take remote control of infected systems. It also has a module to download additional payload onto to the infected machine based on C2 server command. Additionally, this threat also has a ransomware encryption/decryption module which appends .crimson extension.
Query for Microsoft Defender Antivirus detections.
Query #1: Query for Antivirus detection events.
Query #1: Query for Antivirus detection events.
'This query looks for Microsoft Defender AV detections related to Dev-0530 actors.
In Microsoft Sentinel the SecurityAlerts table includes only the Device Name of the affected device, this query joins the DeviceInfo table to clearly connect other information such as Device group, ip, logged on users etc. This would allow the Microsoft Sentinel analyst to have more context related to the alert, if available.'
In Microsoft Sentinel the SecurityAlerts table includes only the Device Name of the affected device, this query joins the DeviceInfo table to clearly connect other information such as Device group, ip, logged on users etc. This would allow the Microsoft Sentinel analyst to have more context related to the alert, if available.'
'Provides the Engine version and total count of up to date devices, not up to date devices and count of devices whose status is not available relevant to the Engine version.'
'This query looks for file hashes and AV signatures associated with Prestige ransomware payload.'
'Identifies if an AV scan fails in Azure App Services.'
This query visualises total emails with Malware detections over time summarizing the data daily by various Malware detection technologies/controls.
'Identifies if an AV scan finds infected files in Azure App Services.'
This query shows the source of the AV detections (e.g., the website the file was downloaded from etc.).
Get the list of AV detections.
Get the list of AV detections.
'Provides the Platform version and total count of up to date devices, not up to date devices and count of devices whose status is not available relevant to the Platform version.'
This query looks for Microsoft Defender Antivirus detections related to EUROPIUM actor
Today MDE Alerts do not show PUA/WDAV ThreatName. This is a demonstration of how to get, for example, PUA Threat Names.
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
'This query looks for Microsoft Defender Antivirus detections with the family names used by KNOTWEED'
Total Controlled Folder Access events.
LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavior and escalated its operations in 2021. Today, beyond using resources for its traditional bot and mining activities, LemonDuck steals credentials, removes security controls, spreads via emails, moves laterally, and ultimately drops more tools for human-operated activity.
Detects antivirus alerts indicating the presence of exploitation frameworks or known offensive security tools. This rule emphasizes the importance of investigating such alerts, even if the malware is blocked, to understand the initial compromise vector.
Page 11 of 13