Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
159 detections
Filters
Last updated
All Time
Detection languages
91
23
18
7
7
Contributors
46
40
17
14
9
Categories
20,402
11,796
5,865
5,145
4,864
Platforms
73
63
17
16
10
Products / Services
52
41
27
26
25
MITRE Techniques
48
46
37
28
27
CVEs
11
3
3
2
1
IDS Classtypes
6
1
IDS Protocols
7
'This hunting query uses Application events from the "MSSQL$MICROSOFT##WID" provider to collect SQL statements run against an AD FS database (e.g Windows Internal Database (WID)).
A threat actor might want to extract the AD FS data configuration settings with a SQL statement or modify it with an UPDATE SQL statement.
In order to use this query you need to create a server audit and database audit specification on your AD FS database.
Reference: https://github.com/Azure/SimuLand/blob/main/3_simulate_detect/credential-access/exportADFSTokenSigningCertificate.md
Reference: https://o365blog.com/post/adfs/
'
A threat actor might want to extract the AD FS data configuration settings with a SQL statement or modify it with an UPDATE SQL statement.
In order to use this query you need to create a server audit and database audit specification on your AD FS database.
Reference: https://github.com/Azure/SimuLand/blob/main/3_simulate_detect/credential-access/exportADFSTokenSigningCertificate.md
Reference: https://o365blog.com/post/adfs/
'
'This hunting query looks for users who are running multiple queries that return either a very large
amount of data or the maximum amount allowed by the query method.'
amount of data or the maximum amount allowed by the query method.'
'This hunting query looks for users who have run queries that have not previously been seen running queries.'
Detects the invocation of MS SQL transactions that are destructive towards table or database data, such as "DROP TABLE", "DROP DATABASE", or "TRUNCATE TABLE". These operations can lead to data loss and impact system availability.
Detects the invocation of MS SQL transactions that are destructive towards table or database data, such as "DROP TABLE" or "DROP DATABASE".
Detects suspicious SQL query keywords that are often used during reconnaissance, data exfiltration, or destructive activities. This includes keywords like 'drop', 'truncate', 'dump', and 'select *', which can indicate attempts to manipulate database structures, extract sensitive information, or perform denial-of-service attacks.
This rule detects suspicious error messages generated by various SQL database systems (Oracle, MySQL, SQL Server, SQLite) that are indicative of an attempted SQL injection attack. The rule looks for specific syntax error messages that are commonly returned when an attacker probes for SQL injection vulnerabilities.
This rule detects the execution of the 'xp_cmdshell' stored procedure within Microsoft SQL Server. 'xp_cmdshell' allows SQL Server to execute operating system commands directly, which is a common technique used by attackers for privilege escalation, lateral movement, and persistence within a compromised environment. The detection specifically looks for EventID 33205 in the application log, indicating a SQL Server event, and checks for the presence of 'object_name:xp_cmdshell' and 'statement:EXEC' in the event data, confirming the execution of this procedure.
Detects potentially suspicious SQL queries executed via sqlcmd.exe targeting Veeam backup databases. The rule specifically looks for commands that attempt to query sensitive tables such as BackupRepositories, Backups, Credentials, HostCreds, SmbFileShares, Ssh_creds, and VSphereInfo, which could indicate an attempt to steal information from the Veeam backup infrastructure.
Detects the execution of `sqlcmd.exe` with command-line arguments indicative of database enumeration or backup activities, specifically targeting common system databases and processes. This pattern has been associated with Conti ransomware for dumping database contents.
Detects when an attacker calls the "ALTER SERVER AUDIT" or "DROP SERVER AUDIT" transaction in order to delete or disable audit logs on the server. This action is a strong indicator of an adversary attempting to evade detection by tampering with logging mechanisms.
Detects when a Google Cloud SQL database instance or its user accounts are created, deleted, or modified. This can indicate malicious activity such as data destruction, unauthorized access attempts, or attempts to disrupt services.
Page 8 of 8