Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
379 detections
Filters
Last updated
All Time
Detection languages
176
103
35
17
13
Contributors
101
57
49
42
31
Categories
20,425
11,812
5,870
5,145
4,864
Platforms
346
32
4
1
1
Products / Services
123
84
54
31
25
MITRE Techniques
241
192
169
163
156
CVEs
6
4
2
2
2
Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for security enthusiasts to learn and polish their exploitation skills at Kernel level and often abused by threat actors
Expanding on DeviceEvents output with Attack Surface Reduction (ASR) rule descriptions.
The ActionType values of the ASR events already explain what rule was matched and if it was audited or blocked.
However, it could still be useful to have a more human-friendly description in the results.
Also, this query is a good example for how you could define your own lookup tables and join with them.
The events in the DeviceEvents table contain a GUID for the various ASR rules rather than a full description of the rule.
This query will create a table which has the description for each ASR rule as per https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.
This table is then joined to the output of a query against the DeviceEvents table and shows a summary count of the events by the newly defined description.
This query shows the ability to use joins and custom dimension tables.
See https://docs.loganalytics.io/docs/Language-Reference/Tabular-operators/join-operator for more information on the join syntax.
For more questions on this query, feel free to ping @FlyingBlueMonki on twitter or mattegen@microsoft.com via email.
First lets start by creating a table of the rule descriptions to rule guids.
The ActionType values of the ASR events already explain what rule was matched and if it was audited or blocked.
However, it could still be useful to have a more human-friendly description in the results.
Also, this query is a good example for how you could define your own lookup tables and join with them.
The events in the DeviceEvents table contain a GUID for the various ASR rules rather than a full description of the rule.
This query will create a table which has the description for each ASR rule as per https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.
This table is then joined to the output of a query against the DeviceEvents table and shows a summary count of the events by the newly defined description.
This query shows the ability to use joins and custom dimension tables.
See https://docs.loganalytics.io/docs/Language-Reference/Tabular-operators/join-operator for more information on the join syntax.
For more questions on this query, feel free to ping @FlyingBlueMonki on twitter or mattegen@microsoft.com via email.
First lets start by creating a table of the rule descriptions to rule guids.
This analytic identifies drivers being loaded across the fleet by leveraging a PowerShell script to capture driver data. It helps monitor for unauthorized or malicious drivers that could compromise system integrity, execute arbitrary code, escalate privileges, or maintain persistence within the environment.
Detects the load of the signed poortry driver used by UNC3944 as reported by Mandiant and Sentinel One.
Detects a driver load from a temporary directory
Detects loading of known malicious drivers via the file name of the drivers.
Detects Obfuscated Powershell via use Rundll32 in Scripts
Detects Obfuscated use of Environment Variables to execute PowerShell
Locate vulnerable Gigabyte drivers used by RobbinHood ransomware to turn off security tools.
Detects powershell script installed as a Service
Detects the load of a legitimate signed driver named HW.sys by often used by threat actors or malware for privilege escalation
Detects the load of the vulnerable Dell BIOS update driver as reported in CVE-2021-21551
Detects the load of a signed and vulnerable AVAST Anti Rootkit driver often used by threat actors or malware for stopping and disabling AV and EDR products
Detects driver load of the System Informer tool
Detects driver load of the Process Hacker tool
Detects loading of known malicious drivers via their hash.
Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation
Detects Obfuscated Powershell via COMPRESS OBFUSCATION
Detects Obfuscated Powershell via RUNDLL LAUNCHER
Detects Obfuscated use of Clip.exe to execute PowerShell
Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques
Page 16 of 19