Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
228 detections
Filters
Last updated
All Time
Detection languages
192
13
9
6
5
Contributors
70
39
34
22
15
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
191
50
12
11
10
Products / Services
196
33
25
24
7
MITRE Techniques
141
127
107
70
56
CVEs
2
IDS Classtypes
6
2
1
IDS Protocols
9
This query provides insights on the detections done by Safe Attachment detections
JNLP file extensions are an uncommon file type often used to deliver malware.
This query was originally published in the threat analytics report, Adwind utilizes Java for cross-platform impact.
Adwind is a remote access tool (RAT) that takes advantage of the cross-platform capabilities of the Java framework. It can check which operating system a target is running and adapt accordingly, allowing it to successfully compromise both Windows and macOS devices.
The query below must be run in Microsoft Defender XDR. This query detects events where a single Java archive, or JAR file, was attached to an incoming email. Since Adwind is distributed as a JAR file, this can help detect the initial access stage of a Adwind attack. Note that, although the behavior detected by this query is typical of attacks that use Adwind malware, unrelated attacks may use the same or similar techniques. Also note that JAR attachments are not necessarily or even often malware, and that further research will be needed to determine if query results are associated with malicious behavior.
See Hiding a Java class file for an additional query that detects behavior associated with Adwind attacks.
Adwind is a remote access tool (RAT) that takes advantage of the cross-platform capabilities of the Java framework. It can check which operating system a target is running and adapt accordingly, allowing it to successfully compromise both Windows and macOS devices.
The query below must be run in Microsoft Defender XDR. This query detects events where a single Java archive, or JAR file, was attached to an incoming email. Since Adwind is distributed as a JAR file, this can help detect the initial access stage of a Adwind attack. Note that, although the behavior detected by this query is typical of attacks that use Adwind malware, unrelated attacks may use the same or similar techniques. Also note that JAR attachments are not necessarily or even often malware, and that further research will be needed to determine if query results are associated with malicious behavior.
See Hiding a Java class file for an additional query that detects behavior associated with Adwind attacks.
In this query, we are looking for emails containing malware attachment sent by an internal sender
This query helps reviewing list of top 10 URL domains attacking the organization
This query helps reviewing top targeted users with malware or phishing emails in an organization in last 30 days
This query helps in reviewing malicious emails allowed due to user overrides
This query helps reviewing malware detections by detection methods
URLs clicked in Email
This analytic detects emails containing attachments with suspicious file extensions. It leverages the Email data model in Splunk, using the tstats command to identify emails where the attachment filename is not empty. This detection is significant for SOC analysts as it highlights potential phishing or malware delivery attempts, which are common vectors for data breaches and malware infections. If confirmed malicious, this activity could lead to unauthorized access to sensitive information, system compromise, or data exfiltration. Immediate review and analysis of the identified emails and attachments are crucial to mitigate these risks.
This analytic detects email attachments with an unusually high number of spaces in their file names, which is a common tactic used by attackers to obfuscate file extensions. It leverages the Email data model to identify attachments where the ratio of spaces to the total file name length exceeds 10%. This behavior is significant as it may indicate an attempt to bypass security filters and deliver malicious payloads. If confirmed malicious, this activity could lead to the execution of harmful code or unauthorized access to sensitive information within the recipient's environment.
The following analytic identifies when a suspicious email is detected within the Microsoft Office 365 ecosystem through the Advanced Threat Protection engine and delivered to an end user. Attackers may execute several attacks through email, any detections from built-in Office 365 capabilities should be monitored and responded to appropriately. Certain premium Office 365 capabilities such as Safe Attachment and Safe Links further enhance these detection and response functions.
This analytic identifies when a malicious file is detected within the Microsoft Office 365 ecosystem by the Advanced Threat Protection (ATP) engine. Attackers often stage and execute malicious files from within cloud environments like Office 365. Monitoring detections from built-in Office 365 capabilities, such as those enhanced by Safe Attachments and Safe Links, is crucial for identifying and responding to threats.
This analytic detects suspicious attachment file extensions in GSuite emails, potentially indicating a spear-phishing attack. It leverages GSuite Gmail logs to identify emails with attachments having file extensions commonly associated with malware, such as .exe, .bat, and .js. This activity is significant as these file types are often used to deliver malicious payloads, posing a risk of compromising targeted machines. If confirmed malicious, this could lead to unauthorized code execution, data breaches, or further network infiltration.
The analytic detects when Microsoft's Zero-hour Auto Purge (ZAP) capability takes action against a user's mailbox. ZAP is an enhanced protection feature that retroactively removes emails with known malicious content from user inboxes. This detection indicates that a malicious email was initially delivered to a user's inbox but was subsequently removed by ZAP. While ZAP helps mitigate threats, it also signifies that there was a window during which the user could have been exposed to the malicious content.
This analytic detects when an email reported by a user in Microsoft 365 using the built-in report button is subsequently found to be malicious. Specifically, it looks for submissions that receive a 'Phish' or 'Malware' verdict from Microsoft's analysis.
The following analytic identifies Gsuite emails with suspicious subjects and attachments commonly used in spear phishing attacks. It leverages Gsuite email logs, focusing on specific keywords in the subject line and known malicious file types in attachments. This activity is significant for a SOC as spear phishing is a prevalent method for initial compromise, often leading to further malicious actions. If confirmed malicious, this activity could result in unauthorized access, data exfiltration, or further malware deployment, posing a significant risk to the organization's security.
This analytic detects when an email manually submitted to Microsoft through the Security & Compliance portal is found to be malicious. This capability is an enhanced protection feature that can be used within O365 tenants by administrative users to report potentially malicious emails. This correlation looks for any submission that returns a Phish or Malware verdict upon submission.
Page 11 of 11