Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,155 detections
Filters
Last updated
All Time
Detection languages
2,301
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
2,858
2,017
816
524
213
Products / Services
1,336
1,144
831
576
366
MITRE Techniques
1,822
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
'This query combines different Storage alerts with CommonSecurityLogs and AuditLogs helping analysts investigate any possible storage related attacks faster
thus reducing Mean Time To Respond'
thus reducing Mean Time To Respond'
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Looks for a logon domain in the Microsoft Entra ID logs, encoded with the same DGA encoding used in the Nobelium campaign.
See Important steps for customers to protect themselves from recent nation-state cyberattacks for more on the Nobelium campaign (formerly known as Solorigate).
This query is inspired by an Azure Sentinel detection.
References:
https://blogs.microsoft.com/on-the-issues/2020/12/13/customers-protect-nation-state-cyberattacks/
https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Hunting%20Queries/DnsEvents/Solorigate-Encoded-Domain-URL.yaml
See Important steps for customers to protect themselves from recent nation-state cyberattacks for more on the Nobelium campaign (formerly known as Solorigate).
This query is inspired by an Azure Sentinel detection.
References:
https://blogs.microsoft.com/on-the-issues/2020/12/13/customers-protect-nation-state-cyberattacks/
https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Hunting%20Queries/DnsEvents/Solorigate-Encoded-Domain-URL.yaml
This query looks for a large number of network-based authentications using local credentials coming from a single source IP address. High counts of logons involving a large number of distinct machines may identify an attacker beachhead within an enterprise.
Detects suspicious "epmap" connection to a remote computer via remote procedure call (RPC)
Detects a network connection initiated by programs or processes running from suspicious or uncommon files system locations.
Detects Non-Standard tools initiating a connection over port 3389 indicating possible lateral movement.
An initial baseline is required before using this utility to exclude third party RDP tooling that you might use.
An initial baseline is required before using this utility to exclude third party RDP tooling that you might use.
C2-NamedPipe
KQL
Detects the creation of a named pipe used by known APT malware.
Reference - https://docs.microsoft.com/openspecs/windows_protocols/ms-wpo/4de75e21-36fd-440a-859b-75accc74487c
Reference - https://docs.microsoft.com/openspecs/windows_protocols/ms-wpo/4de75e21-36fd-440a-859b-75accc74487c
Detects a network connection initiated from a process located in the "C:\Users\Public" folder.
Attacker are known to drop their malicious payloads and malware in this directory as its writable by everyone.
Use this rule to hunt for potential suspicious or uncommon activity in your environement.
Attacker are known to drop their malicious payloads and malware in this directory as its writable by everyone.
Use this rule to hunt for potential suspicious or uncommon activity in your environement.
The following analytic detects the execution of rundll32.exe with command-line arguments loading davclnt.dll and the davsetcookie function to access a remote WebDav instance. It uses data from Endpoint Detection and Response (EDR) agents, correlating process execution and network traffic data. This activity is significant as it may indicate exploitation of CVE-2023-23397, a known vulnerability. If confirmed malicious, this could allow an attacker to establish unauthorized remote connections, potentially leading to data exfiltration or further network compromise.
'This query detects lateral movement using GPO scheduled task usually used to deploy ransomware at scale.
It monitors whether a scheduled task is modified within the Sysvol folder in GPO.
Ref: https://bogusecurity.com/2019/12/26/persistence-and-execution-at-scale-via-gpo-scheduled-task/'
It monitors whether a scheduled task is modified within the Sysvol folder in GPO.
Ref: https://bogusecurity.com/2019/12/26/persistence-and-execution-at-scale-via-gpo-scheduled-task/'
Detects incoming connections to AnyDesk. This could indicate a potential remote attacker trying to connect to a listening instance of AnyDesk and use it as potential command and control channel.
Detects executables located in potentially suspicious directories initiating network connections towards file sharing domains.
Detects a network connection initiated by an "Msiexec.exe" process over port 80 or 443.
Adversaries might abuse "msiexec.exe" to install and execute remotely hosted packages.
Use this rule to hunt for potentially anomalous or suspicious communications.
Adversaries might abuse "msiexec.exe" to install and execute remotely hosted packages.
Use this rule to hunt for potentially anomalous or suspicious communications.
Detects a network connection initiated by "Regsvr32.exe"
Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account.
This could potentially indicates a remote PowerShell connection.
This could potentially indicates a remote PowerShell connection.
Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443
Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.
Detects an RDP connection originating from a domain controller.
This query identifies files that are copied to a device over SMB, then executed within a
specified threshold. Default is 5 seconds, but is configurable by tweaking the value for
ToleranceInSeconds.
specified threshold. Default is 5 seconds, but is configurable by tweaking the value for
ToleranceInSeconds.
The analytic detects a suspicious process making DNS queries to known, abused web services such as text-paste sites, VoIP, secure tunneling, instant messaging, and digital distribution platforms. This detection leverages Sysmon logs with Event ID 22, focusing on specific query names. This activity is significant as it may indicate an adversary attempting to download malicious files, a common initial access technique. If confirmed malicious, this could lead to unauthorized code execution, data exfiltration, or further compromise of the target host.
Page 225 of 246