Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,155 detections
Filters
Last updated
All Time
Detection languages
2,301
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
2,858
2,017
816
524
213
Products / Services
1,336
1,144
831
576
366
MITRE Techniques
1,822
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
'Any Alerts that fired on any host with this same process in the range of +-1d'
Query for links opened from mail apps - if a detection occurred right afterwards.
As there are many links opened from mails, to have a successful hunt we should have some filter or join with some other signal,.
Such as suspicious processes, network connections, etc.
Therefore, in this example, we query for alerts that might be related to links sent via email.
This could be indicative of a phishing or spear-phishing attacks.
Tags: #EmailLink, #Phishing, #GetNearbyAlerts.
Explaining the underlying data:.
This query uses the BrowserLaunchedToOpenUrl event, that includes clicks on http:// or https:// links (clicks outside of browsers), or on .lnk files.
For this event, RemoteUrl contains the opened URL.
As there are many links opened from mails, to have a successful hunt we should have some filter or join with some other signal,.
Such as suspicious processes, network connections, etc.
Therefore, in this example, we query for alerts that might be related to links sent via email.
This could be indicative of a phishing or spear-phishing attacks.
Tags: #EmailLink, #Phishing, #GetNearbyAlerts.
Explaining the underlying data:.
This query uses the BrowserLaunchedToOpenUrl event, that includes clicks on http:// or https:// links (clicks outside of browsers), or on .lnk files.
For this event, RemoteUrl contains the opened URL.
Query 1 shows you any network communication happened from endpoints to a specific Remote IP or Remote URL.
Ensure to update RemoteIP and RemoteURL variable.
For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com by email.
Ensure to update RemoteIP and RemoteURL variable.
For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com by email.
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
'This rule identifies a web request with a user agent header known to belong to a crypto miner. This indicates a crypto miner may have infected the client machine.<br>You can add custom crypto mining indicating User-Agent headers using a watchlist, for more information refer to the [UnusualUserAgents Watchlist](https://aka.ms/ASimUnusualUserAgentsWatchlist).<br><br> This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM WebSession schema (ASIM WebSession Schema)'
This query looks for signs of impacket wmiexec module usage. May hit other wmi execution-like techniques too.
Author: Jouni Mikkola
More info: https://threathunt.blog/impacket-part-2/
Author: Jouni Mikkola
More info: https://threathunt.blog/impacket-part-2/
This query is looking for regsvr32.exe or rundll32.exe loading DLL images with other extensions than .dll.
Joins the data to public network events.
References:
https://threathunt.blog/running-live-malware-for-threat-hunting-purposes/
Joins the data to public network events.
References:
https://threathunt.blog/running-live-malware-for-threat-hunting-purposes/
Detects a rundll32 that communicates with public IP addresses
Detects suspicious connections from Microsoft Sync Center to non-private IPs.
Detects a network connection that is initiated by the "notepad.exe" process.
This might be a sign of process injection from a beacon process or something similar.
Notepad rarely initiates a network communication except when printing documents for example.
This might be a sign of process injection from a beacon process or something similar.
Notepad rarely initiates a network communication except when printing documents for example.
Detects a "winlogon.exe" process that initiate network communications with public IP addresses
Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder.
Detects a network connection initiated by Cmstp.EXE
Its uncommon for "cmstp.exe" to initiate an outbound network connection. Investigate the source of such requests to determine if they are malicious.
Its uncommon for "cmstp.exe" to initiate an outbound network connection. Investigate the source of such requests to determine if they are malicious.
Detects a network connection initiated from a process located in the "C:\Users\Public" folder.
Attacker are known to drop their malicious payloads and malware in this directory as its writable by everyone.
Use this rule to hunt for potential suspicious or uncommon activity in your environement.
Attacker are known to drop their malicious payloads and malware in this directory as its writable by everyone.
Use this rule to hunt for potential suspicious or uncommon activity in your environement.
Detects network connections from "dfsvc.exe" used to handled ClickOnce applications to non-local IPs
Detects a network connection that was initiated from a PowerShell process.
Often times malicious powershell scripts download additional payloads or communicate back to command and control channels via uncommon ports or IPs.
Use this rule as a basis for hunting for anomalies.
Often times malicious powershell scripts download additional payloads or communicate back to command and control channels via uncommon ports or IPs.
Use this rule as a basis for hunting for anomalies.
Detects suspicious "epmap" connection to a remote computer via remote procedure call (RPC)
Detects a possible remote connections to Silenttrinity c2
Page 227 of 246