Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,155 detections
Filters
Last updated
All Time
Detection languages
2,301
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
2,858
2,017
816
524
213
Products / Services
1,336
1,144
831
576
366
MITRE Techniques
1,822
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
The following queries pivot from an IP address assigned to a machine to the relevant machine or logged-on users.
To read more about it, check out this post: https://techcommunity.microsoft.com/t5/What-s-New/Advanced-hunting-now-includes-network-adapters-information/m-p/224402#M74.
Query #1: get machines that have used a given local IP address at a given time - as configured on their network adapters.
To read more about it, check out this post: https://techcommunity.microsoft.com/t5/What-s-New/Advanced-hunting-now-includes-network-adapters-information/m-p/224402#M74.
Query #1: get machines that have used a given local IP address at a given time - as configured on their network adapters.
The following queries pivot from an IP address assigned to a machine to the relevant machine or logged-on users.
To read more about it, check out this post: https://techcommunity.microsoft.com/t5/What-s-New/Advanced-hunting-now-includes-network-adapters-information/m-p/224402#M74.
Query #1: get machines that have used a given local IP address at a given time - as configured on their network adapters.
To read more about it, check out this post: https://techcommunity.microsoft.com/t5/What-s-New/Advanced-hunting-now-includes-network-adapters-information/m-p/224402#M74.
Query #1: get machines that have used a given local IP address at a given time - as configured on their network adapters.
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Detects an initiated network connection over uncommon ports from "dfsvc.exe". dfsvc.exe is a utility used to handle ClickOnce applications. Adversaries may abuse ClickOnce to proxy execution of malicious code, and unexpected network connections from this process, especially on non-standard ports, could indicate malicious activity.
This query surfaces devices that are in a specific IPAddressV6 subnet
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Detects incoming network connections to the AnyDesk remote access application. This activity could indicate an adversary attempting to establish a remote command and control channel or gain unauthorized access to a system using a legitimate remote access tool.
Detects network communication patterns associated with the Turla ComRAT malware, specifically looking for HTTP/HTTPS requests containing '/index/index.php?h=' in the URI. This pattern is indicative of ComRAT's command and control (C2) communication.
This YARA rule detects the VanHelsing ransomware based on specific byte patterns associated with its file encryption routines, network enumeration capabilities, shadow copy deletion, and ransomware note dropping. The rule includes two main versions of the ransomware's functionality, indicating potential evolution or different variants.
This rule detects network connections initiated by a process over ports 5985 (HTTP) or 5986 (HTTPS), which are commonly used for Windows Remote Management (WinRM) and PowerShell Remoting. The rule specifically looks for these connections originating from non-network service accounts, as connections from such accounts could indicate a suspicious remote PowerShell session. It excludes connections from localhost and known legitimate antivirus processes to reduce false positives.
List all PnP Devices that have been allowed or blocked
Find all alert evidence for a single endpoint. This is handy for exporting to a third-party SIEM.
Detects remote RPC calls made by SharpHound, a BloodHound data collector, to enumerate remote connections and local group memberships. This specific rule targets the MS-SRVS protocol (Server Service Remote Protocol) interface UUID 4b324fc8-1670-01d3-1278-5a47bf6ee188 and operation number 12, which is associated with session enumeration.
This rule detects remote RPC calls to the Microsoft Directory Replication Service Remote Protocol (MS-DRSR) originating from hosts that are not designated as Domain Controllers. Such activity is highly indicative of potential DCSync or DCShadow attacks, where an attacker attempts to replicate Active Directory data, including sensitive credentials, by impersonating a Domain Controller. The rule specifically looks for RPC Firewall logs (EventLog: RPCFW, EventID: 3) where the InterfaceUuid matches 'e3514235-4b06-11d1-ab04-00c04fc2dcd2' (MS-DRSR) and the operation number (OpNum) is not 0, 1, or 12, as these are considered 'dangerous' opcodes when initiated from non-DC hosts.
Detects remote RPC calls used by SharpHound to map remote connections and local group membership. This rule specifically targets the MS-WKST protocol (Workstation Service Remote Protocol) interface UUID and operation number associated with SharpHound's reconnaissance activities.
This rule detects outbound network connections to IP addresses that have been observed for the first time within the last 24 hours. It specifically excludes connections to private IP address ranges (RFC1918). The detection relies on correlating current network connection events with historical 'first seen' data for IP addresses from an entity graph.
This rule detects attempts to execute files from external WebDAV shares. It specifically looks for HTTP GET requests where the User-Agent header starts with 'Microsoft-WebDAV-MiniRedir/' and the requested URI ends with common executable or script file extensions. This behavior is often observed in initial access campaigns where adversaries leverage WebDAV to deliver and execute malicious payloads.
This rule detects attempts to access domains that have been registered within the last 30 days. It correlates network HTTP or generic network connection events with WHOIS data to identify recently created domains. The rule leverages WHOIS enrichment to determine the creation time of the accessed domain and flags any access to domains created within the specified 30-day window.
Page 231 of 246