Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
65 detections
Filters
Last updated
All Time
Detection languages
37
16
5
5
1
Contributors
17
9
8
7
4
Categories
20,425
11,812
5,870
5,145
4,864
Platforms
38
14
10
5
3
Products / Services
19
15
8
6
5
MITRE Techniques
17
16
13
10
10
CVEs
1
KQL Query from file: The Hunt for Blob Phishing Mail Domain
KQL Query from file: M365 Copilot Gone Rouge
KQL Query from file: Threat Hunting - MDE Network Intrusion Discovery
KQL Query from file: Hunting Rogue Endpoints via SMB Detection
KQL Query from file: CVE-2024-3393 DDOS Detection
KQL Query from file: M365 Copilot Chat SafeLink Monitoring
KQL Query from file: KQL URL Protection Report
'Discover all critical ports from a list having rules like 'Any' for sourceIp, which means that they are opened to everyone. Critial ports should not be opened to everyone, and should be filtered.'
'Correlate IPs blocked by a Cisco firewall appliance with successful Microsoft Entra ID signins.
Because the IP was blocked by the firewall, that same IP logging on successfully to Entra ID is potentially suspect and could indicate credential compromise for the user account.'
Because the IP was blocked by the firewall, that same IP logging on successfully to Entra ID is potentially suspect and could indicate credential compromise for the user account.'
This query helps reviewing URL click count by ClickAction
'Identifies a match for XSS attack in the Application gateway WAF logs. The Threshold value in the query can be changed as per your infrastructure's requirement.
References: https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)'
References: https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)'
Get all filtering events done by the Windows filtering platform.
This includes any blocks done by Windows Firewall rules, but also blocks triggered by some 3rd party firewalls.
When no Firewall rules are configured, the default behavior is to block all incoming network connections.
This includes any blocks done by Windows Firewall rules, but also blocks triggered by some 3rd party firewalls.
When no Firewall rules are configured, the default behavior is to block all incoming network connections.
'Identifies when 20 or more failed attempts from a given client IP in 1 minute occur on the IIS server.
This could be indicative of an attempted brute force. This could also simply indicate a misconfigured service or device.
Recommendations: Validate that these are expected connections from the given Client IP. If the client IP is not recognized, potentially block these connections at the edge device.
If these are expected connections, verify the credentials are properly configured on the system, service, application or device that is associated with the client IP.
References:
IIS status code mapping: https://support.microsoft.com/help/943891/the-http-status-code-in-iis-7-0-iis-7-5-and-iis-8-0
Win32 Status code mapping: https://msdn.microsoft.com/library/cc231199.aspx'
This could be indicative of an attempted brute force. This could also simply indicate a misconfigured service or device.
Recommendations: Validate that these are expected connections from the given Client IP. If the client IP is not recognized, potentially block these connections at the edge device.
If these are expected connections, verify the credentials are properly configured on the system, service, application or device that is associated with the client IP.
References:
IIS status code mapping: https://support.microsoft.com/help/943891/the-http-status-code-in-iis-7-0-iis-7-5-and-iis-8-0
Win32 Status code mapping: https://msdn.microsoft.com/library/cc231199.aspx'
This query is designed to help troubleshoot connectivity issues to Microsoft Defender for Endpoint URLs.
It provides a summary of the number of failures which occurred, the number of distinct machines that failed
to connect to the URL, and sorts them by the sum of the overall number of failures recorded.
It provides a summary of the number of failures which occurred, the number of distinct machines that failed
to connect to the URL, and sorts them by the sum of the overall number of failures recorded.
Simple query to show the unique network connections that were audited or blocked by ExploitGuard.
For more questions on this query, feel free to ping @FlyingBlueMonki on twitter or mattegen@microsoft.com via email.
For more questions on this query, feel free to ping @FlyingBlueMonki on twitter or mattegen@microsoft.com via email.
The analytic identifies blocked scam-related activities detected by Zscaler within a network. It leverages web proxy logs to examine actions flagged as scam threats, focusing on data points such as device owner, user, URL category, destination URL, and IP. This detection is significant for SOC as it helps in the early identification and mitigation of scam activities, ensuring network safety. If confirmed malicious, this activity could indicate attempts to deceive users, potentially leading to data theft or financial loss.
The analytic identifies spikes in blocked outbound network connections originating from within an AWS environment. It uses VPC Flow Logs data from CloudWatch, specifically looking for 'blocked' actions from internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) to external destinations. A spike is determined by comparing the current number of blocked connections against a calculated baseline (average and standard deviation) over time. This detection is significant as it can indicate potential exfiltration attempts or misconfigurations leading to data leakage. If confirmed malicious, such activity could allow attackers to bypass network defenses, leading to unauthorized data transfer or communication with malicious external entities.
The analytic identifies blocked destinations within a network that are deemed privacy risks by Zscaler. It leverages web proxy logs, focusing on entries marked as "Privacy Risk." Key data points such as device owner, user, URL category, destination URL, and IP are analyzed. This activity is significant for a SOC as it helps monitor and manage privacy risks, ensuring a secure network environment. If confirmed malicious, this activity could indicate attempts to access or exfiltrate sensitive information, posing a significant threat to data privacy and security.
The analytic detects port security violations on Cisco switches by leveraging logs from Cisco network devices. It specifically looks for events with mnemonics indicating port security violations. This activity is significant because it indicates an unauthorized device attempting to connect to a secured port, potentially bypassing network access controls. If confirmed malicious, this could allow an attacker to gain unauthorized access to the network, leading to data exfiltration, network disruption, or further lateral movement within the environment.
The analytic identifies potential malware activities within a network that are blocked by Zscaler. It leverages web proxy logs to filter for blocked actions associated with malware, aggregating occurrences by user, URL, and threat category. This detection is significant for SOC as it highlights attempts to access malicious content, indicating potential compromise or targeted attacks. If confirmed malicious, this activity could signify an ongoing attempt to infiltrate the network, necessitating immediate investigation to prevent further threats and ensure network integrity.
The following analytic identifies significant legal liability threats blocked by the Zscaler web proxy. It uses web proxy logs to track destinations, device owners, users, URL categories, and actions associated with legal liability. By leveraging statistics on unique fields, it ensures a precise focus on these threats. This activity is significant for SOC as it helps enforce legal compliance and risk management. If confirmed malicious, it could indicate attempts to access legally sensitive or restricted content, potentially leading to legal repercussions and compliance violations.
Page 3 of 4