Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
120 detections
Filters
Last updated
All Time
Detection languages
76
22
12
8
1
Contributors
19
16
15
13
10
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
82
32
15
8
7
Products / Services
29
20
13
10
8
MITRE Techniques
32
31
26
20
16
CVEs
5
5
5
5
1
This query will provide a report of many of the best practice configurations for Defender ATP deployment. Special Thanks to Gilad Mittelman for the initial inspiration and concept.
Any tests which are reporting "BAD" as a result imply that the associated capability is not configured per best practice recommendation.
Any tests which are reporting "BAD" as a result imply that the associated capability is not configured per best practice recommendation.
This query finds anomalous models discovered
'This query will identify the Microsoft Defender Antivirus Security Intelligence version, Security Intelligence up to date value, Engine version, Engine up to date value, Product version (aka Platform version),Product (aka Platform) up to date value, Security Intelligence publish/build timestamp, Security intel refresh timestamp and provide a list of devices with these details.'
EmojiHunt
KQL
Did you know you can use Emojis in Windows?.
Read more here: https://davidzych.com/abusing-emoji-in-windows.
Check-out who in your organization has renamed his or her computer to a Pizza or to a smiling poop.
You might be amused by the results, or perhaps angry if one of your systems or scripts was broken by this...
Note: this query will also return some machines with non-English charcters that are not Emojis.
Credit for this query goes to miflower - thanks for bringing joy to our lives! :).
Read more here: https://davidzych.com/abusing-emoji-in-windows.
Check-out who in your organization has renamed his or her computer to a Pizza or to a smiling poop.
You might be amused by the results, or perhaps angry if one of your systems or scripts was broken by this...
Note: this query will also return some machines with non-English charcters that are not Emojis.
Credit for this query goes to miflower - thanks for bringing joy to our lives! :).
'This detection will go over the heartbeats received from the agents of Domain Controllers over the last hour, and will create alerts if the last heartbeats were received an hour ago.'
'Provides the Anti virus mode and device count falling under that AV mode.'
Detects when an attacker tries to hide from Sysmon by disabling or stopping it
'Provides the Engine version and total count of up to date devices, not up to date devices and count of devices whose status is not available relevant to the Engine version.'
'Provides the Platform version and total count of up to date devices, not up to date devices and count of devices whose status is not available relevant to the Platform version.'
This query searches for not onboarded devices with a specific Suffix
This query will count the number of devices in Defender ATP based
on their DNS suffix. For a full list of devices with the DNS
suffix, comment out or remove the last line.
on their DNS suffix. For a full list of devices with the DNS
suffix, comment out or remove the last line.
'Provides the Security Intelligence version and total count of up to date devices, not up to date devices and count of devices whose status is not available relevant to the security intelligence version.'
Get stats on ASR audit events - count events and machines per rule.
This query provides the most common services discovered
This query presents statistics on count and percentage of DeviceType out of total inventory
The following analytic detects the (re)initialization of the Linux audit daemon (auditd) by identifying log entries of type DAEMON_START. This event indicates that the audit subsystem has resumed logging after being stopped or has started during system boot. While DAEMON_START may be expected during reboots or legitimate configuration changes, it can also signal attempts to re-enable audit logging after evasion, or restarts with modified or reduced rule sets. Monitoring this event in correlation with DAEMON_END, DAEMON_ABORT, and auditctl activity provides visibility into the continuity and integrity of audit logs. Frequent or unexplained DAEMON_START events should be investigated, especially if they are not accompanied by valid administrative or system activity.
The following queries pivot from an IP address assigned to a machine to the relevant machine or logged-on users.
To read more about it, check out this post: https://techcommunity.microsoft.com/t5/What-s-New/Advanced-hunting-now-includes-network-adapters-information/m-p/224402#M74.
Query #1: get machines that have used a given local IP address at a given time - as configured on their network adapters.
To read more about it, check out this post: https://techcommunity.microsoft.com/t5/What-s-New/Advanced-hunting-now-includes-network-adapters-information/m-p/224402#M74.
Query #1: get machines that have used a given local IP address at a given time - as configured on their network adapters.
Find status change from Exposurelevel
Endpoint Inventory
Find endpoints with out of date Defender clients
Detects suspicious log entries in Linux log files
Page 5 of 6