Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
31 detections
Filters
Last updated
All Time
Detection languages
22
5
3
1
Contributors
8
8
5
4
2
Categories
16
9
8
7
6
Platforms
20
12
3
3
Products / Services
10
6
5
4
4
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
Intent:
- Use MTP capability to look for insider threat potential risk indicators
- Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
Definition of Insider Threat:
"The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.
- Use MTP capability to look for insider threat potential risk indicators
- Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
Definition of Insider Threat:
"The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.
// Detect Active Directory service accounts that are not active because their last logon was more than 14 days ago
// Replace XXX on line 4 with the naming convention start of your Active Directory service accounts
// Replace XXX on line 4 with the naming convention start of your Active Directory service accounts
Added credential from country X and Signed-In from country Y in a pecific time window:
This query tries to find all applications that credentials were added to them from country X while the application's identity Signed-In from country Y in a specific time window.
This query tries to find all applications that credentials were added to them from country X while the application's identity Signed-In from country Y in a specific time window.
'This query looks at the last 14 days for "Consent to application" operation by a user/app which could potentially mean unauthorized access. Additional context is added from AuditLogs based on CorrleationId from the same account that performed the action.'
Services
KQL
Gets the service name from the registry key.
This rule detects the installation of the TacticalRMM agent service on a Windows system. It specifically looks for Event ID 7045 from the 'Service Control Manager' provider, indicating a service installation, and then checks if the 'ImagePath' contains 'tacticalrmm.exe' or the 'ServiceName' contains 'TacticalRMM Agent Service'. TacticalRMM is a legitimate remote monitoring and management (RMM) tool, but it can be abused by adversaries for remote access and control.
ServiceDLL Hijack
Sigma
Detects changes to the "ServiceDLL" value related to a service in the registry. This is often used as a method of persistence by adversaries to execute malicious payloads as part of persistence or privilege escalation. The rule specifically looks for modifications to the ServiceDll registry key within the Windows Services hive, while filtering out common legitimate modifications related to printing, domain controllers, and system updates.
This rule detects the Hybrid Connection Manager service running on a Windows endpoint. It specifically looks for Event IDs 40300, 40301, or 40302 in conjunction with keywords like 'HybridConnection', 'sb://', 'servicebus.windows.net', or 'HybridConnectionManage'. This service is used to connect on-premises resources to Azure services, and its activity could indicate legitimate cloud integration or potentially malicious use for persistence or data exfiltration.
This rule detects DNS queries made by the Azure Hybrid Connection Manager service to the Azure Service Bus service. This activity is considered suspicious because it could indicate an attempt to establish persistence or exfiltrate data through a compromised Hybrid Connection Manager, leveraging the Service Bus as a communication channel.
Identifies when a service principal is created in Azure. This activity can be an indicator of an adversary establishing persistence or preparing for further actions within the Azure environment.
Page 2 of 2