Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
4
2
1
Contributors
3
2
1
1
Categories
3
2
1
1
1
Platforms
3
3
1
Products / Services
3
1
1
1
MITRE Techniques
18,109
15,617
12,574
8,386
6,207
KQL Query from file: Blob URI Unique Domain Count
'Looks for file uploads actions to Azure File and Blob Storage from known VPS provider network ranges.
This is not an exhaustive list of VPS provider ranges but covers some of the most prevalent providers observed.'
This is not an exhaustive list of VPS provider ranges but covers some of the most prevalent providers observed.'
Intent:
- Use MTP capability to look for insider threat potential risk indicators
- Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
Definition of Insider Threat:
"The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.
- Use MTP capability to look for insider threat potential risk indicators
- Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
Definition of Insider Threat:
"The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.
'This hunting query looks for anomalously large LA queries by users.'
This rule detects the creation of a Kubernetes container that includes a hostPath mount. A hostPath volume allows a directory or file from the node to be mounted directly into the container. Attackers with permissions to create pods can leverage writable hostPath volumes to perform container escapes, potentially gaining access to the underlying host node by using techniques like chroot.
This rule detects the mounting of a volume shadow copy, specifically looking for Event ID 98 from the Microsoft-Windows-Ntfs provider where the DeviceName contains 'HarddiskVolumeShadowCopy'. Adversaries may mount volume shadow copies to access files, including credential stores like the Security Account Manager (SAM) database, without directly interacting with the live file system, which can bypass some security controls.
This YARA rule detects the Lolkek ransomware by identifying specific byte sequences associated with its file encryption routines, volume discovery, and file discovery mechanisms. The rule looks for patterns related to encrypting files, finding logical volumes, and enumerating files, which are characteristic behaviors of ransomware.
