Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
3
Contributors
2
1
Categories
1
1
1
1
1
Platforms
1
1
1
Products / Services
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
KQL Query from file: MS Teams DLP Playbook
'This rule identifies a web request to a URL that holds a file type, including .ps1, .bat, .vbs, and .scr that can be harmful if downloaded. This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM WebSession schema (ASIM WebSession Schema)'
This query was originally published in the threat analytics report, Sysrv botnet evolution.
Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptocurrency.
The following query finds instances of the attacker attempting to stop the AppArmor network security service on devices running Linux.
Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptocurrency.
The following query finds instances of the attacker attempting to stop the AppArmor network security service on devices running Linux.