Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
25 detections
Filters
Last updated
All Time
Detection languages
22
2
1
Contributors
19
1
1
1
1
Categories
18
11
5
3
3
Platforms
18
3
3
1
1
Products / Services
12
9
5
3
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
This rule identifies recurring antivirus detections on endpoints, specifically filtering out common false positives originating from browser cache directories. It aggregates detections by device, threat name, and device ID, and flags instances where the same threat has been detected on at least two distinct days within a 30-day lookback period. This helps to highlight persistent malware issues rather than transient or benign detections.
This rule detects instances where an antivirus scan has been cancelled on a device. It specifically looks for 'AntivirusScanCancelled' actions in device events and extracts the 'ScanTypeIndex' from additional fields to provide context on the type of scan that was cancelled. This could indicate an attempt to evade detection by disabling security software.
This detection identifies attempts to disable or tamper with Microsoft Defender Antivirus using common command-line tools. This is a frequent defense evasion technique used by threat actors, including those exploiting SharePoint vulnerabilities, to operate undetected on a compromised host.
KQL Query
This query will provide a report of many of the best practice configurations for Defender ATP deployment. Special Thanks to Gilad Mittelman for the initial inspiration and concept.
Any tests which are reporting "BAD" as a result imply that the associated capability is not configured per best practice recommendation.
Any tests which are reporting "BAD" as a result imply that the associated capability is not configured per best practice recommendation.
'This query will identify the Microsoft Defender Antivirus Security Intelligence version, Security Intelligence up to date value, Engine version, Engine up to date value, Product version (aka Platform version),Product (aka Platform) up to date value, Security Intelligence publish/build timestamp, Security intel refresh timestamp and provide a list of devices with these details.'
Pivot from downloads detected by Windows Defender Antivirus to other files downloaded from the same sites.
To learn more about the download URL info that is available and see other sample queries,.
Check out this blog post: https://techcommunity.microsoft.com/t5/Threat-Intelligence/Hunting-tip-of-the-month-Browser-downloads/td-p/220454.
To learn more about the download URL info that is available and see other sample queries,.
Check out this blog post: https://techcommunity.microsoft.com/t5/Threat-Intelligence/Hunting-tip-of-the-month-Browser-downloads/td-p/220454.
This query make a best-guess detection regarding which removable media device caused an AV detection.
The query is best run over 30 days to get the full USB history.
Get a list of USB AV detections. This assumes any path not beginning with C is a removable/USB device.
The query is best run over 30 days to get the full USB history.
Get a list of USB AV detections. This assumes any path not beginning with C is a removable/USB device.
Query for Microsoft Defender Antivirus detections.
Query #1: Query for Antivirus detection events.
Query #1: Query for Antivirus detection events.
'Provides the Anti virus mode and device count falling under that AV mode.'
This query will identify the Microsoft Defender Antivirus Engine version and Microsoft Defender Antivirus Security Intelligence version (and timestamp), Product update version (aka Platform Update version) as well as the Microsoft Defender Antivirus Mode on the endpoint (Active, Passive, etc.).
Query for Microsoft Defender Antivirus detections.
Query #1: Query for Antivirus detection events.
Query #1: Query for Antivirus detection events.
'Provides the Engine version and total count of up to date devices, not up to date devices and count of devices whose status is not available relevant to the Engine version.'
'Identifies if an AV scan fails in Azure App Services.'
This query helps reviewing malicious email detections by detection methods
This query visualises total emails with Malware detections over time summarizing the data daily by various Malware detection technologies/controls.
'Identifies if an AV scan finds infected files in Azure App Services.'
This query shows the source of the AV detections (e.g., the website the file was downloaded from etc.).
Get the list of AV detections.
Get the list of AV detections.
Today MDE Alerts do not show PUA/WDAV ThreatName. This is a demonstration of how to get, for example, PUA Threat Names.
'Provides the Security Intelligence version and total count of up to date devices, not up to date devices and count of devices whose status is not available relevant to the security intelligence version.'
This query helps reviewing malware detections by detection methods
Page 1 of 2