Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
6
2
Contributors
3
2
1
1
1
Categories
3
3
2
2
1
Platforms
6
3
2
1
Products / Services
4
2
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
2
Detects when the Tamper Protection feature of Windows Defender is disabled. This action is often taken by adversaries or malicious software to weaken endpoint defenses and facilitate further compromise or concealment of malicious activity.
This rule detects attempts to clear network connection history by deleting the wtmp log file via an SSH connection. The rule specifically looks for the command 'rm -rf /var/log/wtmp' being sent over TCP port 22 (SSH). This activity is often associated with defense evasion tactics used by attackers to remove forensic evidence.
This rule detects attempts to clear Windows network connection history remotely over SMB (port 445). It specifically looks for traffic containing the strings "NetworkList" and "delete" (case-insensitive) within TCP sessions directed to the HOME_NET on port 445. This activity could indicate an attacker attempting to remove forensic evidence of their network presence.
New forensic techniques helps to have more insights about RDP-based attacks.By analyzing login sequences, screen tile caches, clipboard data, and session memory, analysts can now reconstruct full attacker activity during Remote Desktop sessions—even if the adversary tries to cover their tracks.
The following KQL Query helps to identify when a ransomware attack attempts to remove the mentioned evidence via script which will be identified as executed command.
The following KQL Query helps to identify when a ransomware attack attempts to remove the mentioned evidence via script which will be identified as executed command.
KQL Query from file: One-Click ANY RUN Storm-1747 KQL Scan
Query 1 shows you any network communication happened from endpoints to a specific Remote IP or Remote URL.
Ensure to update RemoteIP and RemoteURL variable.
For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com by email.
Ensure to update RemoteIP and RemoteURL variable.
For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com by email.
Query 1 shows you any network communication happened from endpoints to a specific Remote IP or Remote URL.
Ensure to update RemoteIP and RemoteURL variable.
For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com by email.
Ensure to update RemoteIP and RemoteURL variable.
For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com by email.
Intent:
- Use MTP capability to look for insider threat potential risk indicators
- Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
Definition of Insider Threat:
"The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.
- Use MTP capability to look for insider threat potential risk indicators
- Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
Definition of Insider Threat:
"The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.