Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
175 detections
Filters
Last updated
All Time
Detection languages
81
61
8
7
5
Contributors
29
26
22
20
14
Categories
51
33
31
25
23
Platforms
149
16
12
5
2
Products / Services
51
39
14
13
12
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
2
1
1
IDS Classtypes
2
1
IDS Protocols
3
Detects calls to WinAPI functions from PowerShell scripts. Attackers can often leverage these APIs to avoid detection based on typical PowerShell function calls. Use this rule as a basis to hunt for interesting scripts.
This query will find applications that have been granted Mail.Read or Mail.ReadWrite permissions in which the corresponding user recently consented to. It can help identify applications that have been abused to gain access to user email.
The actor, Nobelium, was observed modifying existing tenant application permissions to allow them to read user email through the Microsoft Graph API. See Customer Guidance on Recent Nation-State Cyber Attacks.
This query is insprired by an Azure Sentinel detection.
References:
https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/MailPermissionsAddedToApplication.yaml
The actor, Nobelium, was observed modifying existing tenant application permissions to allow them to read user email through the Microsoft Graph API. See Customer Guidance on Recent Nation-State Cyber Attacks.
This query is insprired by an Azure Sentinel detection.
References:
https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/MailPermissionsAddedToApplication.yaml
'Shows the rarest processes seen running for the first time. (Performs best over longer time ranges - eg 3+ days rather than 24 hours!)
These new processes could be benign new programs installed on hosts;
However, especially in normally stable environments, these new processes could provide an indication of an unauthorized/malicious binary that has been installed and run.
Reviewing the wider context of the logon sessions in which these binaries ran can provide a good starting point for identifying possible attacks.'
These new processes could be benign new programs installed on hosts;
However, especially in normally stable environments, these new processes could provide an indication of an unauthorized/malicious binary that has been installed and run.
Reviewing the wider context of the logon sessions in which these binaries ran can provide a good starting point for identifying possible attacks.'
Detects calls to WinAPI libraries from PowerShell scripts. Attackers can often leverage these APIs to avoid detection based on typical PowerShell function calls. Use this rule as a basis to hunt for interesting scripts.
This query helps you review all OAuth applications accessing user mail via Graph. It could return a significant number of results depending on how many applications are deployed in the environment.
Detects different process creation events as described in Malwarebytes's threat report on Lazarus group activity
Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility
Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles
Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file
Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility
Detects use of WinAPI functions in PowerShell scripts
Detects different process creation events as described in Malwarebytes's threat report on Lazarus group activity
Detects suspicious mshta process execution patterns
Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file
Detects potential calls to NtOpenProcess directly from NTDLL.
Detects the creation of named pipes with specific names known to be used by the Turla APT group. These named pipes include '\atctl', '\comnap', '\iehelper', '\sdlrpc', and '\userpipe'. The rule relies on Sysmon Event ID 17 or 18 for named pipe creation events.
Detects HandleKatz, a tool designed to duplicate the LSASS process handle with specific access rights (PROCESS_DUP_HANDLE, PROCESS_QUERY_LIMITED_INFORMATION, PROCESS_QUERY_INFORMATION) to later dump its memory without opening new handles. The detection logic focuses on the target image being 'lsass.exe', the specific granted access rights, and a suspicious call trace originating from ntdll.dll with an 'UNKNOWN' module.
Detects the use of Windows API (WinAPI) functions being called directly via the command line. This technique is often used by threat actors, for example, with tools like winapiexec, to perform various malicious actions such as privilege escalation, process injection, or credential dumping by directly interacting with low-level operating system functions. The rule specifically looks for a wide range of sensitive WinAPI function names and DLLs in the command line arguments of newly created processes.
This rule detects GET requests to the Microsoft Graph API's '/v1.0/groups' endpoint. This activity can indicate an adversary enumerating groups within an Azure Active Directory environment, potentially using tools like GraphRunner's 'Get-DynamicGroups' function or similar custom scripts. Successful requests (HTTP 200) are specifically targeted.
Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec
This rule detects potential direct system calls to NtOpenProcess, specifically when the CallTrace starts with 'UNKNOWN'. This behavior can be indicative of advanced persistent threats (APTs) or malware attempting to evade detection by bypassing user-mode API hooks. The rule includes several filters to reduce false positives from legitimate applications and system processes.
Page 8 of 9