Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
115 detections
Filters
Last updated
All Time
Detection languages
59
19
11
10
6
Contributors
20
19
15
9
7
Categories
53
25
22
20
13
Platforms
47
36
29
12
9
Products / Services
40
9
8
7
6
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
5
1
IDS Protocols
4
2
The analytic detects headless browser activity accessing mockbin.org or mocky.io. It identifies processes with the "--headless" and "--disable-gpu" command line arguments, along with references to mockbin.org or mocky.io. This behavior is significant as headless browsers are often used for automated tasks, including malicious activities like web scraping or automated attacks. If confirmed malicious, this activity could indicate an attempt to bypass traditional browser security measures, potentially leading to data exfiltration or further exploitation of web applications.
Detects the reconfiguration of a virtual machine where a virtual disk (.vmdk) from a different, often critical, VM is attached. This is a key tactic used by threat actors like UNC3944 to perform offline credential theft by mounting a Domain Controller's disk to a staging VM to access the NTDS.dit file.
This analytic detects the use of Windows command-line copy utilities, such as xcopy, to systematically collect files from user directories and consolidate them into a centralized location on the system. This activity is often indicative of malicious behavior, as threat actors frequently use such commands to gather sensitive information, including documents with .doc, .docx, and .pdf extensions. The detection focuses on identifying recursive copy operations targeting user folders, such as Documents, Desktop, or other directories that commonly store personal or organizational files. Malware that performs this behavior typically attempts to evade detection by using legitimate Windows utilities, executing commands through cmd.exe or other scripting hosts, and writing the collected files to directories like C:\ProgramData or temporary storage locations. Once collected, the information may be staged for exfiltration, used for lateral movement, or leveraged for further compromise of the environment. By monitoring for these types of file collection patterns, security teams can identify suspicious activity early, differentiate between normal administrative tasks and potentially malicious scripts, and prevent sensitive data from being exfiltrated. This analytic is particularly relevant for environments where confidential documents are present and attackers may attempt to harvest them using built-in Windows tools.
Detects the Koi Stealer macOS variant, an infostealer targeting cryptocurrency wallets and sensitive user data. This malware is linked to North Korean threat actors.
This rule detects the creation of specific files named 'spinstall0' within the SharePoint Web Server Extensions template layouts directory. This activity could indicate an attempt to install or modify SharePoint components, potentially for malicious purposes or unauthorized changes.
KQL Query
KQL Query from file: Data Exfiltration via Microsoft Teams
KQL Query
The following analytic identifies anomalous GetObject API activity in AWS, indicating potential data exfiltration attempts. It leverages AWS CloudTrail logs and uses the `anomalydetection` command to detect unusual patterns in the frequency of GetObject API calls by analyzing fields such as "count," "user_type," and "user_arn" within a 10-minute window. This activity is significant as it may indicate unauthorized data access or exfiltration from S3 buckets. If confirmed malicious, attackers could exfiltrate sensitive data, leading to data breaches and compliance violations.
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
'This hunting query will help detect successful sign-ins from devices that are marked non-compliant along with bulk download activity.
Attackers may attempt to get a list of accounts, groups, registration details within an environment which could help in follow-on behavior.
Best practice is to block sign ins from non-complaint devices, however if allowed monitor these events to ensure they do not lead to other risky activity.
Reference: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-devices#non-compliant-device-sign-in'
Attackers may attempt to get a list of accounts, groups, registration details within an environment which could help in follow-on behavior.
Best practice is to block sign ins from non-complaint devices, however if allowed monitor these events to ensure they do not lead to other risky activity.
Reference: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-devices#non-compliant-device-sign-in'
'Any Alerts that fired related to a given IpAddress during the range of +6h and -3d'
This query looks for users accessing multiple other users' mailboxes, or accessing multiple folders in another user's mailbox.
This query is inspired by an Azure Sentinel detection.
Reference - https://github.com/Azure/Azure-Sentinel/blob/master/Hunting%20Queries/OfficeActivity/AnomolousUserAccessingOtherUsersMailbox.yaml
This query is inspired by an Azure Sentinel detection.
Reference - https://github.com/Azure/Azure-Sentinel/blob/master/Hunting%20Queries/OfficeActivity/AnomolousUserAccessingOtherUsersMailbox.yaml
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
Private Key Files.
This query identifies file operation with files having.
One of the extensions commonly used to save a private.
Key. The risk is that if an attacker were to obtain.
The file, they could brute force any password on it.
And potentially obtain a powerful certificate. To do.
This, they would only need to obtain read access to.
The file.
The risk associated with these files is heavily.
Determined by the value of the certificate. For example,.
Loss of a self-signed certificate created by Adobe Acrobat.
Is significantly less impactful than loss of a website.
SSL certificate.
Recommendation: Know where these files are, and if possible.
Back them up and remove them. You might also consider.
Creating an informational alert.
This query identifies file operation with files having.
One of the extensions commonly used to save a private.
Key. The risk is that if an attacker were to obtain.
The file, they could brute force any password on it.
And potentially obtain a powerful certificate. To do.
This, they would only need to obtain read access to.
The file.
The risk associated with these files is heavily.
Determined by the value of the certificate. For example,.
Loss of a self-signed certificate created by Adobe Acrobat.
Is significantly less impactful than loss of a website.
SSL certificate.
Recommendation: Know where these files are, and if possible.
Back them up and remove them. You might also consider.
Creating an informational alert.
Once established within a system or network, an adversary may use automated techniques for collecting internal data
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
'The Exchange Powershell Snapin was loaded on a host, this allows for a Exchange server management via PowerShell.
Whilst this is a legitimate administrative tool it is abused by attackers to performs actions on a compromised
Exchange server. Hunt for unusual activity related to this Snapin including it being added on new hosts or by
new accounts.'
Whilst this is a legitimate administrative tool it is abused by attackers to performs actions on a compromised
Exchange server. Hunt for unusual activity related to this Snapin including it being added on new hosts or by
new accounts.'
The following analytic detects the usage of headless browsers within an organization. It identifies processes containing the "--headless" and "--disable-gpu" command line arguments, which are indicative of headless browsing. This detection leverages data from the Endpoint.Processes datamodel to identify such processes. Monitoring headless browser usage is significant as these tools can be exploited by adversaries for malicious activities like web scraping, automated testing, and undetected web interactions. If confirmed malicious, this activity could lead to unauthorized data extraction, automated attacks, or other covert operations on web applications.
Page 5 of 6