Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
5
Contributors
4
1
Categories
3
1
1
1
1
Platforms
4
1
1
1
Products / Services
3
1
1
1
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
KQL Query from file: Exploring M365 Accounts Investigation
Tor
KQL
This query looks for Tor client, or for a common Tor plugin called Meek.
We query for active Tor connections, but could have alternatively looked for active Tor runs (ProcessCreateEvents) or Tor downloads (DeviceFileEvents).
To read more about this technique, see:.
Tor: https://attack.mitre.org/wiki/Software/S0183#Techniques_Used.
Meek plugin: https://attack.mitre.org/wiki/Software/S0175.
Multi-hop proxy technique: https://attack.mitre.org/wiki/Technique/T1188.
Tags: #Tor, #MultiHopProxy, #CnC.
We query for active Tor connections, but could have alternatively looked for active Tor runs (ProcessCreateEvents) or Tor downloads (DeviceFileEvents).
To read more about this technique, see:.
Tor: https://attack.mitre.org/wiki/Software/S0183#Techniques_Used.
Meek plugin: https://attack.mitre.org/wiki/Software/S0175.
Multi-hop proxy technique: https://attack.mitre.org/wiki/Technique/T1188.
Tags: #Tor, #MultiHopProxy, #CnC.
This query checks for network connection failures to Microsoft Defender for Endpoint URLs.
The output includes any device with 1+ connectivity failures, a list of the domains they
failed to connect to (including the number of failures), as well as the overall number of
failures in the time period. Results are sorted by the total number of connection failures
by the device.
The output includes any device with 1+ connectivity failures, a list of the domains they
failed to connect to (including the number of failures), as well as the overall number of
failures in the time period. Results are sorted by the total number of connection failures
by the device.
This advanced hunting query detects processes communicating with known Tor relay IP addresses.
The public URL in the query is updated daily at 12PM and 12AM UTC.
CSV source is the Tor Project API, obtained with: https://github.com/Dylan-J/Tor-Project-Statistics
The public URL in the query is updated daily at 12PM and 12AM UTC.
CSV source is the Tor Project API, obtained with: https://github.com/Dylan-J/Tor-Project-Statistics
'Detects request to potentially harmful file types (.ps1, .bat, .vbs, etc.).'