Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
345 detections
Filters
Last updated
All Time
Detection languages
183
90
20
18
12
Contributors
85
73
57
47
29
Categories
300
166
46
9
9
Platforms
317
25
6
4
3
Products / Services
127
58
46
9
8
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
9
8
1
1
1
IDS Classtypes
2
IDS Protocols
2
Detects a service binary running in a suspicious directory
Detects potential arbitrary file download using a Microsoft Office application
Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros
Detects uncommon "conhost" child processes. This could be a sign of "conhost" usage as a LOLBIN or potential process injection activity.
ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file.
Detects uncommon child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript
Detects potential abuse of Windows Subsystem for Linux (WSL) binary as a Living of the Land binary in order to execute arbitrary Linux or Windows commands.
'This query looks for Microsoft Defender for Endpoint detections related to the remote command execution attempts on Azure IR with Managed VNet or SHIR.
In Microsoft Sentinel, the SecurityAlerts table includes the name of the impacted device. Additionally, this query joins the DeviceInfo table to connect other information such as device group, IP address, signed in users, and others allowing analysts using Microsoft Sentinel to have more context related to the alert.
Reference: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29972 ,
https://msrc-blog.microsoft.com/2022/05/09/vulnerability-mitigated-in-the-third-party-data-connector-used-in-azure-synapse-pipelines-and-azure-data-factory-cve-2022-29972'
In Microsoft Sentinel, the SecurityAlerts table includes the name of the impacted device. Additionally, this query joins the DeviceInfo table to connect other information such as device group, IP address, signed in users, and others allowing analysts using Microsoft Sentinel to have more context related to the alert.
Reference: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29972 ,
https://msrc-blog.microsoft.com/2022/05/09/vulnerability-mitigated-in-the-third-party-data-connector-used-in-azure-synapse-pipelines-and-azure-data-factory-cve-2022-29972'
Detect indirect command execution via Program Compatibility Assistant (pcalua.exe or forfiles.exe).
Detects potential DLL sideloading using the Microsoft Office winword process via the '/l' flag.
Detects execution of powershell scripts via Runscripthelper.exe
Detects suspicious Splwow64.exe process without any command line parameters
Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav shares).
ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context.
Detects uncommon child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript
Detects execution of msdt.exe using the "cab" flag which could indicates suspicious diagcab files with embedded answer files leveraging CVE-2022-30190
Detects suspicious child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript
Detects the abuse of custom file open handler, executing powershell
Detects Winword.exe loading a custom DLL using the /l flag
Detects potential DLL sideloading using the Microsoft Office winword process via the '/l' flag.
Detects the execution of a renamed "CURL.exe" binary based on the PE metadata fields
Page 14 of 17