Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
26 detections
Filters
Last updated
All Time
Detection languages
13
11
1
1
Contributors
7
5
4
2
2
Categories
10
5
5
5
3
Platforms
15
5
3
3
1
Products / Services
15
5
3
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects suspicious behavior from database accounts with replication privileges ('rolreplication=true'). The rule monitors for logins from unauthorized IP addresses, the execution of non-replication related SQL commands by these accounts, and the use of potentially malicious plugin names (containing path traversal characters) during replication slot creation.
Detects suspicious behavior from database accounts with replication privileges ('rolreplication=true'). The rule monitors for logins from unauthorized IP addresses, the execution of non-replication related SQL commands by these accounts, and the use of potentially malicious plugin names (containing path traversal characters) during replication slot creation.
Detects suspicious behavior from database accounts with replication privileges ('rolreplication=true'). The rule monitors for logins from unauthorized IP addresses, the execution of non-replication related SQL commands by these accounts, and the use of potentially malicious plugin names (containing path traversal characters) during replication slot creation.
Detects suspicious behavior from database accounts with replication privileges ('rolreplication=true'). The rule monitors for logins from unauthorized IP addresses, the execution of non-replication related SQL commands by these accounts, and the use of potentially malicious plugin names (containing path traversal characters) during replication slot creation.
Detects suspicious behavior from database accounts with replication privileges ('rolreplication=true'). The rule monitors for logins from unauthorized IP addresses, the execution of non-replication related SQL commands by these accounts, and the use of potentially malicious plugin names (containing path traversal characters) during replication slot creation.
Detects installation of malicious Exchange transport agents for email persistence
This rule detects network traffic indicating the installation of a Transport Agent on an Exchange server. It specifically looks for the strings "TransportAgent" and "Install-TransportAgent" in TCP traffic directed to port 25 of the home network, suggesting a potential malicious or unauthorized installation of an Exchange Transport Agent.
Detects anomalous Exchange Transport Rule activity: high volume changes, suspicious patterns, or after-hours modifications
This query uses the Machine Learning series_decompose_anomalies function to build a baseline of "normal" transport rule modification behavior. If your organization typically changes 0 rules a week, and suddenly 5 are changed at 2 AM on a Saturday, this query will catch it regardless of what the parameters are.
Detects a failed installation of a Exchange Transport Agent
Detects the Installation of a Exchange Transport Agent
Detects the Installation of a Exchange Transport Agent
Detects the creation of a process where the parent process is 'EdgeTransport.exe' and the child process is not 'conhost.exe' or 'OleConverter.exe'. This behavior is indicative of a WMI backdoor being used in Exchange Transport Agents, leveraging WMI event filters for persistence or execution.
Detects scenarios where an attacker attempts to load an artifact in the Exchange transport agent.
Detects scenarios where an attacker attempts to load an artifact in the Exchange transport agent.
KQL Query from file: Threat Hunting AzureHound Usage
KQL Query from file: Detecting Misconfigured EXO Transport Rules
Detects the Installation of a Exchange Transport Agent
Detects the Installation of a Exchange Transport Agent
'This rule identifies a web request with a user agent header known to belong to a hacking tool. This indicates a hacking tool is used on the host.<br>You can add custom hacking tool indicating User-Agent headers using a watchlist, for more information refer to the [UnusualUserAgents Watchlist](https://aka.ms/ASimUnusualUserAgentsWatchlist).
This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM WebSession schema (ASIM WebSession Schema)'
This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM WebSession schema (ASIM WebSession Schema)'
Detects a failed installation of a Exchange Transport Agent
Page 1 of 2