Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
13 detections
Filters
Last updated
All Time
Detection languages
10
1
1
1
Contributors
8
3
1
1
Categories
10
1
1
1
1
Platforms
10
3
2
Products / Services
3
2
1
1
1
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects TFTP boot image transfers to network devices for persistent firmware modification
Detects malicious firmware pushed to network devices via TFTP
Detects TFTP-based pre-boot file transfers for bootkit or firmware persistence
Detects firmware updates pushed from unverified or IP-only sources
Detects TFTP boot image transfers to network devices for persistent firmware modification
Detects modification of network device system images via TFTP for persistent backdoors
This rule detects when a TFTP (Trivial File Transfer Protocol) boot image is potentially pushed to a network device. It specifically looks for UDP traffic on port 69 (TFTP default port) directed to the home network, containing the byte sequence "|00 02|" (which often indicates a TFTP write request or a specific TFTP opcode) and having a data size greater than 10000 bytes, suggesting a large file transfer like a boot image.
Detects TFTP transfers used to deliver bootkit or firmware persistence payloads
Goal: Find machines in the last N days where the SystemGuardSecurityLevel value NOW is less than it was BEFORE.
Step 1: Get a list of all security levels in the system where the level is not null.
Step 1: Get a list of all security levels in the system where the level is not null.
This query will hunt for files matching the current abuse.ch recent threat feed based on Sha256. Currently the query is set up to analyze the last day worth of events, but this is configurable using the MaxAge variable.
Establishes a baseline SystemGuardSecurityLevel and show the devices that are below that baseline.
See https://techcommunity.microsoft.com/t5/Microsoft-Defender-ATP/How-insights-from-system-attestation-and-advanced-hunting-can/ba-p/969252 for full details on this query.
And Device Boot Attestation Info and feel free to ping @DepletionMode or @flyingbluemonki on twitter.
See https://techcommunity.microsoft.com/t5/Microsoft-Defender-ATP/How-insights-from-system-attestation-and-advanced-hunting-can/ba-p/969252 for full details on this query.
And Device Boot Attestation Info and feel free to ping @DepletionMode or @flyingbluemonki on twitter.
The following analytic identifies unauthorized software downloads to network devices via TFTP, FTP, or SSH/SCP. It detects this activity by analyzing network traffic events on specific ports (69, 21, 22) from devices categorized as network, router, or switch. This activity is significant because adversaries may exploit netbooting to load unauthorized operating systems, potentially compromising network integrity. If confirmed malicious, this could lead to unauthorized control over network devices, enabling further attacks, data exfiltration, or persistent access within the network.
Detects instances where a TFTP service on an OpenCanary honeypot node has received a request. This indicates potential reconnaissance or attempts to interact with a seemingly vulnerable service.
