Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
315 detections
Filters
Last updated
All Time
Detection languages
140
65
56
27
13
Contributors
116
51
30
16
13
Categories
94
93
89
75
71
Platforms
116
85
80
75
62
Products / Services
95
84
60
53
42
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
2
1
1
1
1
IDS Classtypes
32
31
1
1
1
IDS Protocols
41
13
2
2
1
Detects successful user authentication using the FIDO2/WebAuthn cross-device (hybrid) sign-in feature. This technique can be abused by attackers in Adversary-in-the-Middle (AiTM) phishing campaigns to bypass FIDO key protections, as seen in the PoisonSeed campaign.
KQL Query from file: The Hunt for QR Phisher
KQL Query from file: Attacker in the Middle Precision Detection
KQL Query from file: Detect Privilege Admin under AiTM attack
KQL Query from file: Hunting Rockstar 2FA
KQL Query
KQL Query from file: Detecting Mamba 2FA phishing-as-a-service
KQL Query from file: NTLMv2 Hash Leak via COM Detection
KQL Query from file: KQLWiz PDF NTLM Leak Detector
KQL Query
KQL Query from file: Muddled Libra
detects a possible IPv6 DNS takeover using ISATAP configuration events (Event ID 4100) new ISATAP router was set successfully
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
'This rule identifies a web request with a user agent header known to belong to a hacking tool. This indicates a hacking tool is used on the host.<br>You can add custom hacking tool indicating User-Agent headers using a watchlist, for more information refer to the [UnusualUserAgents Watchlist](https://aka.ms/ASimUnusualUserAgentsWatchlist).
This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM WebSession schema (ASIM WebSession Schema)'
This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM WebSession schema (ASIM WebSession Schema)'
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
The following analytic identifies user sessions in Office 365 accessed from multiple IP addresses, indicating potential adversary-in-the-middle (AiTM) phishing attacks. It detects this activity by analyzing Azure Active Directory logs for 'UserLoggedIn' operations and flags sessions with more than one associated IP address. This behavior is significant as it suggests unauthorized concurrent access, which is uncommon in normal usage. If confirmed malicious, the impact could include data theft, account takeover, and the launching of internal phishing campaigns, posing severe risks to organizational security.
The following analytic detects the installation of a root CA certificate by monitoring specific registry paths for SetValue events. It leverages data from the Endpoint datamodel, focusing on registry paths containing "certificates" and registry values named "Blob." This activity is significant because unauthorized root CA certificates can compromise the integrity of encrypted communications and facilitate man-in-the-middle attacks. If confirmed malicious, this could allow an attacker to intercept, decrypt, or manipulate sensitive data, leading to severe security breaches.
The following analytic identifies the presence of unauthorized DHCP servers on the network. It leverages logs from Cisco network devices with DHCP Snooping enabled, specifically looking for events where DHCP leases are issued from untrusted ports. This activity is significant because rogue DHCP servers can facilitate Man-in-the-Middle attacks, leading to potential data interception and network disruption. If confirmed malicious, this could allow attackers to redirect network traffic, capture sensitive information, and compromise the integrity of the network.
Detects Border Gateway Protocol (BGP) authentication failures, which can indicate attempts to brute force BGP peer authentication. Such attacks aim to manipulate routing information, potentially leading to traffic redirection or denial of service.
Detects BGP failures which may be indicative of brute force attacks to manipulate routing.
Page 15 of 15