Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
726 detections
Filters
Last updated
All Time
Detection languages
401
142
54
54
27
Contributors
153
152
78
42
33
Categories
227
208
134
132
119
Platforms
466
226
29
29
27
Products / Services
237
212
122
48
21
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
726
CVEs
5
5
5
4
4
IDS Classtypes
7
2
IDS Protocols
6
2
1
KQL Query
KQL Query from file: Any.Run Corrupt File Zero Day Attack
KQL Query
KQL Query from file: Hunting AI Recall on Windows 11 24H2
KQL Query
KQL Query
KQL Query
Detects the execution of the `hdiutil` utility on macOS to mount disk images. This activity can be associated with malware delivery, as adversaries often use disk images (.dmg files) to distribute malicious payloads. Monitoring this utility can help identify suspicious attempts to introduce or execute malware on a system.
Identifies the top 10 external sender addresses delivering inbound emails classified as malware.
If you want to exclude your own organization's domains (including subdomains), add a filter after the malware filter, e.g.:
| where SenderFromAddress !contains ".yourdomain.com"
(Replace "yourdomain.com" with your actual domain.)
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
If you want to exclude your own organization's domains (including subdomains), add a filter after the malware filter, e.g.:
| where SenderFromAddress !contains ".yourdomain.com"
(Replace "yourdomain.com" with your actual domain.)
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
Detects the execution of PowerShell by a Microsoft Office application. This behavior is consistent with the UAC-0001 (APT28) campaign described by CERT-UA, where a malicious document's macro was used to launch PowerShell for installing the BEARDSHELL backdoor and COVENANT C2 framework components.
Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spear phishing campaigns
This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams over time summarizing the data by the various Malware families detected focusing on Defender for Office 365 detections (detonations)
Detects Winword starting uncommon sub process csc.exe as used in exploits for CVE-2017-8759
Detects a suspicious child process of a Microsoft HTML Help (HH.exe)
Detects a suspicious execution of a Microsoft HTML Help (HH.exe)
Alerts on trust record modification within the registry, indicating usage of macros
This query was originally published in the threat analytics report, CVE-2018-15982 exploit attacks.
CVE-2018-15982 is an exploit of Adobe Flash Player, that allows for remote execution of arbitrary code. It has since been patched.
Actors have been observed using this vulnerability in targeted attacks. Exploits for CVE-2018-15982 have also been included in several exploit kits.
In some initial attacks exploiting CVE-2018-15982, attackers sent targets spear-phishing emails. The emails would include an attached RAR archive, which contained a lure document, as well as a second archive disguised as a .jpg file. Opening the document would automatically run an embedded Flash ActiveX control. This, in turn, would call a script containing the exploit. The exploit's ability to run arbitrary code would be employed to unpack and run a payload from the second archive. The payload is a backdoor used both to achieve persistance and for command and control.
The following query detects possible instances of a payload being extracted by the exploit.
References:
https://nvd.nist.gov/vuln/detail/CVE-2018-15982
https://helpx.adobe.com/security/products/flash-player/apsb18-42.html
CVE-2018-15982 is an exploit of Adobe Flash Player, that allows for remote execution of arbitrary code. It has since been patched.
Actors have been observed using this vulnerability in targeted attacks. Exploits for CVE-2018-15982 have also been included in several exploit kits.
In some initial attacks exploiting CVE-2018-15982, attackers sent targets spear-phishing emails. The emails would include an attached RAR archive, which contained a lure document, as well as a second archive disguised as a .jpg file. Opening the document would automatically run an embedded Flash ActiveX control. This, in turn, would call a script containing the exploit. The exploit's ability to run arbitrary code would be employed to unpack and run a payload from the second archive. The payload is a backdoor used both to achieve persistance and for command and control.
The following query detects possible instances of a payload being extracted by the exploit.
References:
https://nvd.nist.gov/vuln/detail/CVE-2018-15982
https://helpx.adobe.com/security/products/flash-player/apsb18-42.html
ISO Image Mounted
Sigma
Detects the mount of an ISO image on an endpoint
Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spear phishing campaigns
Detects the creation of a new office macro files on the systems
Page 30 of 35