Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
33 detections
Filters
Last updated
All Time
Detection languages
16
10
3
2
1
Contributors
7
6
6
5
5
Categories
14
5
5
3
3
Platforms
28
5
2
1
1
Products / Services
8
7
6
4
4
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
3
1
IDS Classtypes
1
IDS Protocols
1
'Shows the rarest processes seen running for the first time. (Performs best over longer time ranges - eg 3+ days rather than 24 hours!)
These new processes could be benign new programs installed on hosts;
However, especially in normally stable environments, these new processes could provide an indication of an unauthorized/malicious binary that has been installed and run.
Reviewing the wider context of the logon sessions in which these binaries ran can provide a good starting point for identifying possible attacks.'
These new processes could be benign new programs installed on hosts;
However, especially in normally stable environments, these new processes could provide an indication of an unauthorized/malicious binary that has been installed and run.
Reviewing the wider context of the logon sessions in which these binaries ran can provide a good starting point for identifying possible attacks.'
Detects driver load events print service operational log that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675
Detects events of driver load errors in print service logs that could be a sign of successful exploitation attempts of print spooler vulnerability CVE-2021-1675
Establishes a baseline SystemGuardSecurityLevel and show the devices that are below that baseline.
See https://techcommunity.microsoft.com/t5/Microsoft-Defender-ATP/How-insights-from-system-attestation-and-advanced-hunting-can/ba-p/969252 for full details on this query.
And Device Boot Attestation Info and feel free to ping @DepletionMode or @flyingbluemonki on twitter.
See https://techcommunity.microsoft.com/t5/Microsoft-Defender-ATP/How-insights-from-system-attestation-and-advanced-hunting-can/ba-p/969252 for full details on this query.
And Device Boot Attestation Info and feel free to ping @DepletionMode or @flyingbluemonki on twitter.
This query searches for not onboarded devices with a specific Suffix
'This hunting query looks for file paths/hashes related to observed activity by Dev-0228. The actor is known to use custom version of popular tool like PsExec, Procdump etc. to carry its activity.
The risk score associated with each result is based on a number of factors, hosts with higher risk events should be investigated first.
This query uses the Microsoft Sentinel Information Model - https://docs.microsoft.com/azure/sentinel/normalization'
The risk score associated with each result is based on a number of factors, hosts with higher risk events should be investigated first.
This query uses the Microsoft Sentinel Information Model - https://docs.microsoft.com/azure/sentinel/normalization'
'This hunting query looks for file paths/hashes related to observed activity by Dev-0228. The actor is known to use custom version of popular tool like PsExec, Procdump etc. to carry its activity.
The risk score associated with each result is based on a number of factors, hosts with higher risk events should be investigated first.'
The risk score associated with each result is based on a number of factors, hosts with higher risk events should be investigated first.'
Detects the execution of PsExec, a legitimate but often abused tool for remote command execution. The rule specifically looks for the executable name 'psexec.exe' or its original filename 'psexec.c' in process creation events.
Detects events of driver load errors in print service logs that could be a sign of successful exploitation attempts of print spooler vulnerability CVE-2021-1675, also known as PrintNightmare. The rule specifically looks for EventID 808 with ErrorCode 0x45A or 0x7e, combined with keywords indicating a plug-in module load failure and common DLL names used in PrintNightmare Proof-of-Concept exploits.
Detects remote printer driver load from a Detailed File Share event in Windows Security logs, which is indicative of successful exploitation attempts against the Print Spooler vulnerabilities CVE-2021-1675 (PrintNightmare) and CVE-2021-34527.
This rule detects attempts to exploit the Print Spooler vulnerability CVE-2021-1675, also known as PrintNightmare. It specifically looks for Event ID 316 in the Print Service Operational log, which indicates a driver load event. The rule further refines detection by searching for keywords such as 'UNIDRV.DLL, kernelbase.dll,', '123', '1234', or 'mimispool', which are associated with known exploitation methods for this vulnerability. Successful exploitation often involves loading malicious drivers or DLLs through the print spooler service.
Psexec Execution
Sigma
Detects user accept agreement execution in psexec commandline
Page 2 of 2