Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
486 detections
Filters
Last updated
All Time
Detection languages
142
130
119
29
22
Contributors
84
68
57
54
30
Categories
179
153
150
107
91
Platforms
263
161
69
33
10
Products / Services
130
120
72
70
54
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
6
5
4
2
2
IDS Classtypes
66
37
14
9
4
IDS Protocols
37
30
27
14
9
Detects potentially suspicious execution of the Qemu utility in a Windows environment.
Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.
Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.
Detects port forwarding activity via SSH.exe
Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain persistence and remote access to compromised networks.
Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local protected services publicly available.
Involved domains are bin.equinox.io for download and *.ngrok.io for connections.
Involved domains are bin.equinox.io for download and *.ngrok.io for connections.
The analytic detects instances where network traffic, identified by port and transport layer protocol as prohibited in the "lookup_interesting_ports" table, is allowed. It uses the Network_Traffic data model to cross-reference traffic data against predefined security policies. This activity is significant for a SOC as it highlights potential misconfigurations or policy violations that could lead to unauthorized access or data exfiltration. If confirmed malicious, this could allow attackers to bypass network defenses, leading to potential data breaches and compromising the organization's security posture.
Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.
Detects the execution of well known tools that can be abused for data exfiltration and tunneling.
Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443
Execution of plink to perform data exfiltration and tunneling
Execution of ssh.exe to perform data exfiltration and tunneling through RDP
Execution of ssh.exe to perform data exfiltration and tunneling through RDP
Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains.
LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet.
Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.
LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet.
Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.
Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.
Detects the use of 3proxy, a tiny free proxy server
Detects the execution of well known tools that can be abused for data exfiltration and tunneling.
Detects the use of 3proxy, a tiny free proxy server
Detects potentially suspicious execution of the Qemu utility in a Windows environment.
Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.
Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.
View Defender for Endpoint telemetry URLs and their connection status, view trendline over 30 days.
Use to investigate possible telemetry and/or connectivity issues.
Jesse.esquivel@microsoft.com.
Use to investigate possible telemetry and/or connectivity issues.
Jesse.esquivel@microsoft.com.
This rule detects Okta authentication attempts originating from known VPN providers. Threat actors, particularly those involved in Remote Employment Fraud (REF), often use VPNs to mask their true physical location and evade detection. By identifying connections from a listing of commonly used VPN services, this rule aims to flag potentially suspicious access to Okta accounts. The rule extracts user information, client details, geographical context, and debug data to provide comprehensive insights into the VPN usage.
Intent:
- Use MTP capability to look for insider threat potential risk indicators
- Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
Definition of Insider Threat:
"The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.
- Use MTP capability to look for insider threat potential risk indicators
- Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
Definition of Insider Threat:
"The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Page 21 of 24