Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
19 detections
Filters
Last updated
All Time
Detection languages
11
3
2
2
1
Contributors
7
4
2
2
1
Categories
7
4
4
4
4
Platforms
10
5
3
2
1
Products / Services
5
3
3
2
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
2
1
IDS Protocols
2
1
Detects the presence of self-signed TLS certificates with the common name 'JDYFJ' in the certificate subject or issuer fields. This pattern has been associated with the KV-Botnet, which has been utilized by the Volt Typhoon threat actor to obfuscate command and control traffic through compromised SOHO routers.
Detects unauthorized changes to network appliance configurations, specifically the installation of new software packages using opkg or the modification of network address translation (NAT) rules via iptables or nftables. These actions can be used to maintain persistent access or establish covert command and control infrastructure.
Detects critical log entries on MikroTik RouterOS devices that contain 'flagged' status messages following a system upgrade or maintenance. This pattern is indicative of potential post-exploitation activity or post-update integrity warnings identified in recent vulnerabilities affecting RouterOS.
Detects the execution of 'FortiGateSniffer', a tool identified as Golang-based, used to perform passive network packet capture on compromised FortiGate devices. The rule also analyzes captured traffic for sensitive authentication protocols including RADIUS, Kerberos, and NTLM.
Detects the LEASHTEST MIPS-compiled test binary linked to UAT-7810 ORB network R&D activity; presence indicates device compromise
Detects anomalous device network activity involving 5G-specific protocol ports (e.g., GTP-U, SIP). The rule aggregates unique port usage per device over 1-hour intervals to identify potential network reconnaissance, scanning, or unauthorized control plane communication.
Detects anomalous device network activity involving 5G-specific protocol ports (e.g., GTP-U, SIP). The rule aggregates unique port usage per device over 1-hour intervals to identify potential network reconnaissance, scanning, or unauthorized control plane communication.
This rule detects a brute-force attack against an SSH service on a network device management port. It triggers an alert if 15 or more TCP SYN packets are observed from a single source IP address to destination port 22 (SSH) within a 30-second window, indicating an attempt to establish multiple connections, characteristic of a brute-force attempt.
This rule detects Telnet access attempts to network devices within the home network. It specifically looks for TCP traffic destined for port 23 (the standard Telnet port) and triggers an alert if three such connections from the same source IP are observed within a 60-second window. This activity is flagged as a 'possible compromise' due to Telnet's insecure nature and its common use in initial access or resource development by adversaries.
This rule detects configuration changes to Fortinet FortiGate firewall policies that occur outside of standard business hours (before 8 AM or after 5 PM NZDT). It specifically looks for actions like 'Move', 'Add', 'Enable', 'Delete', or 'Edit' on firewall policies. This can indicate unauthorized access or malicious activity, as legitimate changes are typically performed during business hours.
KQL Query from file: Threat Hunting - MDE Network Intrusion Discovery
'Indicates when an anomalous number of resources are created in Azure via AzureActivity log. Resource creation could indicate malicious or spurious use of your Azure Resource allocation.'
This query checks for network connection failures to Microsoft Defender for Endpoint URLs.
The output includes any device with 1+ connectivity failures, a list of the domains they
failed to connect to (including the number of failures), as well as the overall number of
failures in the time period. Results are sorted by the total number of connection failures
by the device.
The output includes any device with 1+ connectivity failures, a list of the domains they
failed to connect to (including the number of failures), as well as the overall number of
failures in the time period. Results are sorted by the total number of connection failures
by the device.
Get all filtering events done by the Windows filtering platform.
This includes any blocks done by Windows Firewall rules, but also blocks triggered by some 3rd party firewalls.
When no Firewall rules are configured, the default behavior is to block all incoming network connections.
This includes any blocks done by Windows Firewall rules, but also blocks triggered by some 3rd party firewalls.
When no Firewall rules are configured, the default behavior is to block all incoming network connections.
The following query surface network activity associated with exploitation of CVE-2022-22965.
Find devices connected to a monitored network.
Please Note line 5 needs to have a monitored network name put in place or commented out to pull everything.
Please Note line 5 needs to have a monitored network name put in place or commented out to pull everything.
Simple query to show the unique network connections that were audited or blocked by ExploitGuard.
For more questions on this query, feel free to ping @FlyingBlueMonki on twitter or mattegen@microsoft.com via email.
For more questions on this query, feel free to ping @FlyingBlueMonki on twitter or mattegen@microsoft.com via email.
The following queries pivot from an IP address assigned to a machine to the relevant machine or logged-on users.
To read more about it, check out this post: https://techcommunity.microsoft.com/t5/What-s-New/Advanced-hunting-now-includes-network-adapters-information/m-p/224402#M74.
Query #1: get machines that have used a given local IP address at a given time - as configured on their network adapters.
To read more about it, check out this post: https://techcommunity.microsoft.com/t5/What-s-New/Advanced-hunting-now-includes-network-adapters-information/m-p/224402#M74.
Query #1: get machines that have used a given local IP address at a given time - as configured on their network adapters.
This analytic identifies high-severity intrusion events based on the classification assigned to Snort rules within Cisco Secure Firewall logs. It leverages Cisco Secure Firewall Threat Defense logs and focuses on events classified as: A Network Trojan was Detected, Successful Administrator Privilege Gain, Successful User Privilege Gain, Attempt to Login By a Default Username and Password, Known malware command and control traffic, Known malicious file or file based exploit, Known client side exploit attempt, Large Scale Information Leak. These classifications typically represent significant threats such as remote code execution, credential theft, lateral movement, or malware communication. Detection of these classifications should be prioritized for immediate investigation.
