Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
36 detections
Filters
Last updated
All Time
Detection languages
17
9
6
2
1
Contributors
12
4
3
3
3
Categories
10
9
9
8
6
Platforms
19
11
5
5
3
Products / Services
9
6
4
4
4
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
4
3
2
IDS Protocols
4
4
1
Another small hunting idea using CallActivityEvents Table. The query extracts the Top-Level Domain (TLD) from the person performing the action in a Microsoft Teams call and enriches it with an external country list. In this example, I exclude .CH to quickly surface activity where the originator is using a domain associated with another country. A different hunting angle to spot unexpected external participants, unusual call activity, or simply identify interactions that deserve a closer look. Of course, a foreign TLD is not malicious by itself — it is just another piece of context for the hunter. 🔎
Detects a network activity pattern from a single host characterized by a high volume of connections to a wide range of remote hosts and ports, combined with an exceptionally low coefficient of variation in inter-request timing. This pattern is indicative of an automated, scriptable agent or AI-driven reconnaissance tool rather than a human-operated scanner, likely performing automated asset discovery or network enumeration.
Detects DNS resolution requests to 'graph.microsoft.com' on endpoint devices. This is intended to act as a precursor indicator for potential Microsoft 365 or Azure environment enumeration and discovery activities, which would typically involve subsequent API calls.
Detects a sequence of user activities—authentication, MFA registration, Graph API reconnaissance, and data exfiltration—originating from a rotating set of distinct source IP addresses for the same user within a 24-hour period. This behavior is indicative of coordinated infrastructure rotation tactics used by threat actors in cloud intrusions.
Detects repeated manual HTTP GET requests from many distinct source IPs to a canary token resource. The URI pattern follows a format indicative of a tracked canary token resource, and the threshold of 49 unique source IPs accessing the resource within a prolonged period suggests potential unauthorized reconnaissance or probing activities.
Detects repeated manual HTTP GET requests from many distinct source IPs to a canary token resource. The URI pattern follows a format indicative of a tracked canary token resource, and the threshold of 49 unique source IPs accessing the resource within a prolonged period suggests potential unauthorized reconnaissance or probing activities.
Detects repeated manual HTTP GET requests from many distinct source IPs to a canary token resource. The URI pattern follows a format indicative of a tracked canary token resource, and the threshold of 49 unique source IPs accessing the resource within a prolonged period suggests potential unauthorized reconnaissance or probing activities.
This rule detects potential reconnaissance activity by identifying IP addresses that generate a high volume of HTTP requests with user agents indicating bots, crawlers, or scanners. It counts requests per IP address within one-hour bins and flags those with 50 or more such requests.
Detects BGP route lookups used to map target IP address blocks
Detects IP geolocation lookups used to gather target network information
Detects WHOIS queries used to gather domain information for reconnaissance
Detects use of WHOIS web services for domain property enumeration
Detects queries to internet-wide scan databases for target infrastructure reconnaissance
Detects high-rate GET requests to contact pages for email harvesting
Detects access to device firmware version pages for vulnerability assessment
This rule detects potential reconnaissance activity by identifying IP addresses that generate a high volume of HTTP requests with user agents indicating bots, crawlers, or scanners. It counts requests per IP address within one-hour bins and flags those with 50 or more such requests.
This rule detects potential reconnaissance activity by identifying IP addresses that generate a high volume of HTTP requests with user agents indicating bots, crawlers, or scanners. It counts requests per IP address within one-hour bins and flags those with 50 or more such requests.
This rule detects attempts to perform a DNS zone transfer. It specifically looks for UDP traffic on port 53 (DNS) destined for the home network, containing the byte sequence "|00 FC|" at an offset of 2 bytes with a depth of 2 bytes. This byte sequence corresponds to the 'AXFR' (Authoritative Zone Transfer) query type in a DNS request, which is often used by attackers for reconnaissance to enumerate DNS records for a domain.
This rule detects DNS zone transfer attempts over TCP. It specifically looks for the byte sequence "|00 FC|" in TCP traffic destined for port 53, which is indicative of a DNS AXFR (zone transfer) request. This activity is often associated with reconnaissance by attackers to gather information about a network's DNS infrastructure.
This rule detects a NetBIOS Name Service enumeration sweep. It triggers an alert when 15 or more UDP packets destined for port 137 (NetBIOS Name Service) on the home network are observed from a single source IP within a 30-second window. This behavior is indicative of an attacker attempting to discover hosts and services on a network.
This rule detects DNS ANY record queries, which can be used for reconnaissance purposes. An ANY record query (QTYPE=255 or 0xFF) requests all available record types for a given domain. While legitimate uses exist, it is often abused by attackers to gather extensive information about a target's DNS infrastructure, making it a common indicator of reconnaissance activity.
Page 1 of 2