Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
4
4
Contributors
4
2
1
1
Categories
5
1
1
1
Platforms
6
2
1
Products / Services
4
1
1
1
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
3
1
IDS Protocols
1
1
1
1
This rule detects potential automated subdomain enumeration by monitoring for a high volume of DNS queries (200 or more within 60 seconds) originating from a single host. Such behavior is characteristic of reconnaissance activities used to discover subdomains and map out network infrastructure.
Detects TCP SYN sweeping across multiple hosts for network topology mapping
This rule detects network host discovery attempts using a TCP SYN sweep. It triggers when a source IP sends 30 or more TCP SYN packets (indicated by the 'flags:S' option) to any destination on the HOME_NET within a 10-second window. This behavior is characteristic of an attacker attempting to identify active hosts on a network by sending SYN packets and observing which hosts respond with a SYN-ACK.
This rule detects network topology discovery attempts via ICMP host sweeps. It triggers an alert when a source IP sends 50 or more ICMP echo requests (type 8) within a 10-second window to the local network. This behavior is indicative of an attacker trying to identify active hosts on a network.
This rule detects network host discovery attempts via UDP sweeps. It triggers an alert when a single source IP sends 30 or more UDP packets within a 10-second window to various destinations on the home network. This behavior is indicative of an attacker attempting to map out active hosts on a network.
Detects possible MuddyWater related activity in Microsoft Defender XDR Advanced Hunting by correlating suspicious process, network, file, and logon telemetry into a unified timeline. The hunt focuses on behaviours reported in the Huntress MuddyWater attack chain, including Remote Desktop logons, reconnaissance commands, OpenSSH reverse tunnelling, suspicious network connections, and possible DLL side loading involving FMAPP.exe and FMAPP.dll.
This query is a function that consumes the publicly available Azure IP address list and checks a list of remote IP addresses against it to see if they are Azure IP addresses or not.
To use this, replace the demo portion of the query (DeviceNetworkEvents | take 10000) with your query with the column name of the IP address to check named RemoteIP. The function will add a new column to the end called IsAzure denoting if the IP address range is in the published list or not.
Please note that over time the URL to the Azure IP address list may need to be updated.
To use this, replace the demo portion of the query (DeviceNetworkEvents | take 10000) with your query with the column name of the IP address to check named RemoteIP. The function will add a new column to the end called IsAzure denoting if the IP address range is in the published list or not.
Please note that over time the URL to the Azure IP address list may need to be updated.
This query uncovers seen IPAddressV6 network subnets