Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
19 detections
Filters
Last updated
All Time
Detection languages
11
6
2
Contributors
5
4
4
2
2
Categories
7
3
3
2
2
Platforms
8
4
4
4
2
Products / Services
4
4
2
2
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
IDS Classtypes
2
IDS Protocols
2
Detects anomalous GitHub activity where a single actor interacts with 20 or more unique repositories within a 24-hour period. This behavior is indicative of potential repository scraping, unauthorized data harvesting, or mass configuration changes associated with reconnaissance or exfiltration activity.
KQL Query from file: The Hunt for QR Phisher
This rule detects HTTP requests to github.com that contain sensitive file names or patterns in the URI, such as '.env', 'config.php', 'credentials', 'secrets', or 'api_key'. This activity could indicate an attacker or malicious actor searching for sensitive information exposed in public or private GitHub repositories.
This rule detects potential GitHub organization repository enumeration by monitoring HTTP traffic to api.github.com with URIs containing '/orgs/'. A threshold of 20 requests within 60 seconds from a single source IP address is used to trigger an alert, indicating a possible network scan or reconnaissance activity targeting GitHub organizations.
KQL Query from file: The Hunt for QR Phisher
KQL Query from file: defendnot detection
KQL Query from file: Remote code execution exploit chain in OpenVPN
KQL Query from file: Entra QR Code Sign-In KQL Detection
KQL Query
'Detects potentially malicious Visual Studio Code (VSCode) extensions installed on a users system, which threat actors might use to control devices and exfiltrate personal information.
Ref: https://blog.checkpoint.com/securing-the-cloud/malicious-vscode-extensions-with-more-than-45k-downloads-steal-pii-and-enable-backdoors/'
Ref: https://blog.checkpoint.com/securing-the-cloud/malicious-vscode-extensions-with-more-than-45k-downloads-steal-pii-and-enable-backdoors/'
Suspicious Git Clone
Sigma
Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious
'The query looks for source code files being modified immediately after a build process is started. The purpose of this is to look for malicious code injection during the build process.
More details: https://techcommunity.microsoft.com/t5/azure-sentinel/monitoring-the-software-supply-chain-with-azure-sentinel/ba-p/2176463'
More details: https://techcommunity.microsoft.com/t5/azure-sentinel/monitoring-the-software-supply-chain-with-azure-sentinel/ba-p/2176463'
Suspicious Git Clone
Sigma
Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious
Intent:
- Use MTP capability to look for insider threat potential risk indicators
- Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
Definition of Insider Threat:
"The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.
- Use MTP capability to look for insider threat potential risk indicators
- Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
Definition of Insider Threat:
"The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.
In this query, we hunt for inbound emails having URLs from QR codes and send by non-prevalent senders
This rule detects the execution of the 'git clone' command on Linux systems when the command line arguments contain suspicious keywords. These keywords are indicative of activities related to exploits, vulnerabilities, remote code execution (RCE), or proof-of-concept (PoC) code for known vulnerabilities like ProxyShell, Log4Shell, and EternalBlue. The rule aims to identify attempts by adversaries to download malicious or exploit-related code from remote repositories.
This rule detects the execution of 'git.exe' or 'git-remote-https.exe' when attempting to clone a remote repository. The detection is specifically triggered if the command line arguments contain keywords commonly associated with exploits, vulnerabilities, or proof-of-concept code, such as 'exploit', 'Vulns', 'vulnerability', 'RemoteCodeExecution', 'Invoke-', 'CVE-', 'poc-', 'ProofOfConcept', 'proxyshell', 'log4shell', 'eternalblue', 'eternal-blue', or 'MS17-'. This aims to identify reconnaissance activities where adversaries might be searching for or downloading publicly available exploit code.
Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious
Suspicious Git Clone
Sigma
Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious