Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
4
3
1
Contributors
4
2
1
1
Categories
4
3
3
1
1
Platforms
4
3
1
Products / Services
4
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
This rule detects the negotiation of an export-grade cipher suite during a TCP connection to port 443 (HTTPS). Specifically, it looks for the byte sequence '|00 1B|' at a depth of 2 bytes within the TCP payload, which corresponds to a specific cipher suite identifier often associated with weaker, export-grade cryptography. This could indicate an attempt to downgrade encryption for easier interception or exploitation.
Detects negotiation of weak cipher suites to reduce encryption strength
In this case, I have been researching about the 'curve' value into AdditionalFields field of DeviceNetworkEvents table which I identified into iana.org as two groups 'Elliptic curve' and 'Diffie-Hellman groups'.
These 2 kinds of encryption groups work to secure communication over an insecure channel, are classified by Internet Assigned Numbers Authority (IANA), as if are 'recommended' and the Datagram Transport Layer Security status. In addition, to take into account, the mentioned site mention: "If an item is not marked as 'Recommended', it does not necessarily mean that it is flawed; rather, it indicates that the item either has not been through the IETF consensus process, has limited applicability, or is intended only for specific use cases"
Therefore, this KQL Query is oriented to identify if the current encryption to secure your communications is enough or if due to the level of sensitive of your information, would need to be reviewed.
These 2 kinds of encryption groups work to secure communication over an insecure channel, are classified by Internet Assigned Numbers Authority (IANA), as if are 'recommended' and the Datagram Transport Layer Security status. In addition, to take into account, the mentioned site mention: "If an item is not marked as 'Recommended', it does not necessarily mean that it is flawed; rather, it indicates that the item either has not been through the IETF consensus process, has limited applicability, or is intended only for specific use cases"
Therefore, this KQL Query is oriented to identify if the current encryption to secure your communications is enough or if due to the level of sensitive of your information, would need to be reviewed.
'This detection uses Security events from the "AD FS Auditing" provider to detect suspicious object identifiers (OIDs) as part EventID 501 and specifically part of the Enhanced Key Usage attributes.
This query checks to see if you have any new OIDs in the last hour that have not been seen in the previous day. New OIDs should be validated and OIDs that are very long, as indicated
by the OID_Length field, could also be an indicator of malicious activity.
In order to use this query you need to enable AD FS auditing on the AD FS Server.
References:
https://www.microsoft.com/security/blog/2022/08/24/magicweb-nobeliums-post-compromise-trick-to-authenticate-as-anyone/
https://docs.microsoft.com/windows-server/identity/ad-fs/troubleshooting/ad-fs-tshoot-logging
'
This query checks to see if you have any new OIDs in the last hour that have not been seen in the previous day. New OIDs should be validated and OIDs that are very long, as indicated
by the OID_Length field, could also be an indicator of malicious activity.
In order to use this query you need to enable AD FS auditing on the AD FS Server.
References:
https://www.microsoft.com/security/blog/2022/08/24/magicweb-nobeliums-post-compromise-trick-to-authenticate-as-anyone/
https://docs.microsoft.com/windows-server/identity/ad-fs/troubleshooting/ad-fs-tshoot-logging
'
Detects when an AWS CloudFront distribution is created or updated with an insecure SSL policy, specifically allowing TLSv1, SSLv3, TLSv1_2016, or TLSv1.1_2016. These protocols are considered insecure and can expose data to various attacks.
Detects when an AWS Application Load Balancer (ALB) listener is created or modified to use an insecure SSL policy. Insecure SSL policies can expose communication to vulnerabilities such as weak ciphers or outdated TLS versions, potentially allowing attackers to decrypt sensitive data or perform downgrade attacks. The rule specifically looks for the use of several known insecure or deprecated ELBSecurityPolicy versions during 'ModifyListener' or 'CreateListener' CloudTrail events.
Detects when an insecure SSL policy is configured for an AWS Application Load Balancer.
Detects when an insecure SSL policy is configured for an AWS CloudFront distribution.