Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
26 detections
Filters
Last updated
All Time
Detection languages
17
4
3
1
1
Contributors
8
4
3
3
3
Categories
8
7
7
5
4
Platforms
14
9
3
3
2
Products / Services
8
5
4
3
3
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
3
IDS Protocols
2
1
Detects the use of system utilities (wevtutil, PowerShell, wmic, etc.) or log-reading tools (grep, tail) for log enumeration or export when executed by processes that are not standard management or monitoring agents. This pattern is commonly associated with adversary efforts to gain situational awareness or identify security logs.
Detects anomalous Microsoft Graph API usage patterns where a single account interacts with a high number of unique request paths using common API pagination or search parameters, indicating potential resource enumeration or reconnaissance activity.
Detects high-frequency SMB (Logon Type 3) authentication events targeting Domain Controllers, specifically involving suspicious or generic accounts such as 'ANONYMOUS LOGON', 'Guest', empty usernames, or machine accounts. This behavior is indicative of network reconnaissance, session enumeration, or brute-force attempts targeting the domain.
Detects high-frequency SMB (Logon Type 3) authentication events targeting Domain Controllers, specifically involving suspicious or generic accounts such as 'ANONYMOUS LOGON', 'Guest', empty usernames, or machine accounts. This behavior is indicative of network reconnaissance, session enumeration, or brute-force attempts targeting the domain.
Detects an unusual volume of 'Logging' or 'Monitor' operations within Azure Activity logs from a single caller within an hour. This could indicate an adversary attempting to enumerate logging configurations, monitor activities, or potentially tamper with logging settings as a precursor to other malicious activities or an attempt to cover tracks.
This rule detects the use of system utilities (wevtutil.exe, auditpol.exe, PowerShell) to interact with, query, or check status of security event logs and auditing configurations. While these tools are standard for administration, their usage by non-system accounts can indicate an adversary attempting to understand, monitor, or manipulate system audit policies and event log configurations as part of a reconnaissance or defense evasion strategy.
This rule detects the use of system utilities (wevtutil.exe, auditpol.exe, PowerShell) to interact with, query, or check status of security event logs and auditing configurations. While these tools are standard for administration, their usage by non-system accounts can indicate an adversary attempting to understand, monitor, or manipulate system audit policies and event log configurations as part of a reconnaissance or defense evasion strategy.
This rule detects the use of system utilities (wevtutil.exe, auditpol.exe, PowerShell) to interact with, query, or check status of security event logs and auditing configurations. While these tools are standard for administration, their usage by non-system accounts can indicate an adversary attempting to understand, monitor, or manipulate system audit policies and event log configurations as part of a reconnaissance or defense evasion strategy.
Detects web-based access to log files indicating log tampering attempts
Detects an unusual volume of 'Logging' or 'Monitor' operations within Azure Activity logs from a single caller within an hour. This could indicate an adversary attempting to enumerate logging configurations, monitor activities, or potentially tamper with logging settings as a precursor to other malicious activities or an attempt to cover tracks.
This rule detects attempts to remotely enumerate Windows Event Logs over SMB. It specifically looks for TCP traffic on port 445 (SMB) where the content includes both "eventlog" and "EvtQuery" (case-insensitive), indicating a query for event log information.
This rule detects attempts to query AWS CloudTrail logs for activity discovery. Specifically, it looks for HTTP traffic to 'cloudtrail.amazonaws.com' with the URI containing 'LookupEvents'. This activity could indicate an attacker attempting to understand the environment or their own actions.
Detects an unusual volume of 'Logging' or 'Monitor' operations within Azure Activity logs from a single caller within an hour. This could indicate an adversary attempting to enumerate logging configurations, monitor activities, or potentially tamper with logging settings as a precursor to other malicious activities or an attempt to cover tracks.
This rule detects attempts to enumerate Linux system logs via remote SSH connections. Specifically, it looks for the string "cat /var/log/" within TCP traffic on port 22 (SSH). A threshold of 10 occurrences within 30 seconds from the same source IP is set to reduce false positives.
This rule detects the infected version of CPU-Z, a popular system information tool, which has been compromised and used as a vector for malware infection. The detection is based on specific indicators of compromise (IOCs) related to the malicious version of CPU-Z, like unusual command-line arguments, or known malicious behaviors associated with this tool. Specifically, it looks for `cpuz.exe` spawning `powershell.exe` with suspicious command-line arguments like `[Console]::In.ReadToEnd()` or `Invoke-Expression`, or `csc.exe` spawning `chrome.exe`.
This query is designed to identify any attempts to list or enumerate Windows Security Logs using the command-line tool "wevtutil." It focuses on detecting a specific technique known as "Log Collection" (T1654). Here's a simple breakdown of what the query does:
Time Frame: It looks at data from the past 7 days.
Source: It examines events related to processes on devices (DeviceProcessEvents).
Filter Criteria:
It checks for events where a process was created (ActionType contains "ProcessCreated").
It specifically looks for instances where the process involved is "wevtutil.exe" and the command line used includes "enum-logs."
Output: The query extracts and displays specific details about these events, including:
The name of the device where the event occurred (DeviceName).
The type of action that was recorded (ActionType).
The name of the file involved (FileName).
The full command line that was executed (ProcessCommandLine).
The domain and name of the account that executed the command (AccountDomain, AccountName).
The user principal name and command line of the initiating process (InitiatingProcessAccountUpn, InitiatingProcessCommandLine).
In summary, this query helps security analysts detect and investigate potential unauthorized attempts to access or list Windows Security Logs using the "wevtutil" tool.
Time Frame: It looks at data from the past 7 days.
Source: It examines events related to processes on devices (DeviceProcessEvents).
Filter Criteria:
It checks for events where a process was created (ActionType contains "ProcessCreated").
It specifically looks for instances where the process involved is "wevtutil.exe" and the command line used includes "enum-logs."
Output: The query extracts and displays specific details about these events, including:
The name of the device where the event occurred (DeviceName).
The type of action that was recorded (ActionType).
The name of the file involved (FileName).
The full command line that was executed (ProcessCommandLine).
The domain and name of the account that executed the command (AccountDomain, AccountName).
The user principal name and command line of the initiating process (InitiatingProcessAccountUpn, InitiatingProcessCommandLine).
In summary, this query helps security analysts detect and investigate potential unauthorized attempts to access or list Windows Security Logs using the "wevtutil" tool.
KQL Query from file: Detect Microsoft Graph API Abuse
KQL Query from file: EntraFalcon Detection
KQL Query
'Indicates when an anomalous number of resources are created in Azure via AzureActivity log. Resource creation could indicate malicious or spurious use of your Azure Resource allocation.'
Identify accounts that have logged on to affected endpoints.
Check for specific alerts.
Check for specific alerts.
Page 1 of 2