Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
This query visualises the daily amount of emails that had a post delivery action from zero-hour auto purge.
This query visualises emails released from quarantine and summarizing the result by the original filter verdict
Detects ScreenConnect program starts that establish a remote access to a system.
Detects failed logins with multiple valid domain accounts from a single source system using the NTLM protocol.
'This query helps detect new Microsoft Entra ID sign in from a new location correlating with Office Activity data highlighting cases where user mails are being forwarded and shows if it is being forwarded to external domains as well.'
This query lists files copied to USB external drives with USB drive information based on FileCreated events associated with most recent USBDriveMount events befor file creations. But be aware that Advanced Hunting is not monitoring all the file types.
USB Device Plugged
Sigma
Detects plugged/unplugged USB devices
This query looks for users sharing access to files with external users.
This applies to SharePoint and OneDrive users.
Audit event and Cloud application identifier references.
Reference - https://learn.microsoft.com/microsoft-365/compliance/audit-log-sharing?view=o365-worldwide
Reference - https://learn.microsoft.com/azure/sentinel/entities-reference#cloud-application-identifiers
This applies to SharePoint and OneDrive users.
Audit event and Cloud application identifier references.
Reference - https://learn.microsoft.com/microsoft-365/compliance/audit-log-sharing?view=o365-worldwide
Reference - https://learn.microsoft.com/azure/sentinel/entities-reference#cloud-application-identifiers
Detects an unexpected process spawning from dns.exe which may indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)
In this detection,we hunt for any sign-in attempt from a non-managed, non-compliant, untrusted device.
'This hunting query looks in Azure Web Application Firewall data to find possible SpringShell Exploitation Attempt (CVE-2022-22965).
The Spring Framework is one of the most widely used lightweight open-source framework for Java. To exploit the vulnerability attackers can
send a specially crafted query to a web server running the Spring Core framework to change the target of logging facility and create a new
malicious JSP file in a location accessible by http requests. Attackers then make requests to the malicious backdoor to run system commands.
Reference: https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/'
The Spring Framework is one of the most widely used lightweight open-source framework for Java. To exploit the vulnerability attackers can
send a specially crafted query to a web server running the Spring Core framework to change the target of logging facility and create a new
malicious JSP file in a location accessible by http requests. Attackers then make requests to the malicious backdoor to run system commands.
Reference: https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/'
This query visualises the amount of spam emails that are quarantined, summarized daily by the detection method
'Malware authors will sometimes hardcode user agent string values when writing the network communication component of their malware. Malformed user agents can be an indication of such malware.'
Detects potential initial exploitation attempts against VMware Horizon deployments running a vulnerable versions of Log4j.
'This query identifies attackers trying to enumerate the Storage keys as well as updating roles using AzureActivity,SigninLogs
and AuditLogs'
and AuditLogs'
Detects a source system failing to authenticate against a remote host with multiple users.
Detects failed logins with multiple accounts from a single process on the system.
Detects an installation of a device that is forbidden by the system policy
Detects DNS queries initiated by "QuickAssist.exe" to Microsoft Quick Assist primary endpoint that is used to establish a session.
Detects Winword starting uncommon sub process csc.exe as used in exploits for CVE-2017-8759
This query looks for Teams messages from an external user with a suspicious display name.
Page 186 of 235