Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,577
8,388
6,220
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
This query visualises total emails with Malware detections summarizing the data by ThreatNames of the malware detected.
This query visualises total emails with Phish detections over time summarizing the data daily by various Phish Detection technologies/controls
This query was originally published in the threat analytics report, Cypherpunk ransomware leaves wake of tampered AVs.
Cypherpunk is a human-operated ransomware campaign named after the unusual .cypherpunk extension given to encrypted files.
The query below surfaces commands that follow the distinctive pattern Cypherpunk operators would use to remotely execute code.
Cypherpunk is a human-operated ransomware campaign named after the unusual .cypherpunk extension given to encrypted files.
The query below surfaces commands that follow the distinctive pattern Cypherpunk operators would use to remotely execute code.
This query generates process trees of given processes and performs anomaly detection on the process trees. It generates process trees up to 7th level.
The query can be used as a template to perform anomaly detection on specific processes like winword.exe, powerpnt.exe, w3wp.exe, etc. The query runs without any performance issues in large environments.
Detailed explanation can be found here
Reference - https://mergene.medium.com/detecting-threats-with-process-tree-analysis-without-machine-learning-838d85f78b2c
The query can be used as a template to perform anomaly detection on specific processes like winword.exe, powerpnt.exe, w3wp.exe, etc. The query runs without any performance issues in large environments.
Detailed explanation can be found here
Reference - https://mergene.medium.com/detecting-threats-with-process-tree-analysis-without-machine-learning-838d85f78b2c
This query helps reviewing incoming email messages where the Display Name of the sender contains own or other partner company/brand name
This query shows information about high confidence phish email that has been released from the Quarantine.
Intent:
- Use MTP capability to look for insider threat potential risk indicators
- Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
Definition of Insider Threat:
"The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.
- Use MTP capability to look for insider threat potential risk indicators
- Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
Definition of Insider Threat:
"The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.
This query detects attempts to add attacker devices as allowed IDs for active sync using the Set-CASMailbox command.
This technique was seen in relation to Solorigate attack but the results can indicate potential malicious activity used in different attacks.
- Note that this query can be changed to use the KQL "has_all" operator, which hasn't yet been documented officially, but will be soon.
In short, "has_all" will only match when the referenced field has all strings in the list.
- Refer to Set-CASMailbox syntax: https://docs.microsoft.com/powershell/module/exchange/set-casmailbox?view=exchange-ps
This technique was seen in relation to Solorigate attack but the results can indicate potential malicious activity used in different attacks.
- Note that this query can be changed to use the KQL "has_all" operator, which hasn't yet been documented officially, but will be soon.
In short, "has_all" will only match when the referenced field has all strings in the list.
- Refer to Set-CASMailbox syntax: https://docs.microsoft.com/powershell/module/exchange/set-casmailbox?view=exchange-ps
ZLoader was delivered in a campaign in late summer 2021 using malvertising to download malicious .msi files onto affected machines. This campaign was originally tweeted by @MsftSecIntel on Twitter.
In this campaign, the malicious .msi files create registry keys that use that attacker-created comapny names.
In this campaign, the malicious .msi files create registry keys that use that attacker-created comapny names.
'This query looks for messages related to file downloads of suspicious file types on an Exchange Server. This could indicate attempted deployment of webshells.
This query uses the Exchange HttpProxy AOBGeneratorLog, you will need to onboard this log as a custom log under the table http_proxy_oab_CL before using this query.
This log is commonly found at C:\Program Files\Microsoft\Exchange Server\V15\Logging\OABGeneratorLog on the Exchange server. Details on collecting custom logs into Sentinel
can be found here: https://learn.microsoft.com/azure/sentinel/connect-custom-logs
This query uses the Exchange HttpProxy AOBGeneratorLog, you will need to onboard this log as a custom log under the table http_proxy_oab_CL before using this query.
This log is commonly found at C:\Program Files\Microsoft\Exchange Server\V15\Logging\OABGeneratorLog on the Exchange server. Details on collecting custom logs into Sentinel
can be found here: https://learn.microsoft.com/azure/sentinel/connect-custom-logs
'Detects a successful logon by a privileged account from an ASN not logged in from in the last 14 days.
Monitor these logons to ensure they are legitimate and identify if there are any similar sign ins.'
Monitor these logons to ensure they are legitimate and identify if there are any similar sign ins.'
Detects Winword starting uncommon sub process csc.exe as used in exploits for CVE-2017-8759
Detects outlook initiating connection to a WebDAV or SMB share, which could be a sign of CVE-2023-23397 exploitation.
Detects potential exploitation attempt of CVE-2022-22954, a remote code execution vulnerability in VMware Workspace ONE Access and Identity Manager.
As reported by Morphisec, part of the attack chain, threat actors used PowerShell commands that executed as a child processes of the legitimate Tomcat "prunsrv.exe" process application.
As reported by Morphisec, part of the attack chain, threat actors used PowerShell commands that executed as a child processes of the legitimate Tomcat "prunsrv.exe" process application.
Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation
Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.
Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)
This query helps reviewing emails accessed by end users using cloud app events data
The Reset-ComputerMachinePassword cmdlet changes the computer account password that the computers use to authenticate to the domain controllers in the domain.
You can use it to reset the password of the local computer.
You can use it to reset the password of the local computer.
Detects suspicious processes logging on with explicit credentials
Detects exploitation attempt of Cleo's CVE-2024-50623 by looking for a "cmd.exe" process spawning from the Celo software suite with suspicious Powershell commandline.
Page 195 of 235