Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,577
8,388
6,215
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Intent:
- Use MTP capability to look for insider threat potential risk indicators
- Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
Definition of Insider Threat:
"The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.
- Use MTP capability to look for insider threat potential risk indicators
- Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
Definition of Insider Threat:
"The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.
Intent:
- Use MTP capability to look for insider threat potential risk indicators
- Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
Definition of Insider Threat:
"The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.
- Use MTP capability to look for insider threat potential risk indicators
- Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
Definition of Insider Threat:
"The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.
'This query will detect paths suspicious associated with ProxyLogon exploitation'
'This query identifies exploitation attempts using Pulse Connect Secure(PCS) vulnerability (CVE-2021-22893) to the VPN server'
Bazacall uses malicious Excel files to execute payloads on affected devices.
BazaCall is a campaign that manipulate users into calling a customer support center, where they are instructed to download an Excel file to unsubscribe from a phony service. When the user opens the Excel file, they are prompted to enable a malicious macro that infects their device with BazaLoader.
This query surfaces connections to the distinctive .xyz domains that the BazaCall campaign uses to host malicious Excel files.
This query surfaces connections to the distinctive .xyz domains that the BazaCall campaign uses to host malicious Excel files.
ZLoader was delivered in a campaign in late summer 2021. This campaign was tweeted by @MsftSecIntel on twitter.
This query was originally published in the threat analytics report, Solorigate supply chain attack. Please note that these attacks are currently known as the Nobelium campaign.
Microsoft detects the 2020 SolarWinds supply chain attack implant and its other components as part of a campaign by the Nobelium activity group. Nobelium is the threat actor behind the attack against SolarWinds, which was previously referred to as Solorigate.
Nobelium silently added malicious code to legitimate software updates for Orion, which is IT monitoring software provided by SolarWinds. In this way, malicious dynamic link libraries (DLLs) were distributed to SolarWinds customers.
The following query searches Threat and Vulnerability Management (TVM) data for Orion software known to be affected by the Nobelium campaign.
More Nobelium-related queries can be found listed under the See also section of this document.
References:
https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/
Microsoft detects the 2020 SolarWinds supply chain attack implant and its other components as part of a campaign by the Nobelium activity group. Nobelium is the threat actor behind the attack against SolarWinds, which was previously referred to as Solorigate.
Nobelium silently added malicious code to legitimate software updates for Orion, which is IT monitoring software provided by SolarWinds. In this way, malicious dynamic link libraries (DLLs) were distributed to SolarWinds customers.
The following query searches Threat and Vulnerability Management (TVM) data for Orion software known to be affected by the Nobelium campaign.
More Nobelium-related queries can be found listed under the See also section of this document.
References:
https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/
Sample query that search for .settingcontent-ms that has been downloaded from the web.
Through Microsoft Edge, Internet Explorer, Google Chrome, Mozilla Firefox, Microsoft Outlook.
For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com.
Through Microsoft Edge, Internet Explorer, Google Chrome, Mozilla Firefox, Microsoft Outlook.
For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com.
This query looks for a Word document attachment, from which a link was clicked, and after which there was a browser download.
This query is not noisy, but most of its results are clean.
It can also hserve as reference for other queries on email attachments, on browser downloads or for queries that join multiple events by time.
Tags: #EmailAttachment, #WordLink, #BrowserDownload, #Phishing, #DedupFileCreate.
Implementation comment #1: Matching events by time.
Matching the 3 different events (saving attachment, clicking on link, downloading file) is done purely by time difference - so could sometimes link together unrelated events.
Doing a more exact lookup would create a much more complex query due to.
Implementation comment #2: Deduping DeviceFileEvents.
Oftentimes there are multiple DeviceFileEvents for a single file - e.g. if the file keeps being appended into before being closed.
So, we query only for the last reported file state to ignore intermediate file states.
Explaining the underlying data:.
BrowserLaunchedToOpenUrl event:.
This query uses the BrowserLaunchedToOpenUrl event, that includes clicks on http:// or https:// links (clicks outside of browsers), or on .lnk files.
For this event, RemoteUrl contains the opened URL.
This query is not noisy, but most of its results are clean.
It can also hserve as reference for other queries on email attachments, on browser downloads or for queries that join multiple events by time.
Tags: #EmailAttachment, #WordLink, #BrowserDownload, #Phishing, #DedupFileCreate.
Implementation comment #1: Matching events by time.
Matching the 3 different events (saving attachment, clicking on link, downloading file) is done purely by time difference - so could sometimes link together unrelated events.
Doing a more exact lookup would create a much more complex query due to.
Implementation comment #2: Deduping DeviceFileEvents.
Oftentimes there are multiple DeviceFileEvents for a single file - e.g. if the file keeps being appended into before being closed.
So, we query only for the last reported file state to ignore intermediate file states.
Explaining the underlying data:.
BrowserLaunchedToOpenUrl event:.
This query uses the BrowserLaunchedToOpenUrl event, that includes clicks on http:// or https:// links (clicks outside of browsers), or on .lnk files.
For this event, RemoteUrl contains the opened URL.
This rule detects Okta authentication attempts originating from known VPN providers. Threat actors, particularly those involved in Remote Employment Fraud (REF), often use VPNs to mask their true physical location and evade detection. By identifying connections from a listing of commonly used VPN services, this rule aims to flag potentially suspicious access to Okta accounts. The rule extracts user information, client details, geographical context, and debug data to provide comprehensive insights into the VPN usage.
This query helps reviewing authentication failure count by authentication type. Update the authentication type below as DMARC, DKIM, SPM, CompAuth
Total Submissions by Submission Type
This query helps hunting for good emails from senders with bad patterns
In this detection, we check the sender prevalence over the last 14 days and use the same to detect malicious activity via email containing QR code
In this query, we summarize volume of inbound emails with QR code URLs in last 30 days
This query helps reviewing external top malicious email sender with malware or phishing emails in an organization in last 30 days
This query helps reviewing email malware detection cases
This query provides insights on the detections done by Safe Attachment detections
JNLP file extensions are an uncommon file type often used to deliver malware.
'This query will look for events where guest user was invited but has not accepted/redeemed invite for unusually longer period.
Any invites not redeemed for longer period of time can be misused and pose risk if suspiciously redeemed in other ways'
Any invites not redeemed for longer period of time can be misused and pose risk if suspiciously redeemed in other ways'
Page 207 of 235