Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,577
8,388
6,215
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Show usb mounted devices and drive letters
This query helps reviewing top submitters of admin submissions
'Identifies when a recently created Group was added to a privileged built in domain local group or global group such as the Enterprise Admins, Cert Publishers or DnsAdmins. Be sure to verify this is an expected addition.
References: For AD SID mappings - https://docs.microsoft.com/windows/security/identity-protection/access-control/active-directory-security-groups.'
References: For AD SID mappings - https://docs.microsoft.com/windows/security/identity-protection/access-control/active-directory-security-groups.'
One of the tricks used in phishing is obfuscating the domain name in a URL by
using the @ symbol. This technique goes all the way back to the original RFC
for URLs, RFC 1738. When you specify an @ in the DNS portion of a URL it denotes
that the left side of the DNS name holds a username and password for
authentication to the server on the right side of the @ sign. Unfortunately,
an attacker can use this technique to trick a user by formatting the URL as
http://www.trusteddomain.com@www.realdomain.com/. When a user sees the link
may they think they're going to www.trusteddomain.com when in fact they are
going to www.realdomain.com. For a working example, try this:
http://www.google.com@www.bing.com/.
This query finds this technique in URLs embedded within e-mails and highlights
the fake and real domains.
using the @ symbol. This technique goes all the way back to the original RFC
for URLs, RFC 1738. When you specify an @ in the DNS portion of a URL it denotes
that the left side of the DNS name holds a username and password for
authentication to the server on the right side of the @ sign. Unfortunately,
an attacker can use this technique to trick a user by formatting the URL as
http://www.trusteddomain.com@www.realdomain.com/. When a user sees the link
may they think they're going to www.trusteddomain.com when in fact they are
going to www.realdomain.com. For a working example, try this:
http://www.google.com@www.bing.com/.
This query finds this technique in URLs embedded within e-mails and highlights
the fake and real domains.
This query identifies web content filtering events in Advanced Hunting.
This rule detects user logins from multiple distinct states or countries within a one-hour window, leveraging GeoIP enrichment. It specifically looks for successful login events where a user logs in from at least two different states or at least one country, indicating potential 'impossible travel' or suspicious access patterns.
URLs clicked in Email
Qakbot operators have been abusing the Craigslist messaging system to send malicious emails. These emails contain non-clickable links to malicious domains impersonating Craigslist, which the user is instructed to manually type into the address bar to access.
Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP. This activity can indicate an attacker exploiting a public-facing application to gain initial access and execute arbitrary commands.
Identify emails that were send from an address external to your company and where email was send to more then 50 distinct corporate users.
Update corporatedomain.com to your corporate domain to have it excluded.
Update 50 if you want to adjust the distinct user count.
Update corporatedomain.com to your corporate domain to have it excluded.
Update 50 if you want to adjust the distinct user count.
Count of recipient's email addresses by subject
Count of recipient's email addresses by subject
Count of sender's email addresses by subject
This analytic identifies outbound LDAP traffic to external IP addresses. It leverages network traffic data to detect connections on ports 389 (LDAP) or 636 (LDAPS) that are not directed to private IP ranges (RFC1918). This activity is significant because outbound LDAP traffic can indicate potential data exfiltration or unauthorized access attempts. If confirmed malicious, attackers could exploit this to access sensitive directory information, leading to data breaches or further network compromise. The rule specifically excludes traffic between internal source and destination IPs.
This rule detects successful user logins where the user's termination date is in the past, indicating a login from a terminated employee. This could signify unauthorized access or a failure in account deprovisioning processes. The rule requires a context data source that provides user termination dates, such as Azure AD Context or Workday.
This rule detects outbound network connections to IP addresses that have been observed for the first time within the last 24 hours. It specifically excludes connections to private IP address ranges (RFC1918). The detection relies on correlating current network connection events with historical 'first seen' data for IP addresses from an entity graph.
This rule detects attempts to execute files from external WebDAV shares. It specifically looks for HTTP GET requests where the User-Agent header starts with 'Microsoft-WebDAV-MiniRedir/' and the requested URI ends with common executable or script file extensions. This behavior is often observed in initial access campaigns where adversaries leverage WebDAV to deliver and execute malicious payloads.
Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, or a set of spaces or underlines to cloak the executable file, often used in spear phishing campaigns to trick users into executing malicious files.
Detects DNS queries initiated by "QuickAssist.exe" to the Microsoft Quick Assist primary endpoint. This activity is often associated with social engineering attacks leading to ransomware, where threat actors misuse Quick Assist to gain remote access to a victim's system.
This rule detects the creation of specific files associated with the Octopus Scanner malware. The malware creates files named 'Cache134.dat' and 'ExplorerSync.db' within the user's local AppData\Microsoft directory. This activity is indicative of the malware's presence and operation.
Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation. This rule specifically looks for common web server processes (Caddy, Apache HTTPD, Nginx, PHP, Tomcat, IIS, Exchange UMWorkerProcess) or Java processes identified as Tomcat, spawning anomaly children processes like command-line interpreters (cmd.exe, powershell.exe, bash.exe), network utilities (net.exe, netsh.exe), or other system utilities often used in post-exploitation.
Page 211 of 235