Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
368 detections
Filters
Last updated
All Time
Detection languages
165
76
61
21
19
Contributors
104
64
59
35
30
Categories
109
79
71
56
40
Platforms
349
9
5
3
2
Products / Services
10,665
9,773
6,705
4,421
3,749
368
MITRE Techniques
128
87
68
40
36
CVEs
7
5
5
2
2
IDS Classtypes
1
IDS Protocols
1
Detects failed logon attempts from clients with external network IP to an MSSQL server. This can be a sign of a bruteforce attack.
Detects the invocation of MS SQL transactions that are destructive towards table or database data, such as "DROP TABLE" or "DROP DATABASE".
Detects when the MSSQL "xp_cmdshell" stored procedure setting is changed.
This rule detects a suspicious crash of the Microsoft Malware Protection Engine
This rule detects the execution of the extended storage procedure backdoor named Maggie in the context of Microsoft SQL server
Detects when an attacker calls the "ALTER SERVER AUDIT" or "DROP SERVER AUDIT" transaction in order to delete or disable audit logs on the server
Detects PoC tool used to exploit LPE vulnerability CVE-2021-41379
This query was originally published in the threat analytics report, WDigest credential harvesting.
WDigest is a legacy authentication protocol dating from Windows XP. While still used on some corporate networks, this protocol can be manipulated by attackers to dump system credentials.
The Microsoft Security Response Center published an overview of KB2871997, which addresses WDigest use on older platforms. More recent versions of Windows can be protected with a holistic security approach that follows the principle of least privilege.
The following query returns any attempts to turn WDigest credential caching on through the registry.
References:
https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2003/cc778868(v=ws.10)?redirectedfrom=MSDN
https://msrc-blog.microsoft.com/2014/06/05/an-overview-of-kb2871997/
https://www.catalog.update.microsoft.com/Search.aspx?q=KB2871997
https://docs.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models
WDigest is a legacy authentication protocol dating from Windows XP. While still used on some corporate networks, this protocol can be manipulated by attackers to dump system credentials.
The Microsoft Security Response Center published an overview of KB2871997, which addresses WDigest use on older platforms. More recent versions of Windows can be protected with a holistic security approach that follows the principle of least privilege.
The following query returns any attempts to turn WDigest credential caching on through the registry.
References:
https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2003/cc778868(v=ws.10)?redirectedfrom=MSDN
https://msrc-blog.microsoft.com/2014/06/05/an-overview-of-kb2871997/
https://www.catalog.update.microsoft.com/Search.aspx?q=KB2871997
https://docs.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models
Detects file being transferred via ScreenConnect RMM
Detects potential abuse of ntdsutil to dump ntds.dit database to a suspicious location
Detects when an attacker tries to backdoor the MSSQL server by adding a backdoor account to the sysadmin fixed server role
Detects installation of a remote msi file from web.
Detects restricted access to applications by the Software Restriction Policies (SRP) policy
'This hunting query uses Application events from the "MSSQL$MICROSOFT##WID" provider to collect SQL statements run against an AD FS database (e.g Windows Internal Database (WID)).
A threat actor might want to extract the AD FS data configuration settings with a SQL statement or modify it with an UPDATE SQL statement.
In order to use this query you need to create a server audit and database audit specification on your AD FS database.
Reference: https://github.com/Azure/SimuLand/blob/main/3_simulate_detect/credential-access/exportADFSTokenSigningCertificate.md
Reference: https://o365blog.com/post/adfs/
'
A threat actor might want to extract the AD FS data configuration settings with a SQL statement or modify it with an UPDATE SQL statement.
In order to use this query you need to create a server audit and database audit specification on your AD FS database.
Reference: https://github.com/Azure/SimuLand/blob/main/3_simulate_detect/credential-access/exportADFSTokenSigningCertificate.md
Reference: https://o365blog.com/post/adfs/
'
This query looks for signs of impacket dcomexec module.
Author: Jouni Mikkola
More info: https://threathunt.blog/impacket-part-2/
Author: Jouni Mikkola
More info: https://threathunt.blog/impacket-part-2/
'Identifies instances where Wazuh logged over 400 '403' Web Errors from one IP Address. To onboard Wazuh data into Sentinel please view: https://github.com/wazuh/wazuh-documentation/blob/master/source/azure/monitoring%20activity.rst'
Detects corrupted packets sent to the MSMQ service. Could potentially be a sign of CVE-2023-21554 exploitation
Detects a crash of "WinRAR.exe" where the version is lower than 6.23. This could indicate potential exploitation of CVE-2023-40477
Ntdsutil Abuse
Sigma
Detects potential abuse of ntdsutil to dump ntds.dit database
Detects when the MSSQL "xp_cmdshell" stored procedure is used to execute commands
Detects failed logon attempts from clients to MSSQL server.
Page 12 of 18