Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
545 detections
Filters
Last updated
All Time
Detection languages
272
102
85
38
17
Contributors
152
88
64
55
44
Categories
97
86
85
85
82
Platforms
299
182
64
41
35
Products / Services
10,665
9,773
6,705
4,421
3,749
545
MITRE Techniques
191
175
144
100
91
CVEs
19
18
12
6
6
IDS Classtypes
21
14
1
1
1
IDS Protocols
37
1
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Backdoor processes associated with OceanLotus Mac malware backdoor dropper.
References:.
Https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/.
OS Platforms: Macintosh.
References:.
Https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/.
OS Platforms: Macintosh.
Query for links opened from mail apps - if a detection occurred right afterwards.
As there are many links opened from mails, to have a successful hunt we should have some filter or join with some other signal,.
Such as suspicious processes, network connections, etc.
Therefore, in this example, we query for alerts that might be related to links sent via email.
This could be indicative of a phishing or spear-phishing attacks.
Tags: #EmailLink, #Phishing, #GetNearbyAlerts.
Explaining the underlying data:.
This query uses the BrowserLaunchedToOpenUrl event, that includes clicks on http:// or https:// links (clicks outside of browsers), or on .lnk files.
For this event, RemoteUrl contains the opened URL.
As there are many links opened from mails, to have a successful hunt we should have some filter or join with some other signal,.
Such as suspicious processes, network connections, etc.
Therefore, in this example, we query for alerts that might be related to links sent via email.
This could be indicative of a phishing or spear-phishing attacks.
Tags: #EmailLink, #Phishing, #GetNearbyAlerts.
Explaining the underlying data:.
This query uses the BrowserLaunchedToOpenUrl event, that includes clicks on http:// or https:// links (clicks outside of browsers), or on .lnk files.
For this event, RemoteUrl contains the opened URL.
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
This query correlates Microsoft Defender for Office 365 signals and Microsoft Entra ID identity data to find the relevant endpoint event BrowerLaunchedToOpen in Microsoft Defender ATP.
This event reflects relevant clicks on the malicious URL in the spear-phishing email recognized by Microsoft Defender for Office 365.
This event reflects relevant clicks on the malicious URL in the spear-phishing email recognized by Microsoft Defender for Office 365.
This query identifies when a user clicks a link that opens a browser to navigate to a URL
which uses redirection. It then filters out any redirections to URLs in the same DNS namespace
as the originating URL. Redirection identification is done based on URL query parameters
outlined in the following article: https://www.bleepingcomputer.com/news/security/snapchat-amex-sites-abused-in-microsoft-365-phishing-attacks/
which uses redirection. It then filters out any redirections to URLs in the same DNS namespace
as the originating URL. Redirection identification is done based on URL query parameters
outlined in the following article: https://www.bleepingcomputer.com/news/security/snapchat-amex-sites-abused-in-microsoft-365-phishing-attacks/
This query helps reviewing list of top users click on Phis URLs
Detects log entries that appear in exploitation attempts against MS Exchange RCE CVE-2021-42321
Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to place a webshell or the needed role assignment for it
Detects specific patterns found after a successful ProxyLogon exploitation in relation to a Commandlet invocation of Set-OabVirtualDirectory
Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be used to place a webshell
Microsoft has observed threat actors exploiting vulnerabilities associated with Log4J.
The MailItemsAccessed action is part of the new Advanced Audit functionality of Microsoft Defender XDR. It's part of Exchange mailbox auditing and is enabled by default for users that have an Office 365 or Microsoft 365 E5 license, or for organizations with a Microsoft 365 E5 Compliance add-on subscription.
If more than 1,000 MailItemsAccessed audit records are generated in less than 24 hours, Exchange Online will stop generating auditing records for MailItemsAccessed activity. When a mailbox is throttled, MailItemsAccessed activity will not be logged for 24 hours after the mailbox was throttled. If this occurs, there's a potential that mailbox could have been compromised during this period. The recording of MailItemsAccessed activity will be resumed following a 24-hour period.
The query is looking for MailItemsAccessed Throttling events where the operation is done by a ClientApplication.
See The MailItemsAccessed mailbox auditing action.
Reference - https://docs.microsoft.com/microsoft-365/compliance/mailitemsaccessed-forensics-investigations?view=o365-worldwide#the-mailitemsaccessed-mailbox-auditing-action
If more than 1,000 MailItemsAccessed audit records are generated in less than 24 hours, Exchange Online will stop generating auditing records for MailItemsAccessed activity. When a mailbox is throttled, MailItemsAccessed activity will not be logged for 24 hours after the mailbox was throttled. If this occurs, there's a potential that mailbox could have been compromised during this period. The recording of MailItemsAccessed activity will be resumed following a 24-hour period.
The query is looking for MailItemsAccessed Throttling events where the operation is done by a ClientApplication.
See The MailItemsAccessed mailbox auditing action.
Reference - https://docs.microsoft.com/microsoft-365/compliance/mailitemsaccessed-forensics-investigations?view=o365-worldwide#the-mailitemsaccessed-mailbox-auditing-action
This query was originally published in the threat analytics report, Python abuse on macOS
The Python programming language comes bundled with macOS. In threat intelligence gathered from macOS endpoints, we have observed numerous attacks run with EmPyre, a Python-based post-exploitation framework similar to PowerShell Empire for Windows.
The following query checks for Microsoft Office documents that run Python scripts.
Reference - https://www.powershellempire.com/
The Python programming language comes bundled with macOS. In threat intelligence gathered from macOS endpoints, we have observed numerous attacks run with EmPyre, a Python-based post-exploitation framework similar to PowerShell Empire for Windows.
The following query checks for Microsoft Office documents that run Python scripts.
Reference - https://www.powershellempire.com/
In this detection, we track emails with personalized subjects.
This hunting query looks for hosts exporting a mailbox from an on-prem Exchange server, followed by
that same host removing the export within a short time window. This pattern has been observed by attackers
when exfiltrating emails from a target environment. A Mailbox export is unlikely to be a common command run so look for
activity from unexpected hosts and accounts.
Reference: https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/
Query insprired by Azure Sentinel detection https://github.com/Azure/Azure-Sentinel/blob/master/Hunting%20Queries/SecurityEvent/HostExportingMailboxAndRemovingExport.yaml
that same host removing the export within a short time window. This pattern has been observed by attackers
when exfiltrating emails from a target environment. A Mailbox export is unlikely to be a common command run so look for
activity from unexpected hosts and accounts.
Reference: https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/
Query insprired by Azure Sentinel detection https://github.com/Azure/Azure-Sentinel/blob/master/Hunting%20Queries/SecurityEvent/HostExportingMailboxAndRemovingExport.yaml
Bazacall malware uses emails that contain a phone number for the user to call in order to cancel a fake subscription. These emails contain no links or attachments, and use automatic payment lures to trick users into contacting the number included in the email.
This query was originally published in the threat analytics report, OSX/Shlayer sustains adware push.
Shlayer is adware that spies on users' search terms, and redirects network traffic to serve the user attacker-controlled search results containing ads.
The following query locates activity associated with the Shlayer payload decrypter.
Reference - https://www.intego.com/mac-security-blog/osxshlayer-new-mac-malware-comes-out-of-its-shell/
Shlayer is adware that spies on users' search terms, and redirects network traffic to serve the user attacker-controlled search results containing ads.
The following query locates activity associated with the Shlayer payload decrypter.
Reference - https://www.intego.com/mac-security-blog/osxshlayer-new-mac-malware-comes-out-of-its-shell/
This query helps reviewing malicious email detections by detection methods
This query helps reviewing count of users attacked more than x times average.
This query displays the configuration auditing for 'Safe Attachments for SharePoint, OneDrive, and Microsoft Teams' and 'Safe Documents' in Microsoft Defender for Office 365.
Page 18 of 26