Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
472 detections
Filters
Last updated
All Time
Detection languages
342
74
19
16
7
Contributors
91
90
77
52
35
Categories
182
148
81
66
60
Platforms
406
68
63
58
26
Products / Services
10,680
9,761
6,694
4,418
3,744
472
MITRE Techniques
180
121
96
78
71
CVEs
6
5
5
5
2
IDS Classtypes
2
1
1
1
1
IDS Protocols
6
'This query identifies attackers trying to enumerate the Storage keys as well as updating roles using AzureActivity,SigninLogs
and AuditLogs'
and AuditLogs'
'Identifies anomalous data transfer to public networks. The query leverages built-in KQL anomaly detection algorithms that detects large deviations from a baseline pattern.
A sudden increase in data transferred to unknown public networks is an indication of data exfiltration attempts and should be investigated.
The higher the score, the further it is from the baseline value.
The output is aggregated to provide summary view of unique source IP to destination IP address and port bytes sent traffic observed in the flagged anomaly hour.
The source IP addresses which were sending less than bytessentperhourthreshold have been exluded whose value can be adjusted as needed .
You may have to run queries for individual source IP addresses from SourceIPlist to determine if anything looks suspicious'
A sudden increase in data transferred to unknown public networks is an indication of data exfiltration attempts and should be investigated.
The higher the score, the further it is from the baseline value.
The output is aggregated to provide summary view of unique source IP to destination IP address and port bytes sent traffic observed in the flagged anomaly hour.
The source IP addresses which were sending less than bytessentperhourthreshold have been exluded whose value can be adjusted as needed .
You may have to run queries for individual source IP addresses from SourceIPlist to determine if anything looks suspicious'
"This Kusto (KQL) hunting query detects blob-enumeration or file-spraying behaviour in Azure Storage by:
- Aggregating requests into time-bound sessions with row_window_session().
- Defining a "user" as the combination of AccountName | UserAgentHeader, which is tolerant of rapid IP rotation.
- Raising an alert when, within any single session:
- The actor touches at least 10 distinct objects, and
- At least 50 % of those requests return an HTTP 4xx/5xx status, and
- Each object is accessed exactly once ("touch-once" pattern typical of enumeration).
All tuning knobs (look-back window, session gap, thresholds, authentication type) are exposed at the top of the query.
Be sure to validate the query against both benign and malicious samples in your own environment before relying on it for production detection.
Reference: https://techcommunity.microsoft.com/blog/microsoftdefendercloudblog/protect-your-storage-resources-against-blob-hunting/3735238"
- Aggregating requests into time-bound sessions with row_window_session().
- Defining a "user" as the combination of AccountName | UserAgentHeader, which is tolerant of rapid IP rotation.
- Raising an alert when, within any single session:
- The actor touches at least 10 distinct objects, and
- At least 50 % of those requests return an HTTP 4xx/5xx status, and
- Each object is accessed exactly once ("touch-once" pattern typical of enumeration).
All tuning knobs (look-back window, session gap, thresholds, authentication type) are exposed at the top of the query.
Be sure to validate the query against both benign and malicious samples in your own environment before relying on it for production detection.
Reference: https://techcommunity.microsoft.com/blog/microsoftdefendercloudblog/protect-your-storage-resources-against-blob-hunting/3735238"
'Indicates when an anomalous number of resources are created in Azure via AzureActivity log. Resource creation could indicate malicious or spurious use of your Azure Resource allocation.'
'Identifies IP addresses performing DNS lookups associated with common ToR proxies.
This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM DNS schema'
This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM DNS schema'
'Looks for file uploads actions to Azure File and Blob Storage from known VPS provider network ranges.
This is not an exhaustive list of VPS provider ranges but covers some of the most prevalent providers observed.'
This is not an exhaustive list of VPS provider ranges but covers some of the most prevalent providers observed.'
'This query helps identify rare DNS connections and resulting data transfer to/from the associated domain. It can help identify unexpected large data transfers to or from internal systems which may indicate data exfil or malicious tool download.'
'Matches domain name IOCs related to Forest Blizzard group activity published July 2019 with CommonSecurityLog, DnsEvents and VMConnection dataTypes.
References: https://blogs.microsoft.com/on-the-issues/2019/07/17/new-cyberthreats-require-new-ways-to-protect-democracy/.'
References: https://blogs.microsoft.com/on-the-issues/2019/07/17/new-cyberthreats-require-new-ways-to-protect-democracy/.'
'Identifies a match for SQL Injection attack in the Application gateway WAF logs. The Threshold value in the query can be changed as per your infrastructure's requirement.
References: https://owasp.org/Top10/A03_2021-Injection/'
References: https://owasp.org/Top10/A03_2021-Injection/'
'This hunting query will try to identify the user account used to perform a file upload to blob storage.
This query can be used to match all file upload events, or filtering can be applied on filename to search for a specific upload.'
This query can be used to match all file upload events, or filtering can be applied on filename to search for a specific upload.'
'Query identifies beaconing patterns from Wire Data logs. Uses KQL functions to calculate time delta and find beaconing percentage. Results of beaconing to untrusted public networks can be investigated.'
'This hunting query will try to identify instances where a file us uploaded to file storage and then deleted
within a given threshold. By default the query will find instances where a file is uploaded and deleted within
5 minutes. This hunting query will help detect automated exfiltration.'
within a given threshold. By default the query will find instances where a file is uploaded and deleted within
5 minutes. This hunting query will help detect automated exfiltration.'
'Identifies a match across various data feeds for hashes and IP IOC related to Europium
Reference: https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government'
Reference: https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government'
'Identifies IP addresses that may be performing DNS lookups associated with common currency mining pools.
This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM DNS schema'
This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM DNS schema'
'This hunting query looks for queries that appear to be looking for secrets or passwords in tables.'
'This hunting query looks for users who have multiple failed queries in a short space of time.'
'Identifies a match across various data feeds for domains related to an actor tracked by Microsoft as Star Blizzard.'
'This hunting query will identify where a file is uploaded to Azure File or Blob storage
and is then accessed once before being deleted. This activity may be indicative of
exfiltration activity.'
and is then accessed once before being deleted. This activity may be indicative of
exfiltration activity.'
This detection identifies when a new packaged application has been added, updated, or deleted within Microsoft Intune. This functionality, while legitimate for software deployment, can be abused by adversaries to deploy malicious payloads to Intune-managed devices.
'Identifies a match for XSS attack in the Application gateway WAF logs. The Threshold value in the query can be changed as per your infrastructure's requirement.
References: https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)'
References: https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)'
'Any Alerts that fired related to a given File during the range of +6h and -3d'
Page 20 of 23