Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
545 detections
Filters
Last updated
All Time
Detection languages
272
102
85
38
17
Contributors
152
88
64
55
44
Categories
97
86
85
85
82
Platforms
299
182
64
41
35
Products / Services
10,665
9,773
6,705
4,421
3,749
545
MITRE Techniques
191
175
144
100
91
CVEs
19
18
12
6
6
IDS Classtypes
21
14
1
1
1
IDS Protocols
37
1
Device Logons from Unknown IP Addresses.
This query identifies device logons from IP addresses not associated with any machine in Defender ATP.
This query identifies device logons from IP addresses not associated with any machine in Defender ATP.
This query is using the locations where malicious DLL images are often loaded from by regsvr32.dll and rundll32.exe.
Blog:
https://threathunt.blog/dll-image-loads-from-suspicious-locations-by-regsvr32-exe-rundll32-exe/
Blog:
https://threathunt.blog/dll-image-loads-from-suspicious-locations-by-regsvr32-exe-rundll32-exe/
'This hunting query looks for file paths/hashes related to observed activity by Dev-0228. The actor is known to use custom version of popular tool like PsExec, Procdump etc. to carry its activity.
The risk score associated with each result is based on a number of factors, hosts with higher risk events should be investigated first.
This query uses the Microsoft Sentinel Information Model - https://docs.microsoft.com/azure/sentinel/normalization'
The risk score associated with each result is based on a number of factors, hosts with higher risk events should be investigated first.
This query uses the Microsoft Sentinel Information Model - https://docs.microsoft.com/azure/sentinel/normalization'
This analytic detects suspicious modifications to Unix shell configuration files, such as `.bashrc` or `.profile`, which may indicate an attempt to alter system behavior or gain unauthorized access. Unauthorized changes to these files can be used to execute malicious commands, escalate privileges, or hide malicious activities. By monitoring for unusual or unauthorized modifications to shell configuration files, this analytic helps identify potential security threats, allowing security teams to respond quickly and mitigate risks.
'This query looks for messages related to file downloads of suspicious file types. This query uses the Exchange HttpProxy AOBGeneratorLog, you will need to onboard this log as a custom log under the table http_proxy_oab_CL before using this query.
Reference: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/'
Reference: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/'
// Author: jan geisbauer
// @janvonkirchheim
// ------------------------
// 1. A list of all devices that have this vulnerability
// 2. A list of all users that uses those devices
// 3. If these users received .mkv files recently
// @janvonkirchheim
// ------------------------
// 1. A list of all devices that have this vulnerability
// 2. A list of all users that uses those devices
// 3. If these users received .mkv files recently
This query was originally published in the threat analytics report, Solorigate supply chain attack. Please note that these attacks are currently known as the Nobelium campaign.
Microsoft detects the 2020 SolarWinds supply chain attack implant and its other components as part of a campaign by the Nobelium activity group. Nobelium is the threat actor behind the attack against SolarWinds, which was previously referred to as Solorigate.
Nobelium silently added malicious code to legitimate software updates for Orion, which is IT monitoring software provided by SolarWinds. In this way, malicious dynamic link libraries (DLLs) were distributed to SolarWinds customers.
The following query detects events when Nobelium received a DNS response after launching a lookup request to known command-and-control infrastructure.
More Nobelium-related queries can be found listed under the See also section of this document.
References:
https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/
Microsoft detects the 2020 SolarWinds supply chain attack implant and its other components as part of a campaign by the Nobelium activity group. Nobelium is the threat actor behind the attack against SolarWinds, which was previously referred to as Solorigate.
Nobelium silently added malicious code to legitimate software updates for Orion, which is IT monitoring software provided by SolarWinds. In this way, malicious dynamic link libraries (DLLs) were distributed to SolarWinds customers.
The following query detects events when Nobelium received a DNS response after launching a lookup request to known command-and-control infrastructure.
More Nobelium-related queries can be found listed under the See also section of this document.
References:
https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/
Finding attackers hiding malware in the recycle bin.
Read more here: https://azure.microsoft.com/blog/how-azure-security-center-helps-reveal-a-cyberattack/.
Tags: #execution #SuspiciousPath.
Read more here: https://azure.microsoft.com/blog/how-azure-security-center-helps-reveal-a-cyberattack/.
Tags: #execution #SuspiciousPath.
In this query, we are looking URL click actions by URL in the last 7 days
This query provides insights on the detections done by SafeLinks protection in Defender for Office 365
'This query will detect paths suspicious associated with ProxyLogon exploitation'
'This query looks for changes to COM registry keys to point to files in C:\Windows\System32\spool\drivers\color\.
This can be used to enable COM hijacking for persistence.
Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/'
This can be used to enable COM hijacking for persistence.
Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/'
This query looks for a Word document attachment, from which a link was clicked, and after which there was a browser download.
This query is not noisy, but most of its results are clean.
It can also hserve as reference for other queries on email attachments, on browser downloads or for queries that join multiple events by time.
Tags: #EmailAttachment, #WordLink, #BrowserDownload, #Phishing, #DedupFileCreate.
Implementation comment #1: Matching events by time.
Matching the 3 different events (saving attachment, clicking on link, downloading file) is done purely by time difference - so could sometimes link together unrelated events.
Doing a more exact lookup would create a much more complex query due to.
Implementation comment #2: Deduping DeviceFileEvents.
Oftentimes there are multiple DeviceFileEvents for a single file - e.g. if the file keeps being appended into before being closed.
So, we query only for the last reported file state to ignore intermediate file states.
Explaining the underlying data:.
BrowserLaunchedToOpenUrl event:.
This query uses the BrowserLaunchedToOpenUrl event, that includes clicks on http:// or https:// links (clicks outside of browsers), or on .lnk files.
For this event, RemoteUrl contains the opened URL.
This query is not noisy, but most of its results are clean.
It can also hserve as reference for other queries on email attachments, on browser downloads or for queries that join multiple events by time.
Tags: #EmailAttachment, #WordLink, #BrowserDownload, #Phishing, #DedupFileCreate.
Implementation comment #1: Matching events by time.
Matching the 3 different events (saving attachment, clicking on link, downloading file) is done purely by time difference - so could sometimes link together unrelated events.
Doing a more exact lookup would create a much more complex query due to.
Implementation comment #2: Deduping DeviceFileEvents.
Oftentimes there are multiple DeviceFileEvents for a single file - e.g. if the file keeps being appended into before being closed.
So, we query only for the last reported file state to ignore intermediate file states.
Explaining the underlying data:.
BrowserLaunchedToOpenUrl event:.
This query uses the BrowserLaunchedToOpenUrl event, that includes clicks on http:// or https:// links (clicks outside of browsers), or on .lnk files.
For this event, RemoteUrl contains the opened URL.
Get stats on ExploitGuard blocks - count events and machines per rule.
This query helps reviewing authentication failure count by authentication type. Update the authentication type below as DMARC, DKIM, SPM, CompAuth
JNLP file extensions are an uncommon file type often used to deliver malware.
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
'This query will detect paths suspicious associated with ProxyLogon exploitation, it will then calculate the percentage of suspicious URIs
the user had visited in relation to the total number of URIs the user has visited. This query will assist in the detection of automated
ProxyLogon exploitation.'
the user had visited in relation to the total number of URIs the user has visited. This query will assist in the detection of automated
ProxyLogon exploitation.'
'Looks for activity that might indicate exploitation of the ProxyToken vulnerability - CVE-2021-33766
Ref: https://www.zerodayinitiative.com/blog/2021/8/30/proxytoken-an-authentication-bypass-in-microsoft-exchange-server'
Ref: https://www.zerodayinitiative.com/blog/2021/8/30/proxytoken-an-authentication-bypass-in-microsoft-exchange-server'
This query was originally published in the threat analytics report, Adwind utilizes Java for cross-platform impact.
Adwind is a remote access tool (RAT) that takes advantage of the cross-platform capabilities of the Java framework. It can check which operating system a target is running and adapt accordingly, allowing it to successfully compromise both Windows and macOS devices.
The query below must be run in Microsoft Defender XDR. This query detects events where a single Java archive, or JAR file, was attached to an incoming email. Since Adwind is distributed as a JAR file, this can help detect the initial access stage of a Adwind attack. Note that, although the behavior detected by this query is typical of attacks that use Adwind malware, unrelated attacks may use the same or similar techniques. Also note that JAR attachments are not necessarily or even often malware, and that further research will be needed to determine if query results are associated with malicious behavior.
See Hiding a Java class file for an additional query that detects behavior associated with Adwind attacks.
Adwind is a remote access tool (RAT) that takes advantage of the cross-platform capabilities of the Java framework. It can check which operating system a target is running and adapt accordingly, allowing it to successfully compromise both Windows and macOS devices.
The query below must be run in Microsoft Defender XDR. This query detects events where a single Java archive, or JAR file, was attached to an incoming email. Since Adwind is distributed as a JAR file, this can help detect the initial access stage of a Adwind attack. Note that, although the behavior detected by this query is typical of attacks that use Adwind malware, unrelated attacks may use the same or similar techniques. Also note that JAR attachments are not necessarily or even often malware, and that further research will be needed to determine if query results are associated with malicious behavior.
See Hiding a Java class file for an additional query that detects behavior associated with Adwind attacks.
This query uncovers seen IPAddressV6 network subnets
Page 20 of 26