Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
472 detections
Filters
Last updated
All Time
Detection languages
342
74
19
16
7
Contributors
91
90
77
52
35
Categories
182
148
81
66
60
Platforms
406
68
63
58
26
Products / Services
10,680
9,761
6,694
4,418
3,744
472
MITRE Techniques
180
121
96
78
71
CVEs
6
5
5
5
2
IDS Classtypes
2
1
1
1
1
IDS Protocols
6
'This hunting query looks for anomalously large LA queries by users.'
'This hunting query looks for new Service Principals running queries that have not previously been seen running queries.'
'This hunting query looks for clients running queries that have not previously been seen running queries.'
This query is a function that consumes the publicly available Azure IP address list and checks a list of remote IP addresses against it to see if they are Azure IP addresses or not.
To use this, replace the demo portion of the query (DeviceNetworkEvents | take 10000) with your query with the column name of the IP address to check named RemoteIP. The function will add a new column to the end called IsAzure denoting if the IP address range is in the published list or not.
Please note that over time the URL to the Azure IP address list may need to be updated.
To use this, replace the demo portion of the query (DeviceNetworkEvents | take 10000) with your query with the column name of the IP address to check named RemoteIP. The function will add a new column to the end called IsAzure denoting if the IP address range is in the published list or not.
Please note that over time the URL to the Azure IP address list may need to be updated.
'Under specific circumstances, executing KQL queries can exfiltrate information like access tokens, regarding external data functions like adx().
This query tries to list executed KQL queries that used the adx() function and where an access token might have been exposed to.
Ref: https://docs.microsoft.com/azure/azure-monitor/logs/azure-monitor-data-explorer-proxy
Ref: https://securecloud.blog/2022/04/27/azure-monitor-malicious-kql-query/'
This query tries to list executed KQL queries that used the adx() function and where an access token might have been exposed to.
Ref: https://docs.microsoft.com/azure/azure-monitor/logs/azure-monitor-data-explorer-proxy
Ref: https://securecloud.blog/2022/04/27/azure-monitor-malicious-kql-query/'
'This hunting query looks for users who are running multiple queries that return either a very large
amount of data or the maximum amount allowed by the query method.'
amount of data or the maximum amount allowed by the query method.'
'This hunting query looks for increases in the number of workspaces queried by a user.'
This query monitors for users running Log Analytics queries that contain filters for specific, defined VIP user accounts or the VIPUser watchlist template.
Use this detection to alert for users specifically searching for activity of sensitive users.
Use this detection to alert for users specifically searching for activity of sensitive users.
'Identifies if an AV scan fails in Azure App Services.'
'This hunting query looks for users whose total returned data that is significantly above their average.'
'This hunting query looks for users who have run queries that have not previously been seen running queries.'
'Identifies if an AV scan finds infected files in Azure App Services.'
'This hunting query looks for users who have run queries calling a watchlist template relating to sensitive data that have not previously been seen calling these watchlists.'
This analytic detects suspicious modifications to Unix shell configuration files, such as `.bashrc` or `.profile`, which may indicate an attempt to alter system behavior or gain unauthorized access. Unauthorized changes to these files can be used to execute malicious commands, escalate privileges, or hide malicious activities. By monitoring for unusual or unauthorized modifications to shell configuration files, this analytic helps identify potential security threats, allowing security teams to respond quickly and mitigate risks.
The following analytic detects attempts to stop a service on Linux systems. It leverages data from Linux Auditd. This activity is significant as adversaries often stop or terminate security or critical services to disable defenses or disrupt operations, as seen in malware like Industroyer2. If confirmed malicious, this could lead to the disabling of security mechanisms, allowing attackers to persist, escalate privileges, or deploy destructive payloads, severely impacting system integrity and availability.
The following analytic detects the suspicious auditd service stop. This behavior is critical for a SOC to monitor because it may indicate attempts to gain unauthorized access or maintain control over a system. Such actions could be signs of malicious activity. If confirmed, this could lead to serious consequences, including a compromised system, unauthorized access to sensitive data, or even a wider breach affecting the entire network. Detecting and responding to these signs early is essential to prevent potential security incidents.
The analytic detects a spike in the number of API calls made to cloud infrastructure by a user. It leverages cloud infrastructure logs and compares the current API call volume against a baseline probability density function to identify anomalies. This activity is significant because an unusual increase in API calls can indicate potential misuse or compromise of cloud resources. If confirmed malicious, this could lead to unauthorized access, data exfiltration, or disruption of cloud services, posing a significant risk to the organization's cloud environment.
The analytic detects cloud API calls executed by user roles that have not previously run these commands. It leverages the Change data model in Splunk to identify commands executed by users with the user_type of AssumedRole and a status of success. This activity is significant because new commands from different user roles can indicate potential malicious activity or unauthorized actions. If confirmed malicious, this behavior could lead to unauthorized access, data breaches, or other damaging outcomes by exploiting new or unmonitored commands within the cloud environment.
The analytic detects the creation of cloud compute instances using previously unseen image IDs. It leverages cloud infrastructure logs to identify new image IDs that have not been observed before. This activity is significant because it may indicate unauthorized or suspicious activity, such as the deployment of malicious payloads or unauthorized access to sensitive information. If confirmed malicious, this could lead to data breaches, unauthorized access, or further compromise of the cloud environment. Immediate investigation is required to determine the legitimacy of the instance creation and to mitigate potential threats.
This analytic aggregates and summarizes alerts from Microsoft Defender for Endpoint. It extracts details such as source, file name, severity, process command line, IP address, registry key, signature, description, and unique ID. The detection is not intended to identify new activity from raw data but rather to leverage existing Microsoft Defender for Endpoint alerts for correlation and risk-based alerting. It filters out alerts with a 'clean' verdict and dynamically maps MITRE techniques and assigns risk scores based on the alert's severity.
The analytic identifies instances where a service principal in Azure Active Directory assigns app roles without standard admin consent. This activity is detected by analyzing Entra ID logs from the `azure_monitor_aad` data source, specifically looking for "Add app role assignment to service principal" or "Add member to role*" operations initiated by a service principal. This detection is crucial for identifying potential bypasses of administrative consent processes, which could lead to unauthorized privilege grants. If malicious, this could allow attackers to exploit automation to assign sensitive permissions without proper oversight, compromising the security of the Azure AD environment.
Page 21 of 23