Montaser Ismail
@M0nt3xTrusted contributorCompletionist
0 followers4 downloads318 copies1 like847 views
40 detections
Filters
Last updated
All Time
Detection languages
40
Categories
20
10
8
6
5
Platforms
30
7
6
2
1
Products / Services
19
6
4
3
2
MITRE Techniques
14
11
7
6
6
CVEs
2
1
1
1
This rule detects processes initiating network connections to standard POP3 (110, 995) and IMAP (143, 993) ports that are not identified as trusted, well-known mail clients. By filtering out connections from common email application paths and local IP ranges, it aims to identify potentially malicious processes, scripts, or non-standard tools attempting to perform email collection or exfiltration directly from mail servers.
This rule detects the use of the Windows certutil.exe utility with flags commonly abused by adversaries for file downloads (-urlcache, -urlfetch) or file deobfuscation/decoding (-decode, -decodehex, -encode). It specifically targets LOLBIN (Living Off the Land Binary) behavior by monitoring process command line arguments, while providing allowances for common administrative tasks like PKI maintenance or CRL/OCSP updates to minimize false positives.
KQL Query
Detects potential data exfiltration attempts using PowerShell by identifying Invoke-WebRequest usage with specific flags (Put, ContentType, InFile) or encoding patterns (EncodedCommand) while targeting sensitive file extensions, directories, or suspicious network destinations.
KQL Query from file: Hunting Mirage kitten AKA unc1549
No description available.
KQL Query
Detects executables launched by common LOLBins (msiexec, powershell, cmd, wscript, cscript, regsvr32, rundll32)
that are either signed by a non-Microsoft/non-trusted-third-party publisher, or entirely unsigned.
that are either signed by a non-Microsoft/non-trusted-third-party publisher, or entirely unsigned.
This hunting query detects potential data exfiltration by identifying users whose outbound data volume to cloud storage and messaging platforms: (OneDrive, Dropbox, Google Drive, SharePoint, Telegram) spikes dramatically compared to their own historical behavior.
It uses a per-user adaptive baseline approach rather than static thresholds, making it more resilient to normal variance in user upload habits while still flagging statistically abnormal spikes.
MITRE ATT&CK Mapping
Tactic: Exfiltration (TA0010)
Technique: T1567 – Exfiltration Over Web Service
Sub-technique T1567.002 – Exfiltration to Cloud Storage
Data Source
DeviceNetworkEvents (Microsoft Defender for Endpoint / Microsoft 365 Defender advanced hunting schema)
Logic Breakdown:
Baseline window (31 days, excluding the most recent day):
The query calculates each user's average daily upload volume (BytesSent) to a defined set of cloud storage/messaging destinations over the trailing 31 days, ending 1 day ago. This establishes a personal historical norm per user.
Global peer baseline fallback:
For users with little or no prior upload history (average below minBaselineFloor = 1 MB), the query substitutes a global average across all users (globalPeerBaseline) — or the 1 MB floor, whichever is higher — to avoid division-by-near-zero producing artificially inflated ratios for low-activity users.
Today's upload volume:
Sums BytesSent to the same destination patterns over the last 24 hours per user.
Ratio comparison:
Joins today's upload volume against each user's effective baseline and computes UploadRatio = TodayUpload / EffectiveBaseline.
Alert conditions (both must be true):
UploadRatio > 5 — today's upload is more than 5x the user's normal daily average.
TodayUpload > minUploadFloor (100 MB) — an absolute floor ensuring small, low-value increases (e.g., 1 KB → 6 KB) don't trigger noise alerts even if the ratio is high.
Output: Results sorted by UploadRatio descending, surfacing the most anomalous users firs
It uses a per-user adaptive baseline approach rather than static thresholds, making it more resilient to normal variance in user upload habits while still flagging statistically abnormal spikes.
MITRE ATT&CK Mapping
Tactic: Exfiltration (TA0010)
Technique: T1567 – Exfiltration Over Web Service
Sub-technique T1567.002 – Exfiltration to Cloud Storage
Data Source
DeviceNetworkEvents (Microsoft Defender for Endpoint / Microsoft 365 Defender advanced hunting schema)
Logic Breakdown:
Baseline window (31 days, excluding the most recent day):
The query calculates each user's average daily upload volume (BytesSent) to a defined set of cloud storage/messaging destinations over the trailing 31 days, ending 1 day ago. This establishes a personal historical norm per user.
Global peer baseline fallback:
For users with little or no prior upload history (average below minBaselineFloor = 1 MB), the query substitutes a global average across all users (globalPeerBaseline) — or the 1 MB floor, whichever is higher — to avoid division-by-near-zero producing artificially inflated ratios for low-activity users.
Today's upload volume:
Sums BytesSent to the same destination patterns over the last 24 hours per user.
Ratio comparison:
Joins today's upload volume against each user's effective baseline and computes UploadRatio = TodayUpload / EffectiveBaseline.
Alert conditions (both must be true):
UploadRatio > 5 — today's upload is more than 5x the user's normal daily average.
TodayUpload > minUploadFloor (100 MB) — an absolute floor ensuring small, low-value increases (e.g., 1 KB → 6 KB) don't trigger noise alerts even if the ratio is high.
Output: Results sorted by UploadRatio descending, surfacing the most anomalous users firs
Detect DNS tunnelling via long subdomain labels. The query is useful for identifying DNS queries with unusually long request strings (typically 40+ characters per label) and high volumes of repetitive requests used by attackers to exfiltrate data or run command-and-control (C2) channels.
Page 3 of 4