Michael Fajkus
@MilesDysonCompletionist
4 followers117 downloads332 copies47 likes4,698 views
27 detections
Filters
Last updated
All Time
Detection languages
27
Categories
10
7
4
1
1
Platforms
23
8
5
2
1
Products / Services
23
18
1
1
1
MITRE Techniques
5
4
4
4
3
IDS Classtypes
1
Detects potential Command and Control (C2) communication patterns based on ASIM-normalized network session data in Microsoft Sentinel. This detection covers three primary patterns:
1) Periodic beaconing with low jitter
2) Long-lived HTTP(S) long-polling sessions
3) Network traffic with very consistent payload sizes
Such patterns can indicate covert communication with compromised systems or malware infections.
1) Periodic beaconing with low jitter
2) Long-lived HTTP(S) long-polling sessions
3) Network traffic with very consistent payload sizes
Such patterns can indicate covert communication with compromised systems or malware infections.
Detects suspicious SMB/NTLM activity triggered by explorer.exe following recent .lnk file creation by script engines. This behavior aligns with the CVE-2025-50154 bypass of Microsoft’s NTLM credential leak patch (CVE-2025-24054), allowing zero-click NTLM hash disclosure and remote binary staging without execution.
This detection identifies Windows service installations (Event ID 4697) where potentially dangerous permissions like Everyone:Full Control or Authenticated Users:Full Control may be assigned to the service executable.
Such configurations can lead to privilege escalation via service binary hijacking.
Note:
Field index positions in EventData.Data[] may vary depending on the system and must be manually verified using parse_xml(EventData).
This detection requires the following audit subcategory to be enabled:
Audit Policy: Audit Kernel Object (under Object Access)
Such configurations can lead to privilege escalation via service binary hijacking.
Note:
Field index positions in EventData.Data[] may vary depending on the system and must be manually verified using parse_xml(EventData).
This detection requires the following audit subcategory to be enabled:
Audit Policy: Audit Kernel Object (under Object Access)
This detection identifies interactive sign-ins from countries that a user has not accessed from in the past 30 days, based on successful logins. It highlights unusual geographic access patterns, such as remote work via VPNs, possible account compromise, or other travel-related anomalies.
Only interactive sign-ins are included to reduce noise from background service logins and token refreshes.
Recommended Extensions:
1. Trusted Applications Watchlist
Use a Sentinel watchlist (e.g., `TrustedAppsWatchlist`) to maintain known or expected applications (like SAP Cloud Identity Services, Microsoft Teams, Outlook Mobile) that frequently authenticate across multiple countries or devices. This helps suppress expected behavior and avoids alert fatigue.
2. Workation / Remote User Watchlist
Create a watchlist (e.g., `WorkationUsers`) with UPNs or user aliases of employees who are temporarily working abroad or from rotating locations. This allows legitimate, location-shifting activity to be filtered out of alerting, reducing false positives during travel seasons or flexible remote work arrangements.
Only interactive sign-ins are included to reduce noise from background service logins and token refreshes.
Recommended Extensions:
1. Trusted Applications Watchlist
Use a Sentinel watchlist (e.g., `TrustedAppsWatchlist`) to maintain known or expected applications (like SAP Cloud Identity Services, Microsoft Teams, Outlook Mobile) that frequently authenticate across multiple countries or devices. This helps suppress expected behavior and avoids alert fatigue.
2. Workation / Remote User Watchlist
Create a watchlist (e.g., `WorkationUsers`) with UPNs or user aliases of employees who are temporarily working abroad or from rotating locations. This allows legitimate, location-shifting activity to be filtered out of alerting, reducing false positives during travel seasons or flexible remote work arrangements.
Detects DNS queries to domains that are suspiciously similar to trusted ones, which may indicate typosquatting, phishing, or user deception tactics. The detection compares unknown domains to a known safe allowlist using a fuzzy character-difference heuristic.
This detection identifies instances where PowerShell is executed using a legacy engine version (e.g., v2.0), which lacks support for AMSI and script block logging. Attackers often downgrade PowerShell to avoid modern security controls and to evade detection during payload execution.
PowerShell version information is captured from the DeviceEvents table with ActionType `PowerShellEngineVersion`. Any engine version starting with "2." or "1." is treated as suspicious in this detection.
PowerShell version information is captured from the DeviceEvents table with ActionType `PowerShellEngineVersion`. Any engine version starting with "2." or "1." is treated as suspicious in this detection.
This detection identifies instances where a Windows service is installed with a file path that contains spaces but is not enclosed in quotation marks. Such misconfigurations can be exploited by attackers for privilege escalation using unquoted service path vulnerabilities. This detection helps administrators identify and remediate potentially insecure service installations.
This detection identifies suspicious authentication failure patterns that may indicate brute-force attacks. It detects four common scenarios:
- Repeated failed login attempts to a single account from a single IP address.
- Distributed login attempts to a single account from multiple IPs.
- A single IP address targeting multiple accounts.
- Broad-scale attempts involving multiple accounts and multiple IPs in a short timeframe.
This rule focuses on failed login attempts only and is intended for early brute-force detection and threat hunting.
Note:
Consider tuning the TimeWindow (default: 10 minutes) and Threshold (default: 5 attempts) values to reflect your organization’s normal login activity. A more permissive or stricter threshold may be necessary depending on your environment (e.g., high-traffic services, mobile users, VPNs).
Includes both a readable union-based version and a compact case()-based variant for performance-conscious deployments.
- Repeated failed login attempts to a single account from a single IP address.
- Distributed login attempts to a single account from multiple IPs.
- A single IP address targeting multiple accounts.
- Broad-scale attempts involving multiple accounts and multiple IPs in a short timeframe.
This rule focuses on failed login attempts only and is intended for early brute-force detection and threat hunting.
Note:
Consider tuning the TimeWindow (default: 10 minutes) and Threshold (default: 5 attempts) values to reflect your organization’s normal login activity. A more permissive or stricter threshold may be necessary depending on your environment (e.g., high-traffic services, mobile users, VPNs).
Includes both a readable union-based version and a compact case()-based variant for performance-conscious deployments.
Detects the use of encoded PowerShell commands often associated with obfuscated or malicious script execution. The rule targets executions of 'powershell.exe' containing suspicious keywords like 'IEX', 'Invoke-WebRequest', or 'FromBase64String', and attempts to decode any Base64-encoded payloads. Common in malware delivery and post-exploitation activity.
This rule detects a potentially malicious Human Interface Device (HID) attack where a newly connected keyboard device (e.g., a USB Rubber Ducky) immediately triggers the execution of a script interpreter such as PowerShell, CMD, or MSHTA. The correlation occurs within 60 seconds of device insertion, which is characteristic of HID-based keystroke injection attacks.
Page 2 of 3