Igor Oliveira
@Pr0fiLeRR2 followers156 downloads197 copies6 likes3,877 views
26 detections
Filters
Last updated
All Time
Detection languages
16
10
Categories
5
2
1
1
1
Platforms
14
3
2
2
Products / Services
10
3
1
MITRE Techniques
4
4
4
4
2
CVEs
2
1
This rule detects HTTPS requests that should have been blocked but are not, for example:
Query Strings with malicious traits like 1=1, attempt to enter <script> in the URL,
URL containing ../ indicating Directory Traversal attempt, and so on.
Query Strings with malicious traits like 1=1, attempt to enter <script> in the URL,
URL containing ../ indicating Directory Traversal attempt, and so on.
Enrichment rule pulling identity details from IdentityInfo table.
Correlated with IdentityLogonEvents via AccountObjectId.
Manager email construction (mgrSplit, ManagerEmail) is handled
natively in KQL post-conversion.
Correlated with IdentityLogonEvents via AccountObjectId.
Manager email construction (mgrSplit, ManagerEmail) is handled
natively in KQL post-conversion.
Correlates IdentityLogonEvents and IdentityInfo on AccountObjectId to detect
after-hours access to Keystone core banking system enriched with user identity.
Note: The following logic is NOT expressible in Sigma and must be applied
post-conversion in native KQL, SPL or whatever query language you use and want
to convert to:
- Timezone conversion (UTC to PST)
- WeekDay function and day-of-week filtering
- Hour-based filtering per department
- summarize arg_max with bin(TimeGenerated, 5m)
- ManagerEmail construction via mgrSplit
- project-reorder
after-hours access to Keystone core banking system enriched with user identity.
Note: The following logic is NOT expressible in Sigma and must be applied
post-conversion in native KQL, SPL or whatever query language you use and want
to convert to:
- Timezone conversion (UTC to PST)
- WeekDay function and day-of-week filtering
- Hour-based filtering per department
- summarize arg_max with bin(TimeGenerated, 5m)
- ManagerEmail construction via mgrSplit
- project-reorder
KQL to detect suspicious HTTP requests
This KQL script detects if end user interacted with an attachment in a potential phishing/BEC incident.
This simple script detects whether a user clicked on a URL in an email message. It uses the 'UrlClickEvents' table in Sentinel to identify such interactions, as well as the 'EmailEvents' table to correlate the email message with the URL click event.
Detect the email delivery delta, comparing before and after the Priority Account Protection Enablement date.
Automate daily manual monitoring of Firewall changes that are performed by the Security Engineer. Additionally, this can be fine-tuned (more on that on next upcoming queries) into an automated rule such as Custom Detection Rule in Defender, Analytics Rule in Sentinel, or Saved Search with Alert Actions within Splunk (SPL) to detect potential changes by unknown authorized individual.
There are operation activities that requires me to daily check whether the firewall backup happened as it should have every night after-hours. The issue is that this is a manual task, requires me to go to a specific directory, find the XML files that are by the firewall and open it up to see if the file will have content. We can also check by the file size without actually opening the file since sometimes the backup fails.
This is a KQL script to automate investigation by full email address. This can be pitched as a workbook as well. Keep in mind all the extra stuff is there for automation, this doesn't need to be your day-to-day query. There's simpler stuff you can make it on the fly in a matter of seconds and give you similar results. This here is for extra information in case you need a single pane of glass.
Page 2 of 3