Ahamed Rizvan
@ahamedrizvan0 followers39 downloads51 copies7 likes864 views
13 detections
Filters
Last updated
All Time
Detection languages
13
Categories
4
4
3
1
1
Platforms
9
5
2
2
Products / Services
8
5
1
MITRE Techniques
4
4
3
3
3
This rule detects an impersonation event within Microsoft Teams, specifically when the 'TeamsImpersonationDetected' action type is logged. It extracts the User ID and the Sender's User Principal Name (UPN) associated with the detected impersonation.
This rule detects when an email with a detected threat (e.g., malware, phishing) has an attachment that is subsequently observed on an endpoint device. This indicates that a malicious attachment from an email was downloaded and executed or saved on a device.
This rule detects instances where an email with identified threats (e.g., malware, phishing) is received and a URL within that email is subsequently clicked by a user. It correlates email threat information with URL click events to identify successful user interaction with malicious links.
This rule detects instances where an antivirus scan fails on a device. It extracts the scan type, error code, and error description from the `AdditionalFields` property to provide detailed information about the failure. This could indicate issues with the antivirus software itself, a system compromise attempting to disable security controls, or a problem with the scanned files.
This rule detects instances where a user clicks on a URL within an email, and subsequently, the email is moved to quarantine. This sequence of events suggests that the email was initially delivered, a user interacted with a potentially malicious link, and then a post-delivery security action (quarantine) was taken, indicating a delayed detection of a threat, likely phishing or malware.
This rule detects attempts to tamper with Windows Defender's real-time protection settings by monitoring specific registry key modifications. It specifically looks for "TamperingAttempt" actions targeting the 'HKEY_LOCAL_MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\Real-Time Protection' registry key, which is commonly used to disable or modify Windows Defender's real-time scanning capabilities.
This rule identifies devices that have software installed which has reached its End-Of-Support (EOS) status. This is crucial for identifying potential security vulnerabilities due to unpatched software and for maintaining compliance with organizational security policies. The rule summarizes the count of such software instances per device, along with the software name and its End-Of-Support date.
This rule detects email events that have an identified threat name and are associated with a URL click event. This combination suggests a user has clicked on a malicious link delivered via email.
This rule detects instances where an antivirus scan has been cancelled on a device. It specifically looks for 'AntivirusScanCancelled' actions in device events and extracts the 'ScanTypeIndex' from additional fields to provide context on the type of scan that was cancelled. This could indicate an attempt to evade detection by disabling security software.
This rule detects when an antivirus scan has completed on a device. It extracts the scan type from the additional fields and summarizes the count of completed scans by timestamp, device name, action type, and scan type. This rule can be used to monitor the frequency and types of antivirus scans occurring across an environment.
Page 1 of 2