Subash Ghimire
@iamsubashgTrusted contributorCompletionist
6 followers244 downloads631 copies17 likes8,299 views
92 detections
Filters
Last updated
All Time
Detection languages
92
Categories
14
11
11
7
6
Platforms
42
13
9
8
6
Products / Services
36
10
7
5
3
MITRE Techniques
21
18
18
16
14
CVEs
3
3
1
1
1
Detects potential brute force attacks by identifying multiple failed logon attempts followed by a successful logon within a short period.
This rule monitors for the mounting of USB drives on a specific device. It aims to detect unauthorized data exfiltration attempts, audit physical device access, investigate insider threats or policy violations, and track removable media usage for compliance purposes.
This rule detects changes to user multi-factor authentication (MFA) methods within an organization. It identifies when MFA methods are added, removed, or when the default MFA method is changed. This helps audit MFA configuration changes, detect unauthorized or suspicious modifications to authentication methods, support incident response by identifying the actor and timestamp of the change, and ensure compliance with security policies requiring strong authentication.
This query monitors users added to specific privilege groups, helping identify unauthorized additions.
This rule detects changes to privileged roles and group memberships within Azure Active Directory. It helps identify potential unauthorized privilege escalation, supports compliance and audit requirements, and allows correlation of identity changes with suspicious activity or alerts. The rule specifically looks for operations such as adding/removing members from roles or groups, and updating role memberships or user details, ensuring the operation was successful.
This rule monitors changes to users' Authenticator app registrations within Azure Active Directory. It detects unauthorized device additions or removals, which can be used by adversaries to bypass multi-factor authentication or maintain persistent access to compromised accounts. The rule parses audit logs for 'Update user' operations specifically targeting 'StrongAuthenticationPhoneAppDetail' to identify both added and removed Authenticator app devices.
This rule detects commands executed via the Run dialog (Win+R), which is often used by attackers or malicious scripts to launch tools like PowerShell, cmd, or other malicious payloads. It specifically looks for modifications to the 'RunMRU' registry key by 'explorer.exe' that contain suspicious keywords or patterns indicative of command execution, especially in scenarios like ClickFix-style attacks where users are tricked into running commands.
KQL Query from file: Hunt new browser extension installation on Microsoft Defender For Endpoint Devices.md
This rule detects communication with known malicious domains and IP addresses, as well as the presence or execution of files with known malicious MD5 or SHA256 hashes. It correlates threat intelligence with network and endpoint telemetry to identify compromised devices or accounts.
Identifies multiple failed login attempts to disabled accounts in Active Directory indicating potential unauthorized access attempts.
Page 5 of 10