Subash Ghimire
@iamsubashgTrusted contributorCompletionist
6 followers244 downloads631 copies17 likes8,299 views
92 detections
Filters
Last updated
All Time
Detection languages
92
Categories
14
11
11
7
6
Platforms
42
13
9
8
6
Products / Services
36
10
7
5
3
MITRE Techniques
21
18
18
16
14
CVEs
3
3
1
1
1
This rule detects GlobalProtect VPN login attempts originating from outside of Canada. This can help identify potential unauthorized access or policy violations where users are expected to connect from specific geographic regions.
This rule detects changes to user multi-factor authentication (MFA) configurations within Azure Active Directory. It identifies when MFA methods are added, removed, or changed for a user, providing details on the actor, target, and the specific changes made. This helps in auditing MFA configuration changes, detecting unauthorized modifications, supporting incident response, and ensuring compliance with security policies.
This rule audits the state of service accounts in the environment by counting total, enabled, and disabled service accounts. This helps in identifying unused or stale service accounts, ensuring only necessary service accounts are active to reduce the attack surface, and supporting compliance and security posture assessments.
This rule identifies users who have clicked on specific URLs that are known to be associated with phishing attempts. It correlates email URL information with URL click events to pinpoint users who interacted with malicious links shared via email. This is particularly useful for identifying victims of targeted phishing campaigns.
This rule identifies logon attempts on any device within 30 minutes of a user receiving an email categorized as malware, phishing, or spam. It correlates email event data with identity logon events to detect potential compromise scenarios where a user might interact with a malicious email and subsequently log on, possibly indicating a successful initial access or credential compromise.
This rule identifies accounts that have been assigned administrative roles within the environment. It helps assess exposure risk by focusing on identities with elevated permissions, supports attack surface reduction by auditing role assignments, and enables proactive threat hunting for potential misuse of admin privileges.
This rule identifies users who clicked on URLs within emails from a specific sender. It correlates email events, URL information, and URL click events to pinpoint which users interacted with links in emails, particularly useful for tracking responses to potential phishing attempts from a compromised account.
This rule detects outbound email activity, specifically focusing on emails sent outside the organization's domain that include attachments. It identifies the sender, recipient, file type, file name, and file size of these attachments.
This KQL query detects suspicious service activities (installation, modification, or deletion) by comparing events with a curated list of known suspicious Windows services. It extracts service names and accounts from device events and joins them with an external CSV list of suspicious services to identify matches. The query aims to alert on the presence or manipulation of services commonly associated with malicious activity.
This rule identifies inbound emails that have been delivered to the organization's email domain and are categorized as 'Phishing' by the email security system. It specifically looks for phishing indicators within the email's attachment or body. The query then summarizes the count of such emails by their URL domain, sorting them to highlight the most frequent phishing domains. The accompanying Python script demonstrates how to cross-reference these identified URL domains with VirusTotal for further analysis.
Page 6 of 10