Subash Ghimire
@iamsubashgTrusted contributorCompletionist
6 followers244 downloads631 copies17 likes8,299 views
92 detections
Filters
Last updated
All Time
Detection languages
92
Categories
14
11
11
7
6
Platforms
42
13
9
8
6
Products / Services
36
10
7
5
3
MITRE Techniques
21
18
18
16
14
CVEs
3
3
1
1
1
This rule detects inbound emails where the sender's domain contains "microsoft" but does not end with "microsoft.com". This is a common tactic used in phishing attacks to spoof legitimate Microsoft domains, tricking recipients into believing the email is from a trusted source.
This KQL rule detects commands executed via the Run dialog by monitoring changes to the "Runmru" registry key. This key stores a history of commands entered into the Run dialog. Attackers or malicious scripts often use this method to launch tools like PowerShell, cmd, or malicious payloads, particularly in social engineering attacks where users are tricked into running commands.
This rule identifies suspicious email attachments based on their file type (e.g., executables, scripts) or if they exceed a defined size threshold. It aims to detect potential data exfiltration or the delivery of malicious files via email.
This rule identifies disabled service accounts within the environment. The goal is to help audit the state of service accounts, identify unused or stale accounts, ensure only necessary service accounts are active to reduce the attack surface, and support compliance and security posture assessments. While not directly indicative of an attack, monitoring disabled service accounts can help identify potential misconfigurations or accounts that could be re-enabled and abused.
This rule identifies unusual DNS query volumes by monitoring and counting DNS queries over a set threshold in the past day.
This rule identifies user accounts with more than 5 failed Windows logon attempts due to wrong passwords in the last 10 minutes, indicating possible brute force attempts.
This rule identifies potentially suspicious signed binaries by looking for files with digital signatures from signers that are not commonly known or trusted vendors. It aims to detect the abuse of code signing certificates by threat actors to bypass security controls, leveraging the trust associated with digital signatures. The rule explicitly excludes a list of well-known and trusted software vendors to reduce false positives.
This rule detects the presence of potentially malicious or unwanted browser extensions and outbound network connections to known adware or tracking domains. It correlates extension presence with network behavior to identify threats.
This rule identifies and analyzes user interactions with URLs embedded in emails, specifically focusing on emails that are either inbound or intra-organizational. It determines which users clicked on URLs within these emails and provides a summary of this activity. This analysis is particularly useful in security contexts, where understanding user behavior regarding potentially risky links can help in identifying phishing attacks or other malicious activities.
This rule detects PowerShell command line execution by user accounts. It specifically looks for `PowerShellCommand` events where the `InitiatingProcessFileName` is `powershell.exe` and the `InitiatingProcessAccountName` is not 'system'. It also ensures that both `ProcessCommandLine` and `InitiatingProcessCommandLine` are not empty. This helps monitor PowerShell usage across endpoints, detect suspicious or unauthorized script execution, and investigate potential lateral movement or remote access.
Page 7 of 10