Subash Ghimire
@iamsubashgTrusted contributorCompletionist
6 followers244 downloads631 copies17 likes8,299 views
92 detections
Filters
Last updated
All Time
Detection languages
92
Categories
14
11
11
7
6
Platforms
42
13
9
8
6
Products / Services
36
10
7
5
3
MITRE Techniques
21
18
18
16
14
CVEs
3
3
1
1
1
This rule identifies devices connected to Wi-Fi networks with public IP addresses and correlates those connections with outbound network events. It aims to provide process-level context for connections originating from such network configurations, including geolocation of both local and remote IPs. This could indicate unusual or unauthorized network activity, potentially related to command and control or data exfiltration from devices on less secure network segments.
KQL Query from file: Defender Weekly OSINT IOC -List Hunt.md
Detects accounts that are created and subsequently deleted within 24 hours, which may indicate malicious activity such as temporary account creation by attackers.
This rule identifies all service accounts in the environment by querying IdentityInfo logs. The goal is to audit the state of these accounts, helping to identify unused or stale service accounts (especially if disabled), ensure only necessary service accounts are active to reduce the attack surface, and support compliance and security posture assessments. This rule does not detect malicious activity but rather provides an inventory for security auditing.
This query is designed to inventory Wi-Fi-connected devices and their network configurations, identify public IP addresses in use, and geolocate those IPs to detect anomalies (e.g., a device showing a public IP from an unexpected country). It also provides visibility into network adapter details, including vendor and status.
Identifies accounts enabled with a default password that haven't been changed by the user within 48 hours, significant for Windows Server 2012 or below environments due to blank password options.
Identifies unauthorized user account creation or deletion attempts by checking against a list of approved users in the IdentityDirectoryEvents.
This query hunts for files shared by a specified malicious sender on user devices. It identifies if attachments from emails sent by the malicious sender have been downloaded, saved, or are present on the user's devices by joining email attachment information with device file events based on the SHA256 hash of the attachment.
This rule detects process events where `svchost.exe` or `schtasks.exe` are the initiating processes on specific devices. This is designed to identify unexpected or suspicious scheduled tasks, whether system-initiated or user-triggered, on monitored devices. It can be used for hunting or to investigate alerts from other security tools regarding suspicious scheduled tasks.
This rule detects outbound automatic reply emails sent from an organization's users to external recipients. It specifically looks for emails with subjects starting with "Automatic reply:" that have been delivered and are outbound.
Page 9 of 10