Kevin Nguyen
@kevinCompletionist
1 follower10 downloads147 copies5 likes1,440 views
8 detections
Filters
Last updated
All Time
Detection languages
8
Categories
2
1
1
1
1
Platforms
8
1
Products / Services
8
1
1
MITRE Techniques
3
2
2
2
2
This rule detects inbound emails that have failed SPF and/or DKIM authentication checks and presents evidence of post-delivery user interaction. Authentication failures on inbound email are a strong indicator of email spoofing or unauthorized sending infrastructure, commonly associated with phishing campaigns targeting organizational users.
Unlike basic phishing detections that alert on email receipt alone, this rule correlates authentication failures with downstream activity to identify attacks that have progressed beyond the initial delivery phase of the MITRE ATT&CK kill chain. Specifically, the rule looks for three post-delivery indicators tied to the suspicious email:
URL Click Activity — A recipient clicked a link contained within the flagged email, suggesting potential engagement with a malicious payload or credential harvesting site
Malicious Attachment Match — An attachment delivered by the flagged email matched a known malicious SHA-256 hash present in the Threat Intelligence table, indicating a known-bad payload was delivered to the recipient
Endpoint File Creation — A file was created on an endpoint whose SHA-256 hash matches an attachment from the flagged email, suggesting the attachment was saved or executed on a host device
Any email triggering one or more of these conditions is surfaced with full metadata including sender, recipient, subject, SPF/DKIM/DMARC results, and the associated IOC for analyst review.
Unlike basic phishing detections that alert on email receipt alone, this rule correlates authentication failures with downstream activity to identify attacks that have progressed beyond the initial delivery phase of the MITRE ATT&CK kill chain. Specifically, the rule looks for three post-delivery indicators tied to the suspicious email:
URL Click Activity — A recipient clicked a link contained within the flagged email, suggesting potential engagement with a malicious payload or credential harvesting site
Malicious Attachment Match — An attachment delivered by the flagged email matched a known malicious SHA-256 hash present in the Threat Intelligence table, indicating a known-bad payload was delivered to the recipient
Endpoint File Creation — A file was created on an endpoint whose SHA-256 hash matches an attachment from the flagged email, suggesting the attachment was saved or executed on a host device
Any email triggering one or more of these conditions is surfaced with full metadata including sender, recipient, subject, SPF/DKIM/DMARC results, and the associated IOC for analyst review.
This query utilizes the IOCs provided by Rapid7 and focuses on columns in the DeviceFileEvents, DeviceProcessEvents and DeviceNetworkEvents tables. This is a high FP query, however each event will require an investigation to its legitimacy. The query accounts for all devices that have installed notepad++ in the past 400d and only looking for IOCs within time of known compromise in order to save on resources. Some IOCs are commented out due to high FP rate.
This alert generates a log when a device onboarded is seen connecting to a known malicious domain within the ThreatIntelIndicators table. The TimeGenerated field should not be changed as the table refreshes every ~10 days.
This rule will alert when a pending action is required by a Security Administrator in Defender XDR. XDR lacks integrations with common ITSM applications and can only natively email for notifications. This will allow you to create a Sentinel Incident which then you can use a logic app to alert to whatever platform you would like.
Detects anomalies in data connector log volumes by comparing current log counts to 30-day averages, identifying significant deviations.
This query monitors the health and performance of data connectors feeding into Microsoft Sentinel by analyzing log volumes from various sources over the past 30 days. It calculates hourly averages to establish a baseline and compares these to logs from the last hour to identify significant deviations.
Specifically, the query detects "No Logs" (indicating a complete halt in log transmission), "Critical Spike" and "Elevated Spike" (indicating significantly higher log volumes, suggesting potential security incidents or increased activity), and "Critical Drop" and "Elevated Drop" (indicating significantly lower log volumes, which could point to misconfigurations or data source issues). The query provides detailed alerts for these anomalies, helping administrators proactively address potential issues with data connectors.
This query monitors the health and performance of data connectors feeding into Microsoft Sentinel by analyzing log volumes from various sources over the past 30 days. It calculates hourly averages to establish a baseline and compares these to logs from the last hour to identify significant deviations.
Specifically, the query detects "No Logs" (indicating a complete halt in log transmission), "Critical Spike" and "Elevated Spike" (indicating significantly higher log volumes, suggesting potential security incidents or increased activity), and "Critical Drop" and "Elevated Drop" (indicating significantly lower log volumes, which could point to misconfigurations or data source issues). The query provides detailed alerts for these anomalies, helping administrators proactively address potential issues with data connectors.
This query will generate an alert for any emails that Defender AIR identifies as malicious but has taken no AIR actions.
This analytics rule measures Mean Time to Detect (MTTD) for alerts generated by Sentinel analytics rules. It correlates rule execution data from SentinelHealth with corresponding alerts in SecurityAlert and incidents in SecurityIncident to determine how long it took for an analytics rule to detect malicious or suspicious activity after the first related event occurred.
The query retrieves all successful analytics rule executions within the specified time window, joins them to alerts using the CorrelationId, and then maps those alerts to incidents through AlertIds. For each alert–incident pair, the rule calculates MTTD as the difference between the rule run time and the first activity time associated with the incident. Results are aggregated by alert name and severity to provide counts and average detection times, enabling visibility into detection performance and rule efficacy.
The query retrieves all successful analytics rule executions within the specified time window, joins them to alerts using the CorrelationId, and then maps those alerts to incidents through AlertIds. For each alert–incident pair, the rule calculates MTTD as the difference between the rule run time and the first activity time associated with the incident. Results are aggregated by alert name and severity to provide counts and average detection times, enabling visibility into detection performance and rule efficacy.
This rule detects potential malicious email campaigns by identifying when multiple users submit email reports (e.g., phishing or spam) that share common entities such as sender IP, primary sender address/domain, secondary sender address/domain, or subject line. A configurable threshold determines the minimum number of distinct reports required to flag an entity as suspicious.