Nicholas Isakson
@nisakson2000Completionist
2 followers24 downloads424 copies9 likes4,448 views
19 detections
Filters
Last updated
All Time
Detection languages
19
Categories
5
4
4
3
3
Platforms
11
3
3
3
Products / Services
10
4
3
3
2
MITRE Techniques
6
5
4
4
3
This rule identifies accounts receiving the most email and highest threat exposure by analyzing inbound email events. It counts total emails, delivered emails, junked emails, blocked emails, and specifically highlights emails with detected threats (Phish, Malware, Spam) that were successfully delivered to the user's inbox. The output is sorted to prioritize accounts with the highest number of delivered threats.
Detects files being written to USB-mounted removable drives. The rule enriches these alerts with USB device identifiers such as VID_PID, InstancePathId, and SerialNumberId, gathered from fleet-wide Plug and Play (PnP) events. This enrichment allows security analysts to cross-reference the detected USB devices against an organization's approved device exclusion list, potentially managed by solutions like Microsoft Intune, to differentiate legitimate data transfers from potential data exfiltration attempts.
This detection identifies potential abuse of the Windows Package Manager (winget.exe) for malicious activities, including arbitrary command execution, execution from temporary directories, suspicious network egress, and installation of unsigned binaries from non-admin accounts.
This rule detects when a member is added to or removed from highly sensitive administrative groups within Active Directory. It specifically monitors Windows Security Event IDs 4728 (member added) and 4729 (member removed) for a predefined list of critical groups such as 'Administrators', 'Domain Admins', 'Enterprise Admins', and 'Schema Admins'. The rule excludes changes made by computer accounts to reduce false positives.
This query identifies URL access attempts that were blocked by CATO Networks security policies, based on logs in CommonSecurityLog. It allows for filtering by specific devices or target URLs.
This rule identifies and aggregates blocked requests from Imperva WAF logs, grouping them by source IP address and then by the owning organization (ASN). It helps to detect and analyze potential attack campaigns or coordinated malicious activity originating from specific organizations or IP ranges. The rule focuses on security, session, and visitor blocks, providing details on attack names, query strings, referrers, and URLs.
This rule tracks and deduplicates alert emails from a Managed Security Service Provider (MSSP). It identifies emails from a specific sender, filters by subject keywords (e.g., severity levels), and groups them into sessions to prevent duplicate alerts. It also extracts case numbers from portal URLs found within the emails.
This query identifies devices with specific versions of installed software that are considered vulnerable. It is a template that can be easily adapted to track any software by changing the placeholder variables. It enriches the findings with device and user information for easier investigation.
This detection identifies successful logon activity (Event ID 4624) on a device that has been reported as stolen or missing. Such activity is highly suspicious and could indicate unauthorized access. The rule enriches the alert with ISP IP information from Azure AD sign-in logs to aid in investigation.
Page 2 of 2