Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,445
11,833
5,875
5,151
4,864
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
'Often times after the initial compromise the attackers create inbox rules to delete emails that contain certain keywords.
This is done so as to limit ability to warn compromised users that they've been compromised. Below is a sample query that tries to detect this.
Reference: https://www.reddit.com/r/sysadmin/comments/7kyp0a/recent_phishing_attempts_my_experience_and_what/'
This is done so as to limit ability to warn compromised users that they've been compromised. Below is a sample query that tries to detect this.
Reference: https://www.reddit.com/r/sysadmin/comments/7kyp0a/recent_phishing_attempts_my_experience_and_what/'
'This query could identify critical user management operations like user registration(Microsoft Entra ID Multi-Factor Authentication & self-service password reset (SSPR)) authentication by admin account followed by attempts to stop System Restore activity. Stopping system restore prevents from recovering data by going back to a restore point. The operations could be an indication of attackers trying to maintain persistence, move laterally with attempts to stop system restore point that could point to a potential ransomware attack.'
'This script identifies rare domain accounts accessing cloud resources by examining logs. You can lower the domainLimit value to see domains with fewer access attempts. For example, set domainLimit = 2 to see domains with 2 or fewer access attempts.'
'This query combines different SQL alerts with CommonSecurityLogs and AuditLogs helping analysts /investigate any possible SQL related attacks faster
thus reducing Mean Time To Respond'
thus reducing Mean Time To Respond'
'Detects a Service Principal being assigned an app role that has sensitive access such as Mail.Read.
A threat actor who compromises a Service Principal may assign it an app role to allow it to access sensitive data, or to perform other actions.
Ensure that any assignment to a Service Principal is valid and appropriate.
Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-applications#application-granted-highly-privileged-permissions'
A threat actor who compromises a Service Principal may assign it an app role to allow it to access sensitive data, or to perform other actions.
Ensure that any assignment to a Service Principal is valid and appropriate.
Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-applications#application-granted-highly-privileged-permissions'
This query helps hunting for Inbox rule changes which forward-redirect email
'This query combines different Storage alerts with CommonSecurityLogs and AuditLogs helping analysts investigate any possible storage related attacks faster
thus reducing Mean Time To Respond'
thus reducing Mean Time To Respond'
This query helps in reviewing top policies for admin overrides (Allow/Block)
'Query for new sign-ins from stale/inactive accounts. UEBA filters based on ActivityInsights. Results for accounts created in the last 7 days are filtered out.'
Author: alex verboon @alexverboon.
Blogpost: https://www.verboon.info/2020/09/hunting-for-local-group-membership-changes.
Blogpost: https://www.verboon.info/2020/09/hunting-for-local-group-membership-changes.
'Identifies accounts that have been added to a PIM managed privileged group'
This query visualises the total amount of emails subject to an admin policy with action of allow, independent of action taken, summarizing the data by type of override
'This query looks for unfamiliar Sign-in's thats not seen recently for the given user
with azure portal login attempts and audit logs to help detect and reduce the analysis timeline for defenders'
with azure portal login attempts and audit logs to help detect and reduce the analysis timeline for defenders'
'This hunting query will help detect successful sign-ins from devices that are marked non-compliant along with bulk download activity.
Attackers may attempt to get a list of accounts, groups, registration details within an environment which could help in follow-on behavior.
Best practice is to block sign ins from non-complaint devices, however if allowed monitor these events to ensure they do not lead to other risky activity.
Reference: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-devices#non-compliant-device-sign-in'
Attackers may attempt to get a list of accounts, groups, registration details within an environment which could help in follow-on behavior.
Best practice is to block sign ins from non-complaint devices, however if allowed monitor these events to ensure they do not lead to other risky activity.
Reference: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-devices#non-compliant-device-sign-in'
'Looks for multiple users that had their admin role removed by a single user within a certain period.
The default threshold is 5 removals, this can be edited in the query.'
The default threshold is 5 removals, this can be edited in the query.'
Listing Email Remediation Actions performed via Explorer in Defender for Office 365
'Any Alerts that fired related to a given IpAddress during the range of +6h and -3d'
This query will find applications that have been granted Mail.Read or Mail.ReadWrite permissions in which the corresponding user recently consented to. It can help identify applications that have been abused to gain access to user email.
The actor, Nobelium, was observed modifying existing tenant application permissions to allow them to read user email through the Microsoft Graph API. See Customer Guidance on Recent Nation-State Cyber Attacks.
This query is insprired by an Azure Sentinel detection.
References:
https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/MailPermissionsAddedToApplication.yaml
The actor, Nobelium, was observed modifying existing tenant application permissions to allow them to read user email through the Microsoft Graph API. See Customer Guidance on Recent Nation-State Cyber Attacks.
This query is insprired by an Azure Sentinel detection.
References:
https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/MailPermissionsAddedToApplication.yaml
This query looks for users accessing multiple other users' mailboxes, or accessing multiple folders in another user's mailbox.
This query is inspired by an Azure Sentinel detection.
Reference - https://github.com/Azure/Azure-Sentinel/blob/master/Hunting%20Queries/OfficeActivity/AnomolousUserAccessingOtherUsersMailbox.yaml
This query is inspired by an Azure Sentinel detection.
Reference - https://github.com/Azure/Azure-Sentinel/blob/master/Hunting%20Queries/OfficeActivity/AnomolousUserAccessingOtherUsersMailbox.yaml
'Compares the current day to last 14 days of audits to identify new audit activities. Useful for tracking malicious activity related to user/group additions/removals by Azure Apps and automated approvals.'
'This query look for accounts that have not been successfully logged into recently who then add or update an MFA method before logging in.
Threat actors may look to re-activate dormant accounts and use them for access by adding MFA methods in the hope that changes to such dormant accounts may go un-noticed. This query uses the Microsoft Sentinel UEBA features.
Ref: [LINK TO BLOG]'
Threat actors may look to re-activate dormant accounts and use them for access by adding MFA methods in the hope that changes to such dormant accounts may go un-noticed. This query uses the Microsoft Sentinel UEBA features.
Ref: [LINK TO BLOG]'
Page 118 of 144