Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
883 detections
Filters
Last updated
All Time
Detection languages
444
92
80
78
55
Contributors
228
168
138
43
37
Categories
20,443
11,831
5,875
5,151
4,864
883
Platforms
596
135
116
72
51
Products / Services
204
150
139
78
67
MITRE Techniques
314
264
223
214
207
CVEs
15
12
4
4
3
IDS Classtypes
20
13
10
8
3
IDS Protocols
24
14
12
1
This rule identifies 'improbable travel' scenarios where a user successfully logs in from two geographically distant locations within a short time frame, suggesting potential account compromise or abuse, possibly related to Remote Employment Fraud (REF). It calculates the speed of travel required between consecutive login locations and flags events where the speed and distance exceed predefined thresholds. It also checks if the login country differs from the user's known work country.
'The alert shows users that join a Zoom meeting from a time zone other than the one the meeting was created in.
You can also whitelist known good time zones in the tz_whitelist value using the tz database name format https://en.wikipedia.org/wiki/List_of_tz_database_time_zones'
You can also whitelist known good time zones in the tz_whitelist value using the tz database name format https://en.wikipedia.org/wiki/List_of_tz_database_time_zones'
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
'This query will detect paths suspicious associated with ProxyLogon exploitation'
This rule detects Okta authentication attempts originating from known VPN providers. Threat actors, particularly those involved in Remote Employment Fraud (REF), often use VPNs to mask their true physical location and evade detection. By identifying connections from a listing of commonly used VPN services, this rule aims to flag potentially suspicious access to Okta accounts. The rule extracts user information, client details, geographical context, and debug data to provide comprehensive insights into the VPN usage.
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Detects the execution of Action1, a Remote Monitoring and Management (RMM) tool, for arbitrary code execution or to establish remote sessions. The rule identifies these activities by looking for specific command-line patterns associated with Action1 agent deployments, script execution (via cmd.exe or powershell.exe), and the initiation of remote sessions through 'agent1_remote.exe'. The description also provides hunting opportunities to refine detection by baselining policy names and identifying remote sessions during abnormal hours.
This rule detects network connections initiated by a process over ports 5985 (HTTP) or 5986 (HTTPS), which are commonly used for Windows Remote Management (WinRM) and PowerShell Remoting. The rule specifically looks for these connections originating from non-network service accounts, as connections from such accounts could indicate a suspicious remote PowerShell session. It excludes connections from localhost and known legitimate antivirus processes to reduce false positives.
Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential abuse. The rule specifically looks for PowerShell script block text containing commands related to installing the Windows feature, installing the PSWA web application, and adding authorization rules.
This rule detects the use of the 'net use' command to connect to Windows administrative shares (C$, ADMIN$, IPC$). It specifically looks for these commands being executed by users who are not part of the 'Information Technology' department or who have the title 'Intern', indicating potentially suspicious activity or a deviation from standard administrative practices. The rule leverages user enrichment data to refine its detection.
This rule detects the creation of remote PowerShell sessions by monitoring for the 'wsmprovhost.exe' process. It triggers when 'wsmprovhost.exe' appears as either the main process image or as a parent process, indicating an active PowerShell remote session, typically facilitated by Windows Remote Management (WinRM).
Page 41 of 43