Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
62 detections
Filters
Last updated
All Time
Detection languages
41
10
7
2
1
Contributors
27
8
6
6
2
Categories
21
21
19
17
16
Platforms
39
9
8
8
5
Products / Services
20
18
16
11
6
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
1
1
1
1
1
IDS Classtypes
1
IDS Protocols
1
'Indicates when an anomalous number of resources are created in Azure via AzureActivity log. Resource creation could indicate malicious or spurious use of your Azure Resource allocation.'
'Identifies a match for SQL Injection attack in the Application gateway WAF logs. The Threshold value in the query can be changed as per your infrastructure's requirement.
References: https://owasp.org/Top10/A03_2021-Injection/'
References: https://owasp.org/Top10/A03_2021-Injection/'
Identify accounts that have logged on to affected endpoints.
Check for specific alerts.
Check for specific alerts.
This query was originally published in the threat analytics report, Motivated miners.
Doublepulsar is a backdoor developed by the National Security Agency (NSA). First disclosed in 2017, it is now used by many malicious actors. Software patches are available.
The following query detects activity broadly associated with campaigns that use DoublePulsar to exploit web servers.
See Detect DoublePulsar execution for a query that detects possible DoublePulsar execution events.
References:
https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/DoublePulsar&threatId=-2147239036
https://www.scmagazine.com/home/security-news/cybercrime/doublepulsar-malware-spreading-rapidly-in-the-wild-following-shadow-brokers-dump/
https://support.microsoft.com/help/4013389/title
Doublepulsar is a backdoor developed by the National Security Agency (NSA). First disclosed in 2017, it is now used by many malicious actors. Software patches are available.
The following query detects activity broadly associated with campaigns that use DoublePulsar to exploit web servers.
See Detect DoublePulsar execution for a query that detects possible DoublePulsar execution events.
References:
https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/DoublePulsar&threatId=-2147239036
https://www.scmagazine.com/home/security-news/cybercrime/doublepulsar-malware-spreading-rapidly-in-the-wild-following-shadow-brokers-dump/
https://support.microsoft.com/help/4013389/title
'This query looks at the last 14 days for "Consent to application" operation by a user/app which could potentially mean unauthorized access. Additional context is added from AuditLogs based on CorrleationId from the same account that performed the action.'
One of the challenges in making an AppLocker policy is knowing where applications
launch from. This query normalizes process launch paths through aliasing, then
counts the number of processes launched from that path, how many distinct machines it
was launched on, and how many distinct file names \ hashes these processes had. The
path is broken into subfolders to help simplify analysis.
launch from. This query normalizes process launch paths through aliasing, then
counts the number of processes launched from that path, how many distinct machines it
was launched on, and how many distinct file names \ hashes these processes had. The
path is broken into subfolders to help simplify analysis.
This rule detects outbound network connections to IP addresses that exhibit low prevalence within the monitored environment. Specifically, it flags connections to IPs that have a rolling maximum prevalence of 1 to 3 occurrences over a 10-day period. This behavior can be indicative of command and control (C2) communication, data exfiltration, or other suspicious activities where adversaries might use newly registered or rarely seen infrastructure.
The following analytic detects attempts to bypass application restrictions by identifying Windows AppLocker policy violations. It leverages Windows AppLocker event logs, specifically EventCodes 8007, 8004, 8022, 8025, 8029, and 8040, to pinpoint blocked actions. This activity is significant for a SOC as it highlights potential unauthorized application executions, which could indicate malicious intent or policy circumvention. If confirmed malicious, this activity could allow an attacker to execute unauthorized applications, potentially leading to further system compromise or data exfiltration.
The analytic identifies instances where a user grants consent to an application requesting mail-related permissions within the Office 365 environment. It leverages O365 audit logs, specifically focusing on events related to application permissions and user consent actions. This activity is significant as it can indicate potential security risks, such as data exfiltration or spear phishing, if malicious applications gain access. If confirmed malicious, this could lead to unauthorized data access, email forwarding, or sending malicious emails from the compromised account. Validating the legitimacy of the application and consent context is crucial to prevent data breaches.
This analytic identifies instances where tenant-wide admin consent is granted to an application within an Azure AD and Office 365 tenant. It leverages O365 audit logs, specifically events related to the "Consent to application." operation within the AzureActiveDirectory workload, and filters for `ConsentType = "AllPrincipals"`. This activity is significant because admin consent allows applications to access data across the entire tenant, potentially exposing vast amounts of organizational data. If confirmed malicious, an attacker could gain extensive and persistent access to organizational data, leading to data exfiltration, espionage, further malicious activities, and potential compliance violations.
The following analytic detects instances where Azure AD has blocked a user's attempt to grant consent to a risky or potentially malicious application. This detection leverages Azure AD audit logs, focusing on user consent actions and system-driven blocks. Monitoring these blocked consent attempts is crucial as it highlights potential threats early on, indicating that a user might be targeted or that malicious applications are attempting to infiltrate the organization. If confirmed malicious, this activity suggests that Azure's security measures successfully prevented a harmful application from accessing organizational data, warranting immediate investigation to understand the context and take preventive measures.
The following analytic identifies instances where Office 365 has blocked a user's attempt to grant consent to an application deemed risky or potentially malicious. This detection leverages O365 audit logs, specifically focusing on failed user consent actions due to system-driven blocks. Monitoring these blocked consent attempts is crucial as it highlights potential threats early on, indicating that a user might be targeted or that malicious applications are attempting to infiltrate the organization. If confirmed malicious, this activity suggests that O365's security measures successfully prevented a harmful application from accessing organizational data, warranting immediate investigation.
The following analytic detects the launch of rarely used applications within the environment, which may indicate the use of potentially malicious software or tools by attackers. It leverages Windows AppLocker event logs, aggregating application launch counts over time and flagging those that significantly deviate from the norm. This behavior is significant as it helps identify unusual application activity that could signal a security threat. If confirmed malicious, this activity could allow attackers to execute unauthorized code, potentially leading to further compromise of the system.
The following analytic identifies potential exploitation attempts of the Confluence CVE-2023-22515 vulnerability. It detects successful accesses (HTTP status 200) to specific vulnerable endpoints by analyzing web logs within the Splunk 'Web' Data Model. This activity is significant for a SOC as it indicates possible privilege escalation attempts in Confluence. If confirmed malicious, attackers could gain unauthorized access or create accounts with escalated privileges, leading to potential data breaches or further exploitation within the environment.
This rule detects when the Unified Audit Log is enabled in Office 365. This event is triggered when the 'Set-AdminAuditLogConfig' cmdlet is used to set 'UnifiedAuditLogIngestionEnabled' to 'True'. While enabling logging is generally a positive security action, this rule is designed to alert if logging was previously disabled and is now being re-enabled, which could indicate an adversary attempting to cover their tracks after a period of operating without logging, or to restore logging after intentionally disabling it.
This rule detects the creation of new applications within Microsoft Entra ID (formerly Azure AD). While application creation can be a legitimate administrative activity, frequent or unauthorized creation of applications can indicate malicious activity, such as an attacker establishing persistence, creating backdoors, or setting up infrastructure for further attacks. The rule specifically looks for 'Add application' events in the Azure AD Directory Audit logs.
This rule detects when an application in Entra ID (formerly Azure AD) is restored. This action implies that the application was previously soft-deleted and is now being recovered. This could be an administrative action to recover a mistakenly deleted application or could indicate an attempt to restore a malicious application that was previously removed.
This rule detects the creation of new applications within Microsoft Entra ID (formerly Azure AD). While application creation is a legitimate administrative activity, it does not occur frequently. Monitoring this event can help identify unauthorized or suspicious application registrations that could be used for persistence, privilege escalation, or other malicious activities within the cloud environment.
This rule detects when a permission on a pre-defined watchlist is applied to an Entra ID application. It specifically looks for 'Update application.' events in Office 365 logs where the 'NewValue_EntitlementId-' or 'OldValue_EntitlementId-' labels indicate a change in application permissions. The rule leverages a watchlist named 'msgraph_watchlist_permissions' to identify sensitive or suspicious permission changes.
Detects changes to the security groups associated with an Elastic Load Balancer (ELB) or Application Load Balancer (ALB). This can indicate that a misconfiguration allowing more traffic into the system than required, or could indicate that an attacker is attempting to enable new connections into a VPC or subnet controlled by the account.
Page 3 of 3