Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
282 detections
Filters
Last updated
All Time
Detection languages
156
55
25
13
13
Contributors
55
55
49
33
12
Categories
192
98
90
69
46
Platforms
119
90
61
47
41
Products / Services
112
65
36
26
19
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
5
2
2
IDS Classtypes
11
2
1
IDS Protocols
10
3
KQL Query from file: Azure Cloud Security Monitoring
KQL Query from file: Multi-Cloud DefenderXDR KQL Threat Detection
Detects a single user failing to authenticate to multiple users using explicit credentials.
Detects failed logins with multiple valid domain accounts from a single source system using the NTLM protocol.
Detects a source system failing to authenticate against a remote host with multiple users.
Detects failed logins with multiple accounts from a single process on the system.
Detects failed logins with multiple invalid domain accounts from a single source system using the NTLM protocol.
'Identifies evidence of brute force activity against a user based on multiple authentication failures and at least one successful authentication within a given time window.
Note that the query does not enforce any sequence, and does not require the successful authentication to occur last.
The default failure threshold is 10, success threshold is 1, and the default time window is 20 minutes.
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimAuthentication)'
Note that the query does not enforce any sequence, and does not require the successful authentication to occur last.
The default failure threshold is 10, success threshold is 1, and the default time window is 20 minutes.
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimAuthentication)'
Detects multiple failed logins with multiple valid domain accounts from a single source system using the Kerberos protocol.
'This query searches for failed attempts to log in from more than 15 various users within a 5 minute timeframe from the same source. This is a potential indication of a password spray attack
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimAuthentication)'
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimAuthentication)'
'Identifies sign-in anomalies from an IP in the last hour, targeting multiple users where the password is correct after multiple attempts'
This query was originally published in the threat analytics report, MailSniper Exchange attack tool.
MailSniper is a tool that targets Microsoft Exchange Server. The core function is to connect to Exchange Server and search through emails. In support of this, it can perform reconnaissance, collection, exfiltration, and credential theft. MailSniper is used both by red teams running penetration tests, and by malicious actors.
Microsoft Defender Security Center may record the following alerts during and after an attack:
1. Global mail search on Exchange using MailSniper
2. Exchange mailbox or mail folder search using MailSniper
3. Enumeration of Active Directory usernames using MailSniper
4. Enumeration of the Exchange GAL using MailSniper
5. Access to Exchange inboxes using MailSniper
6. Password spraying using MailSniper
7. Enumeration of domains and user accounts using MailSniper
The following query detects activity commonly associated with attacks run with MailSniper.
Reference - https://github.com/dafthack/MailSniper
MailSniper is a tool that targets Microsoft Exchange Server. The core function is to connect to Exchange Server and search through emails. In support of this, it can perform reconnaissance, collection, exfiltration, and credential theft. MailSniper is used both by red teams running penetration tests, and by malicious actors.
Microsoft Defender Security Center may record the following alerts during and after an attack:
1. Global mail search on Exchange using MailSniper
2. Exchange mailbox or mail folder search using MailSniper
3. Enumeration of Active Directory usernames using MailSniper
4. Enumeration of the Exchange GAL using MailSniper
5. Access to Exchange inboxes using MailSniper
6. Password spraying using MailSniper
7. Enumeration of domains and user accounts using MailSniper
The following query detects activity commonly associated with attacks run with MailSniper.
Reference - https://github.com/dafthack/MailSniper
Detects failed logins with multiple disabled domain accounts from a single source system using the Kerberos protocol.
Detects failed logins with multiple invalid domain accounts from a single source system using the Kerberos protocol.
'Identifies accounts that have been locked out by smart lockout policies. Review this results for patterns that might suggest that a password spray is triggering these smart lockout events.
Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-for-failed-unusual-sign-ins'
Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-for-failed-unusual-sign-ins'
'Access attempts to Azure Portal from an unauthorized user. Either invalid password or the user account does not exist.'
'This hunting query will identify instances where a single user account has seen a high incidence of failed attempts from highly volatile IP addresses
Changing IP address for every password attempt is becoming a more common technique amongst sophisticated threat groups. Often threat groups will randomise
the user agent they are using as well as IP address. This technique has been enabled by the emergence of services providing huge numbers of residential IP
addresses. These services are often enabled through malicious browser plugins. This query is best executed over longer timeframes.
Reduce the timeRange if you have too much data. Results with the highest "IPs", "Failures" and "DaysWithAttempts" are good candidates for further
investigation. This query intentionally does not cluster on UserAgent, IP etc. This query is clustering on the highly volatile IP behaviour.'
Changing IP address for every password attempt is becoming a more common technique amongst sophisticated threat groups. Often threat groups will randomise
the user agent they are using as well as IP address. This technique has been enabled by the emergence of services providing huge numbers of residential IP
addresses. These services are often enabled through malicious browser plugins. This query is best executed over longer timeframes.
Reduce the timeRange if you have too much data. Results with the highest "IPs", "Failures" and "DaysWithAttempts" are good candidates for further
investigation. This query intentionally does not cluster on UserAgent, IP etc. This query is clustering on the highly volatile IP behaviour.'
'Identifies privileged accounts that have been locked out. Verify these lockout are due to legitimate user activity and not due to threat actors attempting to access the accounts.
Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor'
Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor'
'Identifies spikes in failed sign-in events based on the volume of failed sign-in events over time. Use to identify patterns of suspicious behavior such as unusually high failed sign-in attempts from certain users.
Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts'
Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts'
'This identifies failed logon attempts using permutations based on known first and last names within 10m time windows. Iteration through separators or order changes in the logon name may indicate potential Brute Force logon attempts.'
'Identifies a list of IP addresses with a minimum number(default of 5) of failed logon attempts to remote hosts.
Uses that list to identify any successful logons to Microsoft Entra ID from these IPs within the same timeframe.'
Uses that list to identify any successful logons to Microsoft Entra ID from these IPs within the same timeframe.'
Page 11 of 14