Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
445 detections
Filters
Last updated
All Time
Detection languages
200
123
25
25
20
Contributors
96
68
59
44
34
Categories
266
237
104
47
39
Platforms
313
149
52
51
12
Products / Services
95
72
36
26
21
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
CVEs
15
14
13
11
8
IDS Classtypes
6
4
3
2
2
IDS Protocols
15
3
2
Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation
Detects potentially suspicious child processes of KeyScrambler.exe
Detects a JAVA process running with remote debugging allowing more than just localhost to connect
Detects network connections from "dfsvc.exe" used to handled ClickOnce applications to non-local IPs
Detects an office application (Word, Excel, PowerPoint) that initiate a network connection to a non-private IP addresses.
This rule aims to detect traffic similar to one seen exploited in CVE-2021-42292.
This rule will require an initial baseline and tuning that is specific to your organization.
This rule aims to detect traffic similar to one seen exploited in CVE-2021-42292.
This rule will require an initial baseline and tuning that is specific to your organization.
Detects network connections from the Equation Editor process "eqnedt32.exe".
Detects possible successful exploitation for vulnerability described in CVE-2021-26858 by looking for
creation of non-standard files on disk by Exchange Server’s Unified Messaging service
which could indicate dropping web shells or other malicious content
creation of non-standard files on disk by Exchange Server’s Unified Messaging service
which could indicate dropping web shells or other malicious content
Detects possible successful exploitation for vulnerability described in CVE-2021-26857 by looking for | abnormal subprocesses spawning by Exchange Server's Unified Messaging service
Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum
Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum
Detects Winword starting uncommon sub process FLTLDR.exe as used in exploits for CVE-2017-0261 and CVE-2017-0262
Detects exploitation attempt of CVE-2023-38331 (WinRAR before v6.23), where an attacker can leverage WinRAR to execute arbitrary commands and binaries.
Detects potentially suspicious child processes of WinRAR.exe.
Detects suspicious print spool service (spoolsv.exe) child processes.
Detects potentially suspicious child processes of KeyScrambler.exe
Detects network connections from "dfsvc.exe" used to handled ClickOnce applications to non-local IPs
'This query looks for file hashes and AV signatures associated with Prestige ransomware payload.'
Microsoft has observed attackers who have gained entry to an environment via the Log4J vulnerability utilizing identifiable strings in PowerShell commands.
This query detects possible abuse of ms-msdt MSProtocol URI scheme to load and execute malicious code via Microsoft Support Diagnostic Tool Vulnerability (CVE-2022-30190).
The following query detects when Microsoft Office software spawns an instance of the MSDT utility, msdt.exe.
References:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190
https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/
https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug
https://attack.mitre.org/techniques/T1221/
The following query detects when Microsoft Office software spawns an instance of the MSDT utility, msdt.exe.
References:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190
https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/
https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug
https://attack.mitre.org/techniques/T1221/
This query checks for specific processes and domain TLD used in the CVE-2018-4878 flash 0day exploit attack reported by KrCERT.
CVE: CVE-2018-4878.
Read more here:.
Https://www.krcert.or.kr/data/secNoticeView.do?bulletin_writing_sequence=26998.
Https://helpx.adobe.com/security/products/flash-player/apsa18-01.html.
Http://blog.talosintelligence.com/2018/02/group-123-goes-wild.html.
Http://blog.morphisec.com/flash-exploit-cve-2018-4878-spotted-in-the-wild-massive-malspam-campaign.
Tags: #exploit #CVE-2018-4878 #0day #Korea #Flash.
CVE: CVE-2018-4878.
Read more here:.
Https://www.krcert.or.kr/data/secNoticeView.do?bulletin_writing_sequence=26998.
Https://helpx.adobe.com/security/products/flash-player/apsa18-01.html.
Http://blog.talosintelligence.com/2018/02/group-123-goes-wild.html.
Http://blog.morphisec.com/flash-exploit-cve-2018-4878-spotted-in-the-wild-massive-malspam-campaign.
Tags: #exploit #CVE-2018-4878 #0day #Korea #Flash.
'This query uses the Azure Defender Security Nested Recommendations data to find machines vulnerable to OMIGOD CVE-2021-38647.
OMI is the Linux equivalent of Windows WMI and helps users manage configurations across remote and local environments. The query aims to find machines that have this OMI vulnerability (CVE-2021-38647).
Security Nested Recommendations data is sent to Microsoft Sentinel using the continuous export feature of Azure Defender(refrence link below).
Reference: https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure
Reference: https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal'
OMI is the Linux equivalent of Windows WMI and helps users manage configurations across remote and local environments. The query aims to find machines that have this OMI vulnerability (CVE-2021-38647).
Security Nested Recommendations data is sent to Microsoft Sentinel using the continuous export feature of Azure Defender(refrence link below).
Reference: https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure
Reference: https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal'
Page 19 of 22