Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
43 detections
Filters
Last updated
All Time
Detection languages
29
4
3
2
2
Contributors
9
9
8
8
3
Categories
11
10
10
8
7
Platforms
28
10
8
5
1
Products / Services
16
6
4
4
4
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
3
1
IDS Classtypes
3
1
IDS Protocols
4
This rule detects potential information disclosure attempts by monitoring W3C IIS logs for repeated queries containing keywords like 'version', 'build', or 'debug'. A high frequency (5 or more attempts within an hour) from a single IP address suggests an adversary is trying to enumerate software versions or debug information, which can be used for further reconnaissance or exploit development.
This rule detects attempts to fingerprint WordPress login pages by monitoring HTTP requests for the 'wp-login.php' URI. It triggers an alert if a source IP makes 5 such requests within 60 seconds, indicating a potential reconnaissance activity against WordPress installations.
This rule detects an unusually high number of network connections made by common package managers (npm, nuget, pip) to their respective repositories. A high volume of connections within a short period (1 hour) could indicate automated activity, potential supply chain compromise, or an adversary attempting to download numerous packages for reconnaissance, staging, or malicious purposes.
This rule detects an unusually high number of network connections made by common package managers (npm, nuget, pip) to their respective repositories. A high volume of connections within a short period (1 hour) could indicate automated activity, potential supply chain compromise, or an adversary attempting to download numerous packages for reconnaissance, staging, or malicious purposes.
This rule detects attempts to fingerprint the version of a Drupal Content Management System (CMS) by requesting the 'CHANGELOG.txt' file. This file often contains version information and is a common target for attackers performing reconnaissance to identify potential vulnerabilities.
Detects JavaScript used to fingerprint browser and client configurations
Exposed Git Repository Discovery
Suricata
This rule detects attempts to discover exposed Git repositories on a web server. It triggers when an HTTP request URI contains the string "/.git/", indicating a client is probing for the presence of a Git repository's internal structure. This is a common reconnaissance technique used by attackers to find sensitive information or source code.
This rule identifies devices running vulnerable versions of Notepad++. It parses the software version to determine if it is older than 8.9.1, which was identified as vulnerable in a security incident. The rule specifically looks for Notepad++ installations and flags any instances where the major version is less than 8, or if the major version is 8 and the minor version is less than 9, or if the major version is 8, the minor version is 9, and the patch version is less than 1.
Detects a Windows command shell executing a batch file that subsequently spawns processes for system discovery (often for AV checking) and then either executes a potential payload or performs network reconnaissance. This behavior is consistent with the initial stages of the BlockBlasters malware campaign.
On October 14, 2025, less than one month from now, Exchange Server 2016 and Exchange Server 2019 will reach end of support. It’s critical to upgrade now to remain supported and secure. This query check for all possible builds of Exchange Server 2016 and Exchange Server 2019.
This rule identifies devices that have software installed which has reached its End-Of-Support (EOS) status. This is crucial for identifying potential security vulnerabilities due to unpatched software and for maintaining compliance with organizational security policies. The rule summarizes the count of such software instances per device, along with the software name and its End-Of-Support date.
KQL Query from file: CVE-2024-3094 with CVSS Score 10
KQL Query
This query finds a software by name and/or version
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Intent:
- Use MTP capability to look for insider threat potential risk indicators
- Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
Definition of Insider Threat:
"The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.
- Use MTP capability to look for insider threat potential risk indicators
- Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
Definition of Insider Threat:
"The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.
This query uses the public MDE GitHub repo as a source to estimate the time that an agent build remains supported
based on the time it was uploaded. Please note that the timestamps used in this query are meant to estimate the
support period and will likely not represent the actual expiration of the package which will be based on the build.
If you would like an estimate of support, uncomment the extend statement to get an idea of what is \ is not
supported and an idea of how long support will remain for current agents.
This query currently only supports GA builds, not preview builds.
based on the time it was uploaded. Please note that the timestamps used in this query are meant to estimate the
support period and will likely not represent the actual expiration of the package which will be based on the build.
If you would like an estimate of support, uncomment the extend statement to get an idea of what is \ is not
supported and an idea of how long support will remain for current agents.
This query currently only supports GA builds, not preview builds.
'Provides the Security Intelligence version and total count of up to date devices, not up to date devices and count of devices whose status is not available relevant to the security intelligence version.'
This query was originally published in the threat analytics report, Solorigate supply chain attack. Please note that these attacks are currently known as the Nobelium campaign.
Microsoft detects the 2020 SolarWinds supply chain attack implant and its other components as part of a campaign by the Nobelium activity group. Nobelium is the threat actor behind the attack against SolarWinds, which was previously referred to as Solorigate.
Nobelium silently added malicious code to legitimate software updates for Orion, which is IT monitoring software provided by SolarWinds. In this way, malicious dynamic link libraries (DLLs) were distributed to SolarWinds customers.
The following query retrieves an inventory of SolarWinds Orion software use in your organization, organized by product name and ordered by how many devices the software is installed on.
More Nobelium-related queries can be found listed under the See also section of this document.
References:
https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/
Microsoft detects the 2020 SolarWinds supply chain attack implant and its other components as part of a campaign by the Nobelium activity group. Nobelium is the threat actor behind the attack against SolarWinds, which was previously referred to as Solorigate.
Nobelium silently added malicious code to legitimate software updates for Orion, which is IT monitoring software provided by SolarWinds. In this way, malicious dynamic link libraries (DLLs) were distributed to SolarWinds customers.
The following query retrieves an inventory of SolarWinds Orion software use in your organization, organized by product name and ordered by how many devices the software is installed on.
More Nobelium-related queries can be found listed under the See also section of this document.
References:
https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/
This query provides the most common services discovered
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Page 2 of 3