Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
51 detections
Filters
Last updated
All Time
Detection languages
29
15
2
2
2
Contributors
24
6
6
5
4
Categories
19
13
12
12
10
Platforms
17
15
12
8
5
Products / Services
15
15
11
7
7
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
IDS Classtypes
10
3
2
IDS Protocols
13
1
1
Detects malware using Pastebin as a dead drop resolver for C2 config
This rule detects attempts to upload potentially malicious script or executable files to GitHub's API. It specifically looks for HTTP POST requests to 'api.github.com' with a URI containing '/contents/' and file data matching common executable or script file extensions such as '.exe', '.dll', '.ps1', '.vbs', '.bat', or '.hta'. This activity could indicate an attacker attempting to stage malicious code in a code repository.
This rule detects attempts to upload files containing the 'MZ' magic bytes (indicating a Windows executable) to known file-sharing services such as transfer.sh, mega.nz, mediafire, or anonfiles. It specifically looks for HTTP POST requests with file data.
Detects download of malware builder or generator tools from code repositories
This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the locations they are stored
This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the workload in which they are stored
This query visualises total files located on SharePoint, OneDrive and Teams with Malware detections over time summarizing the data daily.
'Looks for file uploads actions to Azure File and Blob Storage from known VPS provider network ranges.
This is not an exhaustive list of VPS provider ranges but covers some of the most prevalent providers observed.'
This is not an exhaustive list of VPS provider ranges but covers some of the most prevalent providers observed.'
This query visualises total emails with Malware detections over time summarizing the data daily by Malware detection technologies/controls used for detecting unknown-unique malware.
'This hunting query will try to identify the user account used to perform a file upload to blob storage.
This query can be used to match all file upload events, or filtering can be applied on filename to search for a specific upload.'
This query can be used to match all file upload events, or filtering can be applied on filename to search for a specific upload.'
'This query combines different Storage alerts with CommonSecurityLogs and StorageLogs helping analysts triage and investigate any
possible Storage related attacks faster thus reducing Mean Time To Respond'
possible Storage related attacks faster thus reducing Mean Time To Respond'
In this query, we are looking for emails containing malware accessed on a unmanaged device
'Finds instances where a file uploaded to blob or file storage and it is seen on an endpoint by Microsoft Defender XDR.'
This query will hunt for files matching the current abuse.ch recent threat feed based on Sha256. Currently the query is set up to analyze the last day worth of events, but this is configurable using the MaxAge variable.
Graph of MDO detections trended over time
This query visualises total emails with Malware detections summarizing the data by ThreatNames of the malware detected.
This query visualises total emails with Malware detections over time summarizing the data daily by Delivery Location.
MosaicLoader
KQL
This hunting query looks Malware Hides Itself Among Windows Defender Exclusions to Evade Detection
This query visualises total emails with Malware detections over time summarizing the data daily.
Provides a summary of total number of detections
Query for Microsoft Defender Antivirus detections.
Query #1: Query for Antivirus detection events.
Query #1: Query for Antivirus detection events.
Page 2 of 3