Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
38 detections
Filters
Last updated
All Time
Detection languages
28
3
3
3
1
Contributors
12
4
3
3
3
Categories
22
11
4
4
3
Platforms
23
7
5
4
3
Products / Services
28
4
4
3
2
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
1
1
1
IDS Classtypes
3
IDS Protocols
2
1
KQL Query from file: Storm 1811 SE Attack Detection
KQL Query from file: DocuShield - NRT Anti-Impersonation Email Purge
This query visualises total emails with Phish (BEC) Impersonation detections by Detection Technology over time
This query visualises total emails with Phish (BEC) Impersonation detections by Detection Technology
This query visualises total emails with Phish (BEC) - Impersonation detections over time.
This query visualises the amount of phish emails that are quarantined, summarized daily by the detection method
This query helps reviewing count of phish detections done by spoof detection methods
'This detection uses Windows security events to look for users reading the local Device Identity Key (Machine Key).
This information can be correlated with other events for additional context and get to use-cases where a
machine key with a transport key together can be used to impersonate an Entra ID joined or registered machine.
Reference: https://o365blog.com/post/deviceidentity/'
This information can be correlated with other events for additional context and get to use-cases where a
machine key with a transport key together can be used to impersonate an Entra ID joined or registered machine.
Reference: https://o365blog.com/post/deviceidentity/'
This query visualises total emails with Phish detections over time summarizing the data daily by various Phish Detection technologies/controls
This query helps to find threats using display name impersonation for users not already protected with User Impersonation
This query helps reviewing malicious email detections by detection methods
In this detection approach, we correlate email from non-prevalent senders in the organization with impersonation intents
This query helps reviewing count of spoof and impersonation detections done per sender IP
This query helps reviewing Phish detections done by some of the most frequent detection technologies in the last 7 days
The analytic detects a suspicious computer account name change in Active Directory. It leverages Event ID 4781, which logs account name changes, to identify instances where a computer account name is changed to one that does not end with a '$'. This behavior is significant as it may indicate an attempt to exploit CVE-2021-42278 and CVE-2021-42287, which can lead to domain controller impersonation and privilege escalation. If confirmed malicious, this activity could allow an attacker to gain elevated privileges and potentially control the domain.
The analytic identifies emails claiming to be sent from a domain similar to one you are monitoring for potential abuse. It leverages email header data, specifically the sender's address, and cross-references it with a lookup table of known domain permutations generated by the "ESCU - DNSTwist Domain Names" search. This activity is significant as it can indicate phishing attempts or brand impersonation, which are common tactics used in social engineering attacks. If confirmed malicious, this could lead to unauthorized access, data theft, or reputational damage.
This rule detects the creation of a named pipe using `cmd.exe` or `powershell.exe` by looking for specific command-line arguments. The presence of `echo`, `>` and `\\.\pipe\` in the command line indicates an attempt to create or interact with a named pipe. This activity can be associated with privilege escalation techniques, where an attacker might use named pipes for inter-process communication to elevate privileges.
Page 2 of 2