Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
696 detections
Filters
Last updated
All Time
Detection languages
332
134
106
55
25
Contributors
115
100
66
62
55
Categories
136
129
107
104
84
Platforms
324
178
85
83
80
Products / Services
134
112
104
52
47
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
2
2
2
2
1
IDS Classtypes
48
29
11
7
6
IDS Protocols
66
20
11
6
3
'This query identifies attackers trying to enumerate the Storage keys as well as updating roles using AzureActivity,SigninLogs
and AuditLogs'
and AuditLogs'
'Detects when there is a Service Principal login attempt from a country that has not seen a successful login in the previous 14 days.
Threat actors may attempt to authenticate with credentials from compromised accounts - monitoring attempts from anomalous locations may help identify these attempts.
Authentication attempts should be investigated to ensure the activity was legitimate and if there is other similar activity.
Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-for-failed-unusual-sign-ins'
Threat actors may attempt to authenticate with credentials from compromised accounts - monitoring attempts from anomalous locations may help identify these attempts.
Authentication attempts should be investigated to ensure the activity was legitimate and if there is other similar activity.
Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-for-failed-unusual-sign-ins'
Detects specific process parameters as used by Mustang Panda droppers
Looks for multiple users that had their admin role removed by a single user within a certain period.
Detects non-sysinternals tools setting the "accepteula" key which normally is set on sysinternals tool execution
Detects the creation of diagcab file, which could be caused by some legitimate installer or is a sign of exploitation (review the filename and its location)
This query helps hunting for BEC - File sharing tactics - OneDrive or SharePoint
Detects the execution of the PurpleSharp adversary simulation tool
Windows Update Error
Sigma
Detects Windows update errors including installation failures and connection issues. Defenders should observe this in case critical update KBs aren't installed.
'Indicates when an anomalous number of resources are created in Azure via AzureActivity log. Resource creation could indicate malicious or spurious use of your Azure Resource allocation.'
'The query looks for source code files being modified immediately after a build process is started. The purpose of this is to look for malicious code injection during the build process.
More details: https://techcommunity.microsoft.com/t5/azure-sentinel/monitoring-the-software-supply-chain-with-azure-sentinel/ba-p/2176463'
More details: https://techcommunity.microsoft.com/t5/azure-sentinel/monitoring-the-software-supply-chain-with-azure-sentinel/ba-p/2176463'
Detects a command used by conti to find volume shadow backups
Detects potentially highly relevant antivirus events in the application log based on known virus signature names and malware keywords.
Detects the keyboard preload installation with a suspicious keyboard layout, e.g. Chinese, Iranian or Vietnamese layout load in user session on systems maintained by US staff only
Detects suspicious commandline flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights
Detects command lines that contain the 'accepteula' flag which could be a sign of execution of one of the Sysinternals tools
'Detects successful signins using single factor authentication where the device, location, and ASN are abnormal.
Single factor authentications pose an opportunity to access compromised accounts, investigate these for anomalous occurrencess.
Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-devices#non-compliant-device-sign-in'
Single factor authentications pose an opportunity to access compromised accounts, investigate these for anomalous occurrencess.
Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-devices#non-compliant-device-sign-in'
'Identifies an export of the ADFS DKM Master Key from Active Directory.
References: https://blogs.microsoft.com/on-the-issues/2020/12/13/customers-protect-nation-state-cyberattacks/,
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html?1
To understand further the details behind this detection, please review the details in the original PR and subequent PR update to this:
https://github.com/Azure/Azure-Sentinel/pull/1562#issue-551542469
https://github.com/Azure/Azure-Sentinel/pull/1512#issue-543053339
'
References: https://blogs.microsoft.com/on-the-issues/2020/12/13/customers-protect-nation-state-cyberattacks/,
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html?1
To understand further the details behind this detection, please review the details in the original PR and subequent PR update to this:
https://github.com/Azure/Azure-Sentinel/pull/1562#issue-551542469
https://github.com/Azure/Azure-Sentinel/pull/1512#issue-543053339
'
'Looks for file uploads actions to Azure File and Blob Storage from known VPS provider network ranges.
This is not an exhaustive list of VPS provider ranges but covers some of the most prevalent providers observed.'
This is not an exhaustive list of VPS provider ranges but covers some of the most prevalent providers observed.'
'This query helps identify rare DNS connections and resulting data transfer to/from the associated domain. It can help identify unexpected large data transfers to or from internal systems which may indicate data exfil or malicious tool download.'
This query visualises total emails with Malware detections over time summarizing the data daily by Malware detection technologies/controls used for detecting unknown-unique malware.
Page 23 of 34