Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
696 detections
Filters
Last updated
All Time
Detection languages
332
134
106
55
25
Contributors
115
100
66
62
55
Categories
136
129
107
104
84
Platforms
324
178
85
83
80
Products / Services
134
112
104
52
47
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
2
2
2
2
1
IDS Classtypes
48
29
11
7
6
IDS Protocols
66
20
11
6
3
Hunting for credential phishing using the "Referral" infrastructure using Defender for Office 365 data
Provides a summary of total number of detections
Locate vulnerable Gigabyte drivers used by RobbinHood ransomware to turn off security tools.
Query for Microsoft Defender Antivirus detections.
Query #1: Query for Antivirus detection events.
Query #1: Query for Antivirus detection events.
// Detect Active Directory service accounts that are not active because their last logon was more than 14 days ago
// Replace XXX on line 4 with the naming convention start of your Active Directory service accounts
// Replace XXX on line 4 with the naming convention start of your Active Directory service accounts
Prior to deploying Macaw ransomware in an organization, the adversary will disable several tools and functions in order to inhibit later recovery efforts.
This query correlates Microsoft Defender for Office 365 signals and Microsoft Entra ID identity data to find the relevant endpoint event BrowerLaunchedToOpen in Microsoft Defender ATP.
This event reflects relevant clicks on the malicious URL in the spear-phishing email recognized by Microsoft Defender for Office 365.
This event reflects relevant clicks on the malicious URL in the spear-phishing email recognized by Microsoft Defender for Office 365.
This query identifies when a user clicks a link that opens a browser to navigate to a URL
which uses redirection. It then filters out any redirections to URLs in the same DNS namespace
as the originating URL. Redirection identification is done based on URL query parameters
outlined in the following article: https://www.bleepingcomputer.com/news/security/snapchat-amex-sites-abused-in-microsoft-365-phishing-attacks/
which uses redirection. It then filters out any redirections to URLs in the same DNS namespace
as the originating URL. Redirection identification is done based on URL query parameters
outlined in the following article: https://www.bleepingcomputer.com/news/security/snapchat-amex-sites-abused-in-microsoft-365-phishing-attacks/
'This query looks at the last 14 days for "Consent to application" operation by a user/app which could potentially mean unauthorized access. Additional context is added from AuditLogs based on CorrleationId from the same account that performed the action.'
Detects unknown program using commandline flags usually used by tools such as PsExec and PAExec to start programs with SYSTEM Privileges
Detects suspicious commandline flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights
Detects command lines that contain the 'accepteula' flag which could be a sign of execution of one of the Sysinternals tools
Detects the use of the lesser known remote execution tool named CsExec a PsExec alternative
Detects the execution of a Sysinternals Tool via the creation of the "accepteula" registry key
Detects non-sysinternals tools setting the "accepteula" key which normally is set on sysinternals tool execution
Detects specific patterns found after a successful ProxyLogon exploitation in relation to a Commandlet invocation of Set-OabVirtualDirectory
'This hunting query identifies Zoom room systems with high CPU alerts that may be a sign of device compromise.'
Detects a command used by conti to find volume shadow backups
Detects unknown program using commandline flags usually used by tools such as PsExec and PAExec to start programs with SYSTEM Privileges
This query will hunt for files matching the current abuse.ch recent threat feed based on Sha256. Currently the query is set up to analyze the last day worth of events, but this is configurable using the MaxAge variable.
Identify prior activity from this campaign using IOCs shared by Microsoft's Threat Intelligence Center, or MSTIC.
Read more: https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/
Read more: https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/
Page 27 of 34