Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,749 detections
Filters
Last updated
All Time
Detection languages
2,543
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,244
994
880
773
476
Platforms
2,849
1,449
1,229
356
73
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
1,096
988
949
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
This query helps surface phishing campaigns associated with Appspot abuse.
The following analytic detects the suspicious auditd service stop. This behavior is critical for a SOC to monitor because it may indicate attempts to gain unauthorized access or maintain control over a system. Such actions could be signs of malicious activity. If confirmed, this could lead to serious consequences, including a compromised system, unauthorized access to sensitive data, or even a wider breach affecting the entire network. Detecting and responding to these signs early is essential to prevent potential security incidents.
This query helps reviewing malicious clicks where user was allowed to proceed through malicious URL page.
This query helps reviewing the list of top 10% of most attacked users
Advanced Hunting has default timezone as UTC time. Filters in Advanced Hunting also work in UTC by default whereas query results are shown in local time if user has selected local time zone in security center settings.
This query helps getting GeoIP information of emails SenderIPv4 addresses.
This query helps in reviewing malicious emails allowed due to user overrides
The analytic detects a spike in the number of API calls made to cloud infrastructure by a user. It leverages cloud infrastructure logs and compares the current API call volume against a baseline probability density function to identify anomalies. This activity is significant because an unusual increase in API calls can indicate potential misuse or compromise of cloud resources. If confirmed malicious, this could lead to unauthorized access, data exfiltration, or disruption of cloud services, posing a significant risk to the organization's cloud environment.
The analytic detects cloud API calls executed by user roles that have not previously run these commands. It leverages the Change data model in Splunk to identify commands executed by users with the user_type of AssumedRole and a status of success. This activity is significant because new commands from different user roles can indicate potential malicious activity or unauthorized actions. If confirmed malicious, this behavior could lead to unauthorized access, data breaches, or other damaging outcomes by exploiting new or unmonitored commands within the cloud environment.
The analytic detects the creation of cloud compute instances using previously unseen image IDs. It leverages cloud infrastructure logs to identify new image IDs that have not been observed before. This activity is significant because it may indicate unauthorized or suspicious activity, such as the deployment of malicious payloads or unauthorized access to sensitive information. If confirmed malicious, this could lead to data breaches, unauthorized access, or further compromise of the cloud environment. Immediate investigation is required to determine the legitimacy of the instance creation and to mitigate potential threats.
This query helps reviewing Phish detections done by some of the most frequent detection technologies in the last 7 days
The following analytic detects the suspicious sysmon service stop. This behavior is critical for a SOC to monitor because it may indicate attempts to gain unauthorized access or maintain control over a system. Such actions could be signs of malicious activity. If confirmed, this could lead to serious consequences, including a compromised system, unauthorized access to sensitive data, or even a wider breach affecting the entire network. Detecting and responding to these signs early is essential to prevent potential security incidents.
This query helps reviewing malware detections by detection methods
This query helps reviewing top submitters of user submissions
The following analytic identifies the creation of cloud compute instances by users who have not previously created them. It leverages data from the Change data model, focusing on 'create' actions by users, and cross-references with a baseline of known user activities. This activity is significant as it may indicate unauthorized access or misuse of cloud resources by new or compromised accounts. If confirmed malicious, attackers could deploy unauthorized compute instances, leading to potential data exfiltration, increased costs, or further exploitation within the cloud environment.
Looks for a new device registration in Entra ID preceded by medium or high-risk sign-in session for the same user within maximum 6h timeframe.
This query helps reviewing admin reported email submissions
This query helps reviewing top submitters of admin submissions
One of the tricks used in phishing is obfuscating the domain name in a URL by
using the @ symbol. This technique goes all the way back to the original RFC
for URLs, RFC 1738. When you specify an @ in the DNS portion of a URL it denotes
that the left side of the DNS name holds a username and password for
authentication to the server on the right side of the @ sign. Unfortunately,
an attacker can use this technique to trick a user by formatting the URL as
http://www.trusteddomain.com@www.realdomain.com/. When a user sees the link
may they think they're going to www.trusteddomain.com when in fact they are
going to www.realdomain.com. For a working example, try this:
http://www.google.com@www.bing.com/.
This query finds this technique in URLs embedded within e-mails and highlights
the fake and real domains.
using the @ symbol. This technique goes all the way back to the original RFC
for URLs, RFC 1738. When you specify an @ in the DNS portion of a URL it denotes
that the left side of the DNS name holds a username and password for
authentication to the server on the right side of the @ sign. Unfortunately,
an attacker can use this technique to trick a user by formatting the URL as
http://www.trusteddomain.com@www.realdomain.com/. When a user sees the link
may they think they're going to www.trusteddomain.com when in fact they are
going to www.realdomain.com. For a working example, try this:
http://www.google.com@www.bing.com/.
This query finds this technique in URLs embedded within e-mails and highlights
the fake and real domains.
URLs clicked in Email
The following analytic identifies user sessions in Office 365 accessed from multiple IP addresses, indicating potential adversary-in-the-middle (AiTM) phishing attacks. It detects this activity by analyzing Azure Active Directory logs for 'UserLoggedIn' operations and flags sessions with more than one associated IP address. This behavior is significant as it suggests unauthorized concurrent access, which is uncommon in normal usage. If confirmed malicious, the impact could include data theft, account takeover, and the launching of internal phishing campaigns, posing severe risks to organizational security.
Page 166 of 179