Azure Sentinel
@AzureSentinel50 followers965 downloads1,436 copies43 likes37,858 views
1,223 detections
Filters
Last updated
All Time
Detection languages
1,223
Categories
220
218
180
171
135
Platforms
766
284
188
78
29
Products / Services
492
297
159
152
93
MITRE Techniques
530
485
467
348
348
This query detects possible abuse of ms-msdt MSProtocol URI scheme to load and execute malicious code via Microsoft Support Diagnostic Tool Vulnerability (CVE-2022-30190).
The following query detects when Microsoft Office software spawns an instance of the MSDT utility, msdt.exe.
References:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190
https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/
https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug
https://attack.mitre.org/techniques/T1221/
The following query detects when Microsoft Office software spawns an instance of the MSDT utility, msdt.exe.
References:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190
https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/
https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug
https://attack.mitre.org/techniques/T1221/
This query looks for lnk file executions from other locations than C: -drive, which can relate to mounted ISO-files.
Reference - https://threathunt.blog/detecting-a-payload-delivered-with-iso-files-using-mde/
Reference - https://threathunt.blog/detecting-a-payload-delivered-with-iso-files-using-mde/
This query was originally published in the threat analytics report, Ursnif (Gozi) continues to evolve.
Microsoft HTML Applications, or HTAs, are executable files that use the same technologies and models as Internet Explorer, but do not run inside of a web browser.
Mshta.exe is a Windows utility that provides a host for HTA files to run in. Although it has legitimate uses, attackers can use mshta.exe to run malicious Javascript or VBScript commands. The MITRE ATT&CK framework includes Mshta among its list of enterprise attack techniques.
The following query detects when mshta.exe has been run, which might include illegitimate usage by attackers.
References:
https://docs.microsoft.com/previous-versions/ms536496(v=vs.85)
https://attack.mitre.org/techniques/T1170/
Microsoft HTML Applications, or HTAs, are executable files that use the same technologies and models as Internet Explorer, but do not run inside of a web browser.
Mshta.exe is a Windows utility that provides a host for HTA files to run in. Although it has legitimate uses, attackers can use mshta.exe to run malicious Javascript or VBScript commands. The MITRE ATT&CK framework includes Mshta among its list of enterprise attack techniques.
The following query detects when mshta.exe has been run, which might include illegitimate usage by attackers.
References:
https://docs.microsoft.com/previous-versions/ms536496(v=vs.85)
https://attack.mitre.org/techniques/T1170/
Use this query to look for alerts related to suspected ransomware and Cobalt Strike activity, a tool used in numerous ransomware campaigns
This query helps in checking for spoofing attempts on the domain with Authentication failures
This query helps reviewing admin reported email submissions
This query visualises emails submitted as false negatives by admins where emails where already detected by MDO but there was an admin policy override
This query visualises emails submitted by admins as false positives, summarizing the data by top 10 sender domains of those emails
This query helps hunt for emails with malicious attachments based on SH256 hash from external IOC source
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Page 67 of 123