Browse Rules

Search and filter across all detection sources

238 rules

bertjanp unknown kql

Hunt for anomalies in Sentinel

The anomalies table contains anomalies generated by the active Anomaly analytics rules in Azure Sentinel. Those anomalies do not trigger a incident by default (at the moment of writing). This query lists the anomalies and the reaons why they are anomalies.
sentinel low kql

API - Anomaly Detection

'42Crunch API protection anomaly detection'

sagan medium other

[NETSKOPE] anomaly alert - mlad

[NETSKOPE] anomaly alert - mlad
sentinel medium kql

Unusual Anomaly

'Anomaly Rules generate events in the Anomalies table. This scheduled rule tries to detect Anomalies that are not usual, they could be a type of Anomaly that has recently been activated, or an infrequent type. The detected Anomaly should be reviewed, if it is relevant enough, eventually a separate scheduled Analytics Rule could be created specifically for that Anomaly Type, so an alert and/or incident is generated everytime that type of Anomaly happens.'

sagan medium other

[CISCO-PRIME] MFP anomaly detected

[CISCO-PRIME] MFP anomaly detected
sagan medium other

[FORTINET] SSL Certificate Anomaly - Blacklisted

[FORTINET] SSL Certificate Anomaly - Blacklisted
sagan informational other

[FORTINET] UTM Anomaly Event Detected

[FORTINET] UTM Anomaly Event Detected
sagan informational other

[FORTINET] UTM Anomaly Event Detected

[FORTINET] UTM Anomaly Event Detected
sagan low other

[MCAS] ALERT_DISCOVERY_ANOMALY_DETECTION

[MCAS] ALERT_DISCOVERY_ANOMALY_DETECTION
sagan medium other

[NETSKOPE] anomaly alert - data_exfiltration

[NETSKOPE] anomaly alert - data_exfiltration
sagan medium other

[NETSKOPE] Anomaly Alert Detected (High)

[NETSKOPE] Anomaly Alert Detected (High)
sagan medium other

[NETSKOPE] Anomaly Alert Detected (Low)

[NETSKOPE] Anomaly Alert Detected (Low)
sagan medium other

[NETSKOPE] Anomaly Alert Detected (Medium)

[NETSKOPE] Anomaly Alert Detected (Medium)
signature-base unknown yara

SUSP_Sysinternals_Desktops_Anomaly_Feb25 [yara]

Detects anomalies in Sysinternals Desktops binaries
sagan unknown other

[FORTINET] Attack Detected by ICMP Anomaly

[FORTINET] Attack Detected by ICMP Anomaly
sagan unknown other

[FORTINET] Attack Detected by Other Anomaly

[FORTINET] Attack Detected by Other Anomaly
sagan unknown other

[FORTINET] Attack Detected by Other Anomaly

[FORTINET] Attack Detected by Other Anomaly
sagan unknown other

[FORTINET] Attack Detected by Other Anomaly

[FORTINET] Attack Detected by Other Anomaly
sagan medium other

[FORTINET] SSL Certificate Anomaly - Disallow list

[FORTINET] SSL Certificate Anomaly - Disallow list
sagan medium other

[FORTINET] SSL Certificate Anomaly - Disallow list

[FORTINET] SSL Certificate Anomaly - Disallow list
sagan medium other

[FORTINET] SSL Certificate Anomaly - SNI Mismatched

[FORTINET] SSL Certificate Anomaly - SNI Mismatched
sagan medium other

[FORTINET] SSL Certificate Anomaly - SNI Mismatched

[FORTINET] SSL Certificate Anomaly - SNI Mismatched
sagan medium other

[FORTINET] SSL Certificate Anomaly - SNI Mismatched

[FORTINET] SSL Certificate Anomaly - SNI Mismatched
sagan medium other

[NETSKOPE] anomaly alert - user_shared_credentials

[NETSKOPE] anomaly alert - user_shared_credentials
signature-base unknown yara

SysInternals_Tool_Anomaly [yara]

SysInternals Tool Anomaly - does not contain Mark Russinovich as author