Search and filter across all detection sources
66 rules
[Barracuda] Incident Response Deleted Email Detected
[Barracuda] Incident Response Incident Manual Detected
[Barracuda] Incident Response Continuous Remediation Enabled Detected
[Barracuda] Incident Response User-Reported Email Detected
[Barracuda] Incident Response Potential Incident: Related Threats Detected
[Barracuda] Email Gateway Remediated_By_Incident_Response Event Detected
[Barracuda] Incident Response Potential Incident: Post-Delivery Threat Detected
osquery: $(osquery.pack) query result
TRITON_ICS_FRAMEWORK [yara]
TRITON framework recovered during Mandiant ICS incident response
TRITON_ICS_FRAMEWORK [malware]
osquery: $(osquery.pack) $(osquery.subquery): File $(osquery.columns.path) has setuid enabled
osquery: $(osquery.pack) $(osquery.subquery): Key $(osquery.columns.key), Value $(osquery.columns.value)
osquery: $(osquery.pack) $(osquery.subquery): Username $(osquery.columns.username), Key $(osquery.columns.key)
osquery: $(osquery.pack) $(osquery.subquery): Address $(osquery.columns.address) Hostnames $(osquery.columns.hostnames)
osquery: $(osquery.pack) $(osquery.subquery): User $(osquery.columns.username) host $(osquery.columns.host)
Azure Action Groups Deleted
Detects when Azure action groups are deleted, which could disable alert notifications to security teams to prevent incident response.
PUA - Mouse Lock Execution
In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both credential access and collection in security incidents.
osquery: $(osquery.pack) $(osquery.subquery): Program $(osquery.columns.name) is launched at system startup
osquery: $(osquery.pack) $(osquery.subquery): Application Layer Firewall for OSX version $(osquery.columns.version)
osquery: $(osquery.pack) $(osquery.subquery): Kernel module $(osquery.columns.name) version $(osquery.columns.version)
osquery: $(osquery.pack) $(osquery.subquery): Shared NFS $(osquery.columns.share) options $(osquery.columns.options)