EXPLORE DETECTIONS
List supression rule creations
This query lists supression rule creations.
List the 20 most rare file extensions recieved from emails
This query list the 20 rarest file extentions that have been used in email attachments.
List the devices with interesting open ports
List the devices with interesting open ports
List the devices with open database ports
This query lists the devices with open database ports
List the devices with open remote service ports
This query lists the devices with open remote service ports
List the devices with the most open ports
List the devices with the most open ports.
List the external admin activities
This query lists all the external admin activities in your tenant sorted from the account with the most actions performed to the one with the least actions.
List the file extentions that have been used during a HTTP GET request
List the file extentions that have been used during a HTTP GET request
List the top 10 accounts that have the most impersonators
This query lists the top 10 accounts that have performed the most imporsonated users. The definiation for this field is: *Indicates whether the activity was performed by one user for another (impersonated) user*.
List the top 10 external applications with the most consented users
The query below lists the top 10 external applications with the most consented users. It is highly recommended to review newly added applications in which only user consent is given.
List the top 100 accounts that have performed the most impersonated actions
This query lists the top 100 accounts that have performed the most imporsonated actions. The definiation for this field is: *Indicates whether the activity was performed by one user for another (impersonated) user*.
Live Response File Collection
This query lists all the Getfile activities that have been executed. This includes listing the SHA256 hash of the collected file (when available).
Living Off The Tunnels IOCS
raw.githubusercontent.com/jkerai1/SoftwareCertificates/refs/heads/main/Bulk-IOC-CSVs/Living%20Off%20The%20Tunnels%20%20IOCs.csv"] with (format="csv", ignoreFirstRecord=True);
Living Off Trusted Sites
The Living Off Trusted Sites protject is included in the queries below. The project is about: *Attackers are using popular legitimate domains when conducting phishing, C&C, exfiltration and downloading tools to evade detection. The list of websites below allow attackers to use their domain or subdomain.* The query below can be used to hunt for websites which are rare in your organization or are executed by rare *InitiatingFiles*. This query can be used to list all found LOTS domains and how often they are executed, this can serve as input for further investigation or as start for you threat hunting case.
Local Administrator Additions
Adversaries may create a local accounts to maintain access to victim systems. This query lists all the locad admins that have been added in the seletect timeframe per device.
Local Group Created
This query lists all the local groups that have been created, this is done by listing all SecurityGroupCreated events and filtering all group creations on Domain Controllers. The GroupDomainName can be used to identify on which device the group has been created.
Local Group Discovery
Adversaries often execute the *net localgroup "adminstrator"* command to get information about the local admins on a device, but there might also be other groups that could be intersting. This query can be used as custom detection rule to detect local group discovery events using net.exe or net1.exe. There is a whitelist for departments that are expected to perform this action, but if HR or Sales executes these commands you probably want to know.
Locate Nobelium implant receiving DNS response
This query was originally published in the threat analytics report, *Solorigate supply chain attack*. Please note that these attacks are currently known as the *Nobelium campaign*.
Locate Nobelium implant receiving DNS response
This query was originally published in the threat analytics report, *Solorigate supply chain attack*. Please note that these attacks are currently known as the *Nobelium campaign*.
Locate Nobelium-related malicious DLLs created in the system or locally
This query was originally published in the threat analytics report, *Solorigate supply chain attack*. Please note that these attacks are currently known as the *Nobelium campaign*.
Locate Nobelium-related malicious DLLs loaded in memory
This query was originally published in the threat analytics report, *Solorigate supply chain attack*. Please note that these attacks are currently known as the *Nobelium campaign*.
Locate Shlayer payload decryption activity
This query was originally published in the threat analytics report, *OSX/Shlayer sustains adware push*.
Locate Shlayer payload decryption activity
This query was originally published in the threat analytics report, *OSX/Shlayer sustains adware push*.
Locate SolarWinds processes launching command prompt with the echo command
This query was originally published in the threat analytics report, *Solorigate supply chain attack*. Please note that these attacks are currently known as the *Nobelium campaign*.