EXPLORE DETECTIONS
New UserAgent used
This query can be used to detect new UserAgents that have been used to perform sign in activities (succesful or failed). If you company only uses windows devices it will be interesting to investigate the other UserAgents that have been used.
Nltest Discovery Activities
The windows utility Nltest is known to be used by adversaries to enumerate domain trusts. This detection is based on the *DeviceProcessEvents* table and triggers if more than 3 nltest queries are executed by a user on the same computer within 30 minutes. You can alter the variables yourself to tailor it to your environment.
Nltest Discovery Activities
The windows utility Nltest is known to be used by adversaries to enumerate domain trusts. This detection is based on Windows Security Event 4688 and triggers if more than 3 nltest queries are executed by a user on the same computer within 30 minutes. You can alter the variables yourself to tailor it to your environment.
Nobelium campaign DNS pattern
This query looks for the DGA pattern of the domain associated with the Nobelium campaign, in order to find other domains with the same activity pattern.
Nobelium encoded domain in URL
Looks for a logon domain in the Azure AD logs, encoded with the same DGA encoding used in the Nobelium campaign.
Notepad++ - Chrysalis Backdoor File Hash IOCs
Reference: https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
Notepad++ - Chrysalis Backdoor gup.exe detection
Reference: https://medium.com/capturedsignal/notepad-security-incident-threat-hunting-using-kql-and-defender-for-endpoint-logs-dd83b984fcc6
Notepad++ - Chrysalis Backdoor gup.exe spawned binaries excluding known-good Notepad++ hashes
Credit: https://medium.com/capturedsignal/notepad-security-incident-threat-hunting-using-kql-and-defender-for-endpoint-logs-dd83b984fcc6
Notepad++ - Chrysalis Backdoor Network IOCs
Reference: https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
Notepad++ - Chrysalis Backdoor Spawned binaries + network connections correlation
Credit: https://medium.com/capturedsignal/notepad-security-incident-threat-hunting-using-kql-and-defender-for-endpoint-logs-dd83b984fcc6
OAuth apps accessing user mail via GraphAPI [Nobelium]
This query helps you review all OAuth applications accessing user mail via Graph. It could return a significant number of results depending on how many applications are deployed in the environment.
OAuth apps reading mail via GraphAPI and directly [Nobelium]
As described in [previous guidance](https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/), Nobelium may re-purpose legitimate existing OAuth Applications in the environment to their own ends. However, malicious activity patterns may be discernable from legitimate ones.
OAuth apps reading mail via GraphAPI anomaly [Nobelium]
Use this query to review OAuth applications whose behaviour has changed as compared to a prior baseline period. The following query returns OAuth Applications accessing user mail via Graph that did not do so in the preceding week.
office Add-in Installs
This Query looks for office Add-in Installs
Office applications launching wscript.exe to run JScript
This query was originally published in the threat analytics report, *Trickbot: Pervasive & underestimated*.
Onboarded Machines by Resource Group
This query lists the amount of onboarded Azure Arc Machines for each resourceGroup.
OneDrive Sync From Rare IP
This query combines the CloudAppEvents table and the SignInLogs from Entra ID to hunt for OneDrive Sync activities from a rare IP address. The variables should be set based on your needs.
OnionMail EmailAddresses
raw.githubusercontent.com/jkerai1/TLD-TABL-Block/refs/heads/main/OnionMail.txt'] with (format=csv, ignoreFirstRecord=False);
Operation download all users in Azure Active directory performed
Detect when a user account downloads all Azure Active Directory users. This can be used to dump all Azure AD users. Both admin and non-admin users can download user lists.
Oracle WebLogic process wlsvcX64.exe exploitation and execution of PowerShell script to download payloads
This query was originally published in the threat analytics report, *Sysrv botnet evolution*.
Outbound MSHTA Connection
Detects outbound network connections initiated by `mshta.exe`. `mshta.exe` is a legitimate Windows binary, but it is frequently abused by adversaries to execute malicious script content from local or remote HTA resources.
Outlook email access by campaigns using Qakbot malware
This query was originally published in the threat analytics report, *Qakbot blight lingers, seeds ransomware*
Parsed User Agent
| where TimeGenerated > ago(30d)
Password change after succesful brute force
Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. This query combines the brute force indicators with a followed password change after the adversary has gained access to an account.