davidgodwinpratt.com / soc

Determines DeviceId from internal IP address and outputs all alerts in events table associated to the DeviceId. Example use case is Firewall determines Internal IP with suspicious network activity. Qu

One of the challenges in making an AppLocker policy is knowing where applications launch from. This query normalizes process launch paths through aliasing, then counts the number of processes launche

Baseline Comparison. Author: miflower. The purpose of this query is to perform a comparison between "known good" machines and suspected bad machines. The original concept for this query was born due t

This query identifies crashing processes based on parameters passed to werfault.exe and attempts to find the associated process launch from DeviceProcessEvents.

This query is a function that consumes the publicly available Azure IP address list and checks a list of remote IP addresses against it to see if they are Azure IP addresses or not. To use this, repla

This query will count the number of devices in Defender ATP based on their DNS suffix. For a full list of devices with the DNS suffix, comment out or remove the last line.

This query calculates device uptime based on periodic DeviceInfo which is recorded every 15 minutes regardless of device's network connectivity and uploaded once device gets online. If its interval is

Did you know you can use Emojis in Windows?. Read more here: https://davidzych.com/abusing-emoji-in-windows. Check-out who in your organization has renamed his or her computer to a Pizza or to a smili

This query will provide a report of many of the best practice configurations for Defender ATP deployment. Special Thanks to Gilad Mittelman for the initial inspiration and concept. Any tests which are

This query looks for events that are near in time to a detected event. It shows how you could avoid typing exact timestamps, and replace it with a simple query to get the timestamp of your pivot event

This query looks for events that are near in time to a detected event. It shows how you could avoid typing exact timestamps, and replace it with a simple query to get the timestamp of your pivot event

This query looks for events that are near in time to a detected event. It shows how you could avoid typing exact timestamps, and replace it with a simple query to get the timestamp of your pivot event

This query looks for events that are near in time to a detected event. It shows how you could avoid typing exact timestamps, and replace it with a simple query to get the timestamp of your pivot event

Sample query to detect If there are more then 3 failed logon authentications on high value assets. Update DeviceName to reflect your high value assets. For questions @MiladMSFT on Twitter or milad.asl

Query #1 - Find the machines on which this file was seen. TODO - set file hash to be a SHA1 hash of your choice...

Query #1 - Find the machines on which this file was seen. TODO - set file hash to be a SHA1 hash of your choice...

This query helps you design client firewall rules based on data stored within DeviceNetworkEvents. Folder paths are alias'ed to help represent the files making or receiving network connections without

This is a completely stupid and pointless query that makes Vogon poetry out of a random FolderPath from the table you pass it. You can change DeviceProcessEvents for any table as long as it has a col

Hunt package for 2 IOCs associated with Kimwolf

Hunt package for 37 IOCs associated with ClearFake

Hunt package for 90 IOCs associated with Unknown malware

Hunt package for 2 IOCs associated with AdaptixC2

Hunt package for 9 IOCs associated with AsyncRAT

Hunt package for 30 IOCs associated with Cobalt Strike

Hunt package for 4 IOCs associated with Remcos

Vidar is a credential-stealing malware that exfiltrates sensitive data via encrypted channels

Hunt package for 7 IOCs associated with VShell

Hunt package for 18 malicious URLs tagged as 32-bit

Hunt package for 15 malicious URLs tagged as adb

Hunt package for 2 malicious URLs tagged as amos

Hunt package for 4 malicious URLs tagged as c2-monitor-auto

Hunt package for 10 malicious URLs tagged as ClearFake

Hunt package for 3 malicious URLs tagged as DDoSAgent

Hunt package for 19 malicious URLs tagged as elf

Hunt package for 2 malicious URLs tagged as loader

Hunt package for 25 malicious URLs tagged as malware_download

This query was originally published in the threat analytics report, WinRAR CVE-2018-20250 exploit WinRAR is a third-party file compressing application. Versions 5.61 and earlier contained a flaw that

This query was originally published in the threat analytics report, WinRAR CVE-2018-20250 exploit WinRAR is a third-party file compressing application. Versions 5.61 and earlier contained a flaw that

This query was originally published in the threat analytics report, "Exchange Server zero-days exploited in the wild". In early March 2021, Microsoft released patches for four different zero-day vulne

The following query look for suspicious behaviors observed by the samples analyzed in the report.

Identifies native processes or binaries in writable paths loading .NET runtimes. This suggests in-memory code injection and ETW patching used by malware to execute code while evading detection by secu

This query looks for anomalies in mail item access events made by Graph API. It uses standard deviation to determine if the number of events is anomalous. The query returns all clientIDs where the amo

Anthem Hack Deep Panda - htran-exe

Anthem Hack Deep Panda - lot1.tmp-pwdump

Anthem Hack Deep Panda - ScanLine sl-txt-packed

Anthem Hack Deep Panda - Trojan.Kakfum sqlsrv32.dll

YARA rule: APT_DeputyDog

YARA rule: APT_DeputyDog_Fexel

YARA rule: APT_Derusbi_DeepPanda

YARA rule: APT_Derusbi_Gen

Rule to detect Duqu 2.0 drivers

The YARA rule 'apt_duqu2_loaders' detects Duqu 2.0 malware samples

YARA rule: apt_nix_elf_derusbi

YARA rule: apt_nix_elf_derusbi_kernelModule

YARA rule: apt_nix_elf_Derusbi_Linux_SharedMemCreation

YARA rule: apt_nix_elf_Derusbi_Linux_Strings

YARA rule: apt_win_exe_trojan_derusbi

YARA rule: apt_win32_dll_bergard_pgv_pvid_variant

Looks for accounts that uploaded multiple code repositories to external web domain.

Assuming that you have a machine that is properly BitLocker'ed, then the machine will need to be running to extract the SAM and SYSTEM files. This first query looks for any access to the HKLM that hap

The following query surface network activity associated with exploitation of CVE-2022-22965.

Check all created files. That does not have extension ps1, bat or cmd to avoid IT Pro scripts. That are not copied to C:\ to detect all file share, external drive, data partition that are not allowed,

This query can be used to detect instances of a malicious insider creating a file archive and then emailing that archive to an external "competitor" organization.

This query can be used to explore any instances where a terminated individual (i.e. one who has an impending termination date but has not left the company) downloads a large number of files from a non

This query can be used to detect instances of malicious users who attempt to create steganographic images and then immediately browse to a webmail URL. This query would require additional investigati

Identify service hollowing and persistence setting

File manipulation actions associated with CRASHOVERRIDE wiper

Registry Wiper functionality assoicated with CRASHOVERRIDE

The query checks process command lines arguments and parent/child combinations to find machines where there have been. Attempts to exploit the Protocol Handler Vulnerability of Electron framework CVE-

This query was originally published in the threat analytics report, "Exchange Server zero-days exploited in the wild". In early March 2021, Microsoft released patches for four different zero-day vulne

This query lists files copied to USB external drives with USB drive information based on FileCreated events associated with most recent USBDriveMount events befor file creations. But be aware that Adv

This query checks for specific processes and domain TLD used in the CVE-2018-4878 flash 0day exploit attack reported by KrCERT. CVE: CVE-2018-4878. Read more here:. Https://www.krcert.or.kr/data/secNo

Identifies application role assignments to service principals granting high-risk permissions such as Mail.ReadWrite, Directory.ReadWrite.All, or RoleManagement.ReadWrite.Directory, which provide tenan

Identifies the user who acted on a reported phishing message and compares that actor with the original recipient, helping investigate delegate or shared mailbox reporting scenarios.

The query checks process command lines arguments and parent/child combinations to find machines where there have been. Attempts to exploit a DHCP remote code command injection CVE-2018-1111. DynoRoot

The MailItemsAccessed action is part of the new Advanced Audit functionality of Microsoft Defender XDR. It's part of Exchange mailbox auditing and is enabled by default for users that have an Office 3

Action "PnpDeviceConnected" reports the connection of any plug and play device. Read more online on event 6416: https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6416. Query

Action "PnpDeviceConnected" reports the connection of any plug and play device. Read more online on event 6416: https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6416. Query

This hunting query looks Malware Hides Itself Among Windows Defender Exclusions to Evade Detection

This query helps you review all OAuth applications accessing user mail via Graph. It could return a significant number of results depending on how many applications are deployed in the environment.

As described in previous guidance, Nobelium may re-purpose legitimate existing OAuth Applications in the environment to their own ends. However, malicious activity patterns may be discernable from le

Use this query to review OAuth applications whose behaviour has changed as compared to a prior baseline period. The following query returns OAuth Applications accessing user mail via Graph that did no

One common technique leveraged by attackers is using archiving applications to package up files for exfiltration. In many cases, these archives are usually protected with a password to make analysis m

This query searches for file copies which occur within a period of time (by default 15 min) to volumes other than the C drive or UNC shares. By default, this query will search all devices. A single de

First query digs in print spooler drivers folder for any file creations, MANY OF THE FILES THAT SHOULD COME UP HERE MAY BE LEGIT. Unsigned files or ones that don't have any relations to printers that

First query digs in print spooler drivers folder for any file creations, MANY OF THE FILES THAT SHOULD COME UP HERE MAY BE LEGIT. Unsigned files or ones that don't have any relations to printers that

Identifies permanent directory role assignments to privileged roles made outside the Privileged Identity Management activation workflow. Direct assignments bypass PIM approval and justification requir

Designed to catch loader observed used with ROKRAT malware

Designed to catch loader observed used with ROKRAT malware

Identifies service principal credential additions or updates by actors with no history of this operation in the preceding 90 days. A new actor outside the established baseline may indicate credential

//Check for network connections with SolarWInds IP's based on DeviceNetworkEvents## Query

Look for the spoolsv.exe launching rundll32.exe with an empty command line

Look for the creation of suspicious DLL files spawned in the \spool\ folder along with DLLs that were recently loaded afterwards from \Old.

Monitor for creation of suspicious files in the /spools/driver/ folder. This is a broad-based search that will surface any creation or modification of files in the folder targeted by this exploit. Fal

Surfaces suspicious spoolsv.exe behavior likely related to CVE-2021-1675

The query checks for suspicious Tomcat process launches associated with likely exploitation of Confluence - CVE-2022-26134 Read more here:. https://confluence.atlassian.com/doc/confluence-security-adv

Hunt package for 2 IOCs associated with Antidot

Hunt package for 13 IOCs associated with Kimwolf

Hunt package for 3 IOCs associated with Mozi

Hunt package for 2 IOCs associated with PerlBot

Hunt package for 3 IOCs associated with RedTail

Hunt package for 4 IOCs associated with XMRIG

Hunt package for 64 IOCs associated with ClearFake

Hunt package for 8 IOCs associated with KongTuke

Hunt package for 23 IOCs associated with Unknown malware

Hunt package for 2 IOCs associated with Unknown Loader

Hunt package for 2 IOCs associated with Unknown Stealer

Hunt package for 10 IOCs associated with AdaptixC2

Hunt package for 2 IOCs associated with AsyncRAT

Hunt package for 16 IOCs associated with Cobalt Strike

Hunt package for 8 IOCs associated with CountLoader

Hunt package for 2 IOCs associated with DCRat

Hunt package for 2 IOCs associated with Nanocore RAT

Hunt package for 3 IOCs associated with PureRAT

Hunt package for 2 IOCs associated with Remcos

Hunt package for 6 IOCs associated with Remus

Hunt package for 5 IOCs associated with SectopRAT

Hunt package for 4 IOCs associated with Tofsee

Hunt package for 2 IOCs associated with ValleyRAT

Hunt package for 12 IOCs associated with Vidar

Hunt package for 3 IOCs associated with VShell

YARA rule: Trojan_Derusbi

This query looks for users sharing access to files with external users. This applies to SharePoint and OneDrive users. Audit event and Cloud application identifier references. Reference - https://l

Hunt package for 3 malicious URLs tagged as 134-199-190-221

Hunt package for 3 malicious URLs tagged as 165-227-155-54

Hunt package for 47 malicious URLs tagged as 32-bit

Hunt package for 5 malicious URLs tagged as arm

Hunt package for 15 malicious URLs tagged as ClearFake

Hunt package for 4 malicious URLs tagged as e73f7ff7572070d56a631ac6796adabd

Hunt package for 8 malicious URLs tagged as elf

Hunt package for 3 malicious URLs tagged as malware_download

Hunt package for 7 malicious URLs tagged as Mozi

Hunt package for 3 malicious URLs tagged as ocx

The query checks process command being placed into the script; CVE-2022-22960 allows a user to write to it and be executed as root. This vulnerability of VMware Workspace ONE Access, Identity Manager

The query digs in Windows print spooler drivers folder for any file creations, MANY OF THE FILES THAT SHOULD COME UP HERE MAY BE LEGIT. Suspicious DLL is load from Spooler Service backup folder. This

This query looks for lnk file executions from other locations than C: -drive, which can relate to mounted ISO-files. Reference - https://threathunt.blog/detecting-a-payload-delivered-with-iso-files-us

TheMask / Careto CnC communication signature

TheMask / Careto known command and control domains

TheMask / Careto OSX component signature

TheMask / Careto SGH component signature

Casper French Espionage Malware - Win32/ProxyBot.B - x86 Payload http://goo.gl/VRJNLo

Casper French Espionage Malware - Win32/ProxyBot.B - Dropper http://goo.gl/VRJNLo

Casper French Espionage Malware - String Match in File - http://goo.gl/VRJNLo

Casper French Espionage Malware - System Info Output - http://goo.gl/VRJNLo

This query was originally published in the threat analytics report, ShadowHammer supply chain attack Operation ShadowHammer was an attack against ASUS computer hardware, using the company's own update

Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

This query generates process trees of given processes and performs anomaly detection on the process trees. It generates process trees up to 7th level. The query can be used as a template to perform an

This query was originally published in the threat analytics report, Exploitation of CVE-2019-0708 (BlueKeep). CVE-2019-0708, also known as BlueKeep, is a critical remote code execution vulnerability i

This query was originally published in the threat analytics report, Motivated miners. Doublepulsar is a backdoor developed by the National Security Agency (NSA). First disclosed in 2017, it is now use

This query was originally published in the threat analytics report, CVE-2018-8653 scripting engine vulnerability. CVE-2018-8653 is a remote code execution vulnerability found in the scripting engine f

This query looks for signs of impacket atexec module. Should work with others using similar technique. Author: Jouni Mikkola More info: https://threathunt.blog/impacket-part-3/

This query looks for signs of impacket dcomexec module. Author: Jouni Mikkola More info: https://threathunt.blog/impacket-part-2/

This query looks for signs of impacket psexec module usage. May hit other psexec-like techniques too. Author: Jouni Mikkola More info: https://threathunt.blog/impacket-psexec/

This query looks for signs of impacket wmiexec module usage. May hit other wmi execution-like techniques too. Author: Jouni Mikkola More info: https://threathunt.blog/impacket-part-2/

This query was originally published in the threat analytics report, CVE-2018-15982 exploit attacks. CVE-2018-15982 is an exploit of Adobe Flash Player, that allows for remote execution of arbitrary co

This query was originally published in the threat analytics report, Msiexec abuse. Msiexec.exe is a Windows component that installs files with the .msi extension. These kinds of files are Windows inst

This query was originally published in the threat analytics report, Msiexec abuse. Msiexec.exe is a Windows component that installs files with the .msi extension. These kinds of files are Windows inst

This query was originally published in the threat analytics report, Msiexec abuse. Msiexec.exe is a Windows component that installs files with the .msi extension. These kinds of files are Windows inst

This query detects possible abuse of ms-msdt MSProtocol URI scheme to load and execute malicious code via Microsoft Support Diagnostic Tool Vulnerability (CVE-2022-30190). The following query detects

This query was originally published in the threat analytics report, Ursnif (Gozi) continues to evolve. Windows Management Instrumentation, or WMI, is a legitimate Microsoft framework used to obtain ma

This query aim to detect if someone requests service tickets (where count => maxcount) The query requires trimming to set a baseline level for MaxCount Mitre Technique: Kerberoasting (T1558.003) @Ma

This query was originally published in the threat analytics report, Ursnif (Gozi) continues to evolve. Microsoft HTML Applications, or HTAs, are executable files that use the same technologies and mod

This query identifies UAC elevated processes by analyzing launches of consent.exe (the process that performs UAC elevation). The first parameter of consent.exe is the process ID being elevated, theref

This query was originally published in the threat analytics report, Motivated miners. Doublepulsar is a backdoor developed by the National Security Agency (NSA). First disclosed in 2017, it is now use

CRASHOVERRIDE v1 Config File Parsing

CRASHOVERRIDE v1 Suspicious Export

CRASHOVERRIDE Malware Hashes

IEC-104 Interaction Module Program Strings

CRASHOVERRIDE v1 Suspicious Strings and Export

CRASHOVERRIDE v1 Wiper

Blank mutex creation assoicated with CRASHOVERRIDE

This query was originally published in the threat analytics report, Emulation-evading JavaScripts. Attackers in several ransomware campaigns have employed heavily obfuscated JavaScript code, in order

This query was originally published in the threat analytics report, EvilQuest signals the rise of Mac ransomware. As of the time of this writing (October 2020), ransomware designed to target macOS is

This query was originally published in the threat analytics report, OSX/Shlayer sustains adware push. Shlayer is adware that spies on users' search terms, and redirects network traffic to serve the us

This query was originally published in the threat analytics report, OSX/Shlayer sustains adware push. Shlayer is adware that spies on users' search terms, and redirects network traffic to serve the us

This query was originally published in the threat analytics report, OSX/SurfBuyer adware campaign. It will return results if a shell script has furtively attempted to decode and save a file to a /tmp

This query was originally published in the threat analytics report, Trickbot: Pervasive & underestimated. Trickbot is a very prevalent piece of malware with an array of malicious capabilities. Origina

This query identifies common processes run by ransomware malware to destroy volume shadow copies or clean free space on a drive to prevent a file from being recovered post-encryption. To reduce false

Malicious emails often contain documents and other specially crafted attachments that run PowerShell commands to deliver additional payloads. If you are aware of emails coming from a known malicious s

Finds PowerShell execution events that could involve a download.

Find the execution of PowerShell Version 2.0, eather to discover legacy scripts using version 2 or to find attackers trying to hide from script logging and AMSI.

Find all machines running a given Powersehll cmdlet. This covers all Powershell commands executed in the Powershell engine by any process.

Find which uncommon Powershell Cmdlets were executed on that machine in a certain time period. This covers all Powershell commands executed in the Powershell engine by any process.

This query was originally published in the threat analytics report, Python abuse on macOS The Python programming language comes bundled with macOS. In threat intelligence gathered from macOS endpoints

This query was originally published in the threat analytics report, Qakbot blight lingers, seeds ransomware Qakbot is malware that steals login credentials from banking and financial services. It has

This query was originally published in the threat analytics report, "Exchange Server zero-days exploited in the wild". In early March 2021, Microsoft released patches for four different zero-day vulne

This query was originally published in the threat analytics report, "Exchange Server zero-days exploited in the wild". In early March 2021, Microsoft released patches for four different zero-day vulne

Identifies non-ASCII data written to the RunMRU registry key by explorer.

This query was originally published in the threat analytics report, SQL Server abuse. SQL Server offers a vast array of tools for automating tasks, exporting data, and running scripts. These legitimat

Hunt package for 8 IOCs associated with Kimwolf

Hunt package for 2 IOCs associated with Mirai

Hunt package for 2 IOCs associated with XMRIG

Hunt package for 60 IOCs associated with ClearFake

Hunt package for 5 IOCs associated with KongTuke

Hunt package for 17 IOCs associated with Unknown malware

Hunt package for 5 IOCs associated with AdaptixC2

Hunt package for 8 IOCs associated with AsyncRAT

Hunt package for 23 IOCs associated with Cobalt Strike

Hunt package for 2 IOCs associated with Lumma Stealer

The nccTrojan malware is a stealthy backdoor that establishes persistent remote access, exfiltrates sensitive data, and executes arbitrary commands to compromise infected systems. It typically arrives via phishing emails with malicious attachments or exploit kits bundled with legitimate software. SOC analysts should monitor

Hunt package for 5 IOCs associated with NetSupportManager RAT

PureRAT is a remote access trojan that enables attackers to exfiltrate data, execute arbitrary commands,

Remcos is a remote access Trojan (RAT) that enables attackers to steal sensitive data, execute arbitrary

Hunt package for 3 IOCs associated with Remus

Vidar is a credential-stealing malware that exfiltrates sensitive data via encrypted channels, often targeting financial institutions and leveraging stolen credentials for lateral movement. It typically arrives through phishing emails with malicious attachments or compromised websites, using URL and domain-based command-and

Hunt package for 17 IOCs associated with VShell

XWorm is a multi-stage malware that establishes persistence, exfiltrates data, and leverages command-and-control (C2) communication to execute further malicious activities. It typically arrives via phishing emails containing malicious links or compromised domains/IPs used for initial compromise. SOC analysts should monitor for unusual network traffic patterns, lateral

This query was originally published in the threat analytics report, "Exchange Server zero-days exploited in the wild". In early March 2021, Microsoft released patches for four different zero-day vulne

Hunt package for 46 malicious URLs tagged as 32-bit

Hunt package for 2 malicious URLs tagged as 54e64e

Hunt package for 17 malicious URLs tagged as ClearFake

Hunt package for 28 malicious URLs tagged as elf

Hunt package for 8 malicious URLs tagged as malware_download

Hunt package for 4 malicious URLs tagged as mirai

The Mozi malware family is a backdoor that enables remote

This query looks for common webserver process names and identifies any processes launched using a scripting language (cmd, powershell, wscript, cscript), common initial profiling commands (net \ net1

Encoded version of pcclient found on disk

File matching the md5 above tends to only live in memory, hence the lack of MZ header check.

File matching the md5 above tends to only live in memory, hence the lack of MZ header check.

Detects code from APT wateringhole

APT malware used to drop PcClient RAT

The YARA rule 'apt_c16_win64

3102 code features

3102 Identifying Strings

9002

9002 code features

9002 Identifying Strings

This query helps reviewing count of users attacked more than x times average.

This query will identify strings in process command lines which match Base64 encoding format, extract the string to a column called Base64, and decode it in a column called DecodedString.

Finding base64 encoded PE files header seen in the command line parameters. Tags: #fileLess #powershell.

Background Intelligent Transfer Service (BITS) is a way to reliably download files from webservers or SMB servers. This service is commonly used for legitimate purposes, but can also be used as part

Detects BlackEnergy 2 Malware

Visualises the trend of malicious URL clicks that were blocked by Safe Links over the past 30 days, helping analysts monitor the effectiveness of click protection policies. Based on Defender for Offic

This is a patched CMD. This is the CMD that RoyalCli uses.

This query will detect encoded powershell based on the parameters passed during process creation. This query will also work if the PowerShell executable is renamed or tampered with since detection is

This query looks for processes that load an older version of the system.management.automation libraries. While not inherently malicious, downgrading to PowerShell version 2 can enable an attacker to b

This query helps reviewing list of top users click on Phis URLs

Process executed from binary hidden in Base64 encoded file. Encoding malicious software is a. Technique to obfuscate files from detection. The first and second ProcessCommandLine component is looking

YARA rule: FE_APT_9002

This query identifies files that are copied to a device over SMB, then executed within a specified threshold. Default is 5 seconds, but is configurable by tweaking the value for ToleranceInSeconds.

Visualises malicious URL clicks that were allowed through Safe Links over time, helping analysts identify when users bypass security controls and click on malicious content. Based on Defender for Offi

Visualises emails containing QR code URLs that have been detected as malicious, helping analysts identify QR code-based attack campaigns. Based on Defender for Office 365 workbook: https://techcommuni

This query helps reviewing sender IPs sending malicious email of type Malware or Phish

Visualises click attempts on malicious URLs, grouped by workload (such as Exchange, Teams, SharePoint, Copilot etc.), to help analysts understand which workloads are most targeted. Based on Defender f

APT15 bs2005

This is a an exchange enumeration/hijacking tool used by an APT 15

Find generic data potentially relating to AP15 tools

Generic strings found in the Royal CLI tool

APT15 RoyalCli backdoor

DNS backdoor used by APT15

Finding attackers hiding malware in the recycle bin. Read more here: https://azure.microsoft.com/blog/how-azure-security-center-helps-reveal-a-cyberattack/. Tags: #execution #SuspiciousPath.

Finds legitimate system32 or syswow64 executables being run under a different name and in a different location. The rule will require tuning for your environment. MITRE: Masquerading https://attack.mi

Detects PAS Tool PHP Web Kit

The query helps detect emails associated with the open redirector URL campaign using Defender for Office 365 data.

This query visualises the daily amount of emails that had an admin post delivery action, summarizing the data by action type

This query visualises the amount of emails that had a post delivery action, summarizing the data daily by the final location as a result of the action

This query visualises the daily amount of emails that had a post delivery action from zero-hour auto purge, summarizing by phish,spam or malware detection action

This query visualises the daily amount of emails that had a post delivery action from zero-hour auto purge.

This query provides insights on the detections done by SafeLinks protection in Defender for Office 365

Hunt package for 4 IOCs associated with Kimwolf

Hunt package for 61 IOCs associated with ClearFake

Hunt package for 3 IOCs associated with EtherRAT

Hunt package for 2 IOCs associated with FAKEUPDATES

Hunt package for 5 IOCs associated with KongTuke

Hunt package for 32 IOCs associated with Unknown malware

Hunt package for 3 IOCs associated with Unknown Stealer

Hunt package for 3 IOCs associated with ACR Stealer

Hunt package for 3 IOCs associated with AdaptixC2

Hunt package for 4 IOCs associated with AsyncRAT

Hunt package for 36 IOCs associated with Cobalt Strike

DCRat is a remote access Trojan that enables adversaries to exfiltrate data and execute commands on infected systems. It typically arrives via phishing emails or malicious downloads, establishing communication through the identified IP:port

Hunt package for 5 IOCs associated with GCleaner

Hunt package for 4 IOCs associated with PureRAT

Hunt package for 5 IOCs associated with Quasar RAT

Hunt package for 4 IOCs associated with Remcos

Hunt package for 6 IOCs associated with Remus

Hunt package for 4 IOCs associated with Vidar

Hunt package for 17 IOCs associated with VShell

Hunt package for 2 IOCs associated with XWorm

This query helps reviewing the list of top 10% of most attacked users

This query helps reviewing list of top 10 URL domains attacking the organization

Visualises the top 10 users with click attempts on URLs in emails detected as malware, helping analysts identify risky user behaviour and potential targets. Based on Defender for Office 365 workbook:

Visualises the top 10 users with click attempts on URLs in emails detected as phishing, helping analysts identify risky user behaviour and potential targets. Based on Defender for Office 365 workbook:

Visualises the top 10 users with click attempts on URLs in emails detected as spam, helping analysts identify risky user behaviour and potential targets. Based on Defender for Office 365 workbook: htt

This query helps reviewing external top malicious email sender with malware or phishing emails in an organization in last 30 days

This query helps reviewing top targeted users with malware or phishing emails in an organization in last 30 days

Visualises the total amount of click attempts on URLs with detections, split by the different threat types identified. Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/bl

This query helps reviewing URL click count by ClickAction

In this query, we are looking for Url clicks on emails which get actioned by Zerohour auto purge

In this query, we are looking URL click actions by URL in the last 7 days

Summarizes URL click events by action type to help analysts understand user click behavior and policy effectiveness. Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog

In this query, we are looking for Url clicks on emails which are generated the alert-A potentially malicious URL click was detected

Hunt package for 10 malicious URLs tagged as 102-220-160-47

Hunt package for 2 malicious URLs tagged as 176-65-139-194

Hunt package for 7 malicious URLs tagged as 176-65-139-7

Hunt package for 3 malicious URLs tagged as 176-65-139-99

Hunt package for 5 malicious URLs tagged as 176-65-149-239

Hunt package for 15 malicious URLs tagged as 32-bit

Hunt package for 7 malicious URLs tagged as 93-115-172-57

Hunt package for 3 malicious URLs tagged as arm

Hunt package for 9 malicious URLs tagged as ClearFake

Hunt package for 12 malicious URLs tagged as dropped-by-Phorpiex

Hunt package for 4 malicious URLs tagged as elf

Hunt package for 34 malicious URLs tagged as malware_download

The Mirai malware family compromises IoT devices by exploiting default credentials, turning them into bots for large-scale DDoS

Hunt package for 9 malicious URLs tagged as Mozi

Hunt package for 2 malicious URLs tagged as RemcosRAT

Visualises where URLs have been identified in emails, summarizing by location (for example: Attachment, header, body) to help analysts understand distribution and risk. Based on Defender for Office 36

This query helps reviewing malicious clicks where user was allowed to proceed through malicious URL page.

This query provides insights on users who clicked on a suspicious URL

This query helps in determining clickthroughs when email delivered because of detection overrides.

This query helps reviewing user reported email submissions

Detects PAS Tool PHP Web Kit

Detects PAS Tool PHP Web Kit

This query visualises the daily amount of admin false negative submission by submission type.

This query visualises the daily amount of admin false positive submission by submission type.

This query visualises all emails submitted as false positive by admins summarizing by the original filter verdict threat type

This query visualises the original detection technology of emails submitted as phish false positive by admins

This query visualises the original detection technology of emails submitted as spam false positive by admins

This query visualises the total amount of admin false negative or false positive submissions by the verdict of the submission grading.

This query visualises the total amount of admin false negative submissions by the state of the submission.

This query visualises the total amount of admin false positive submissions by the state of the submission.

This query helps reviewing admin reported email submissions

This query visualises the total amount of admin false positive submission by submission type.

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

Detect a dropper used to deploy an implant via side loading. This dropper has specifically been observed deploying REDLEAVES & PlugX

YARA rule: Ham_backdoor

This query visualises total emails with Phish (BEC) - Impersonation detections over time.

CommentCrew-threat-apt1

CommentCrew-threat-apt1

The YARA rule 'PLUGX_RedLeaves' detects specific RedLeaves and PlugX malware binaries associated with advanced persistent threat campaigns. SOC teams should deploy

The YARA rule 'RED

Detect the DLL responsible for loading and deobfuscating the DAT file containing shellcode and core REDLEAVES RAT

Detect obfuscated .dat file containing shellcode and core REDLEAVES RAT

Hunting for credential phishing using the "Referral" infrastructure using Defender for Office 365 data

This query helps reviewing count of spoof and impersonation detections done per sender IP

This query helps reviewing count of phish detections done by spoof detection methods

This query visualises total emails with Phish (BEC) Spoof detections by Detection Technology

This query visualises total emails with Phish (BEC) Spoof detections by Detection Technology over time

This query visualises total emails Business Email Compromise (BEC) Spoofing detections over time summarizing the data daily.

This query helps reviewing status of submissions

Hunt package for 4 IOCs associated with Kimwolf

Hunt package for 5 IOCs associated with PerlBot

Hunt package for 6 IOCs associated with XMRIG

Hunt package for 39 IOCs associated with ClearFake

Hunt package for 6 IOCs associated with KongTuke

Hunt package for 2 IOCs associated with magecart

Hunt package for 21 IOCs associated with Unknown malware

Hunt package for 4 IOCs associated with Unknown Loader

Hunt package for 2 IOCs associated with AdaptixC2

Hunt package for 4 IOCs associated with AsyncRAT

Hunt package for 43 IOCs associated with Cobalt Strike

Hunt package for 2 IOCs associated with DanaBot

Hunt package for 2 IOCs associated with DCRat

Hunt package for 5 IOCs associated with Remcos

The Remus malware family is designed to exfiltrate sensitive data and establish persistence within compromised systems, often

Hunt package for 2 IOCs associated with Sliver

Hunt package for 3 IOCs associated with SmokeLoader

Hunt package for 4 IOCs associated with Tofsee

Hunt package for 3 IOCs associated with ValleyRAT

Hunt package for 46 IOCs associated with Vidar

Hunt package for 5 IOCs associated with VShell

The T

This query visualises emails submitted as false negatives by admins where emails where already detected by MDO but there was an admin policy override

This query visualises emails submitted by admins as false negatives, summarizing the data by top 10 sender domains of those emails

This query visualises emails submitted by admins as false positives, summarizing the data by top 10 sender domains of those emails

This query visualises the top admins performing false negative submissions

This query visualises the top admins performing false positive submissions

This query graphs top accounts performing user submissions

This query visualises top outbound recipient domains by outbound email volume and shows total number of inbound emails with Threats from the same domains (as inbound senders)

Total Submissions by Submission State

Total Submissions by Submission Type

Hunt package for 27 malicious URLs tagged as 32-bit

Hunt package for 4 malicious URLs tagged as arm

Hunt package for 5 malicious URLs tagged as c2-monitor-auto

Hunt package for 11 malicious URLs tagged as ClearFake

Hunt package for 6 malicious URLs tagged as CoinMiner

Hunt package for 5 malicious URLs tagged as elf

Hunt package for 3 malicious URLs tagged as jar

Hunt package for 37 malicious URLs tagged as malware_download

Hunt package for 3 malicious URLs tagged as mirai

Hunt package for 6 malicious URLs tagged as Mozi

Hunt package for 6 malicious URLs tagged as WeedHack

This query visualises the daily ammount of users false negative submission by submission type, including phish simulations reported by users.

This query visualises user submissions type compared to admin review verdict

This query visualises user submissions where admin also performed 'mark and notify' action on the submission

This query visualises the total ammount of user false negative submission by submission type, including the phish simulations reported emails

This query visualises the total ammount of user false negative or false positive submissions by the verdict of the submission grading.

This query visualises the total ammount of user false negative submissions from the junk folder

This query visualises emails submitted as false negatives by users where emails were already detected by MDO but there was an admin definded policy override

This query visualises emails submitted as false negatives by users where emails were already detected by MDO but there was a policy override.

This query visualises top sender email addresses of inbound emails submitted as false negatives by users.

This query visualises top sender domains of inbound emails submitted as false negatives by users.

This query visualises top sender email addresses of intra-org emails submitted as false negatives by users.

This query visualises top 10 subjects of intra-org emails submitted as false negatives by users.

This query helps to find threats using display name impersonation for users not already protected with User Impersonation

This query provides insights into AIR investigation actions in Microsoft Defender for Office 365.

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

This query visualises total inbound emails which has any Bulk complaint level.

CommentCrew-threat-apt1

In this detection,we hunt for emails with randomly named attachment names from the same sender to multiple recipients

In this detection, we track emails with suspicious keywords in subjects.

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

In this detection, we check the sender prevalence over the last 14 days and use the same to detect malicious activity via email containing QR code

CommentCrew-threat-apt1

This query helps reviewing incoming email messages where the Display Name of the sender contains own or other partner company/brand name

CommentCrew-threat-apt1

CommentCrew-threat-apt1

This query visualises total inbound emails with Spam detections.

This query visualises top 10 users targeted with Spam.

This query visualises total inbound emails with Spam detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain).

This query visualises top 15 users targeted with Spam with summarized spam detections.

In this query, we hunt for inbound emails delivered having URLs from QR codes

In this query, we hunt for inbound emails having URLs from QR codes and suspicious keywords in subject

In this query, we hunt for inbound emails having URLs from QR codes and send by non-prevalent senders

CommentCrew-threat-apt1

CommentCrew-threat-apt1

CommentCrew-threat-apt1

This query helps in reviewing group Quarantine released messages by detection type. Useful to see what is leading to the largest number of messages being released.

CommentCrew-threat-apt1

CommentCrew-threat-apt1

This query shows information about high confidence phish email that has been released from the Quarantine.

In this detection approach, we correlate email from non-prevalent senders in the organization with impersonation intents