Indicator catalog

Sample rules:

starts_with: system:serviceaccount: 3 rules

Unsecured Credentials T1552, Container API T1552.007, Account Manipulation T1098, Additional Container Cluster Roles T1098.006

Sample rules:

eq: system:anonymous 2 rules

Sample rules:

eq: system:unauthenticated 2 rules

Sample rules:

graph.metadata.product_name 5 values eq: GCTI Feed (8 rules)

eq: GCTI Feed 8 rules

Proxy T1090, Multi-hop Proxy T1090.003, Account Manipulation T1098, Remote Access Tools T1219

Sample rules:

eq: MISP 6 rules

Sample rules:

eq: VirusTotal Relationships 6 rules

Sample rules:

eq: Google Safe Browsing 4 rules

Domain or Tenant Policy Modification T1484, Group Policy Modification T1484.001, File and Directory Permissions Modification T1222, Windows Permissions T1222.001, Valid Accounts T1078, Domain Accounts T1078.002

Sample rules:

eq: WHOISXMLAPI Simple Whois 4 rules

Sample rules:

ObjectServer 5 values eq: security account manager (7 rules)

eq: security account manager 7 rules

Permission Groups Discovery T1069, Password Policy Discovery T1201, OS Credential Dumping T1003, LSASS Memory T1003.001, Domain Groups T1069.002, Local Groups T1069.001

Sample rules:

eq: security 5 rules

OS Credential Dumping T1003, LSASS Memory T1003.001, Phishing T1566, Spearphishing Attachment T1566.001, Security Account Manager T1003.002, LSA Secrets T1003.004

Sample rules:

eq: ds 3 rules

File and Directory Permissions Modification T1222, Windows Permissions T1222.001, OS Credential Dumping T1003, Permission Groups Discovery T1069, Domain Groups T1069.002, Account Discovery T1087

Sample rules:

eq: sc manager 2 rules, 2 vendors

Create or Modify System Process T1543, Windows Service T1543.003, Disable or Modify Tools T1562, Disable or Modify Tools T1562.001

Sample rules:

eq: DS 2 rules

Data from Local System T1005, OS Credential Dumping T1003, DCSync T1003.006

Sample rules:

ObjectClass 5 values eq: grouppolicycontainer (6 rules)

eq: grouppolicycontainer 6 rules, 2 vendors

Sample rules:

eq: user 6 rules, 4 vendors

Account Manipulation T1098, Steal or Forge Kerberos Tickets T1558, Kerberoasting T1558.003, File and Directory Permissions Modification T1222, Windows Permissions T1222.001, Domain or Tenant Policy Modification T1484

Sample rules:

eq: domaindns 4 rules

Domain or Tenant Policy Modification T1484, File and Directory Permissions Modification T1222, Windows Permissions T1222.001, Rogue Domain Controller T1207

Sample rules:

eq: dnsnode 3 rules, 2 vendors

Adversary-in-the-Middle T1557, Application Layer Protocol T1071, DNS T1071.004, Forced Authentication T1187, Name Resolution Poisoning and SMB Relay T1557.001, DHCP Spoofing T1557.003

Sample rules:

eq: computer 2 rules, 2 vendors

Account Manipulation T1098, Access Token Manipulation T1134

Sample rules:

ResourceType 5 values eq: vaults (6 rules)

eq: vaults 6 rules

Sample rules:

eq: AZUREFIREWALLS 3 rules

Application Layer Protocol T1071, Phishing T1566

Sample rules:

eq: PUBLICIPADDRESSES 2 rules

Sample rules:

eq: azurefirewalls 2 rules

Application Layer Protocol T1071, Event Triggered Execution T1546

Sample rules:

eq: login 2 rules

Sample rules:

network.whois 5 values func_call: network.whois(sender.email.domain).days_old < 30 (6 rules)

func_call: network.whois(sender.email.domain).days_old < 30 6 rules

Sample rules:

func_call: network.whois(sender.email.domain).days_old <= 30 5 rules

Sample rules:

func_call: network.whois(sender.email.domain).days_old <= 90 3 rules

Sample rules:

func_call: network.whois(sender.email.domain).days_old < 365 2 rules

Sample rules:

func_call: network.whois(sender.email.domain).days_old < 90 2 rules

Sample rules:

userAgent 5 values ne: console.amazonaws.com (6 rules)

ne: console.amazonaws.com 6 rules

Disable or Modify Tools T1685, Disable or Modify Cloud Log T1685.002, Create Account T1136, Cloud Account T1136.003

Sample rules:

ne: *.amazonaws.com 5 rules

Account Manipulation T1098, Permission Groups Discovery T1069, Cloud Groups T1069.003

Sample rules:

contains: trufflehog 3 rules, 2 vendors

Cloud Account T1087.004, Account Discovery T1087

Sample rules:

contains: s3 browser 3 rules

Command and Scripting Interpreter T1059, Cloud API T1059.009, Valid Accounts T1078, Cloud Accounts T1078.004

Sample rules:

contains: azurehound 2 rules

Account Discovery T1087, Cloud Account T1087.004, Cloud Service Discovery T1526

Sample rules:

CallTrace 5 values contains: unknown (5 rules)

contains: unknown 5 rules, 2 vendors

Process Injection T1055, Thread Execution Hijacking T1055.003, User Execution T1204, Malicious File T1204.002, Disable or Modify Tools T1685, Disable or Modify Windows Event Log T1685.001

Sample rules:

contains: dbgcore.dll 4 rules, 3 vendors

OS Credential Dumping T1003, LSASS Memory T1003.001, Disable or Modify Tools T1685

Sample rules:

contains: dbghelp.dll 4 rules, 3 vendors

OS Credential Dumping T1003, LSASS Memory T1003.001, Disable or Modify Tools T1685

Sample rules:

contains: seclogon.dll 2 rules, 2 vendors

OS Credential Dumping T1003, LSASS Memory T1003.001

Sample rules:

contains: |unknown( 2 rules

Process Injection T1055, OS Credential Dumping T1003, LSASS Memory T1003.001, Native API T1106

Sample rules:

SubjectUserName 5 values ends_with: $ (5 rules)

ends_with: $ 5 rules, 2 vendors

OS Credential Dumping T1003, DCSync T1003.006, Create Account T1136, File and Directory Permissions Modification T1222, Windows Permissions T1222.001, Masquerading T1036

Sample rules:

eq: anonymous logon 3 rules, 2 vendors

Forced Authentication T1187, Exploitation of Remote Services T1210

Sample rules:

eq: anonymous 3 rules

Exfiltration Over Alternative Protocol T1048, Exfiltration Over Asymmetric Encrypted Non-C2 Protocol T1048.002

Sample rules:

regex_match: \/i-.*$ 2 rules

Exfiltration Over Alternative Protocol T1048, Exfiltration Over Asymmetric Encrypted Non-C2 Protocol T1048.002

Sample rules:

regex_match: ^urn:spo:anon# 2 rules

Sample rules:

Computer 5 values eq: adfs_servers (5 rules)

eq: adfs_servers 5 rules

Data from Local System T1005, Exploitation of Remote Services T1210

Sample rules:

eq: %domain_controllers% 3 rules

OS Credential Dumping T1003, DCSync T1003.006, Exploitation of Remote Services T1210, Adversary-in-the-Middle T1557, Name Resolution Poisoning and SMB Relay T1557.001

Sample rules:

contains: <your ca machine name> 2 rules

Application Layer Protocol T1071, Web Protocols T1071.001, Supply Chain Compromise T1195, Compromise Software Supply Chain T1195.002

Sample rules:

ne: unknown 2 rules

OS Credential Dumping T1003, Masquerading T1036, Match Legitimate Resource Name or Location T1036.005, Active Scanning T1595, Remote Access Tools T1219

Sample rules:

starts_with: DESKTOP- 2 rules

Sample rules:

DestinationPortName 5 values eq: dns (5 rules)

eq: dns 5 rules

Encrypted Channel T1573, Application Layer Protocol T1071, DNS T1071.004, System Binary Proxy Execution T1218, Regsvr32 T1218.010, Rundll32 T1218.011

Sample rules:

eq: http 5 rules

Sample rules:

ne: dns 3 rules

Command and Scripting Interpreter T1059, Visual Basic T1059.005, JavaScript T1059.007, Ingress Tool Transfer T1105, Masquerading T1036, Match Legitimate Resource Name or Location T1036.005

Sample rules:

in: http 2 rules

Sample rules:

in: tls 2 rules

Sample rules:

dll.Ext.device.product_id 5 values eq: virtual disk (5 rules)

eq: virtual disk 5 rules

Sample rules:

eq: virtual dvd-rom 5 rules

Sample rules:

wildcard: USB * 4 rules

Sample rules:

wildcard: Virtual DVD-ROM 4 rules

Sample rules:

wildcard: Virtual Disk 4 rules

Sample rules:

File 5 values in: id_rsa (4 rules)

in: id_rsa 4 rules

Sample rules:

in: passwd 4 rules

Sample rules:

in: shadow 4 rules

Sample rules:

is_not_null: 3 rules

Sample rules:

regex_match: ([a-zA-Z0-9-_]+\.)([a-zA-Z0-9-]+\.[a-zA-Z0-9-]+) 2 rules

Sample rules:

TimeGenerated 5 values cross_field_compare: maxSummarizedTime (4 rules)

cross_field_compare: maxSummarizedTime 4 rules

Fallback Channels T1008, Dynamic Resolution T1568, Non-Application Layer Protocol T1095, Encrypted Channel T1573, Data Transfer Size Limits T1030, Network Service Discovery T1046

Sample rules:

cross_field_compare: ValidUntil 2 rules

Sample rules:

cross_field_compare: timeframe 2 rules

Sample rules:

ge: start 2 rules

Sample rules:

le: end 2 rules

Credentials from Password Stores T1555, Create Account T1136

Sample rules:

object_type 5 values eq: uva (4 rules)

eq: uva 4 rules

Account Manipulation T1098, Valid Accounts T1078, Credentials from Password Stores T1555

Sample rules:

eq: vault 3 rules

Sample rules:

eq: account 2 rules

Disable or Modify Tools T1562, Modify Authentication Process T1556

Sample rules:

eq: gm 2 rules

Valid Accounts T1078, Account Manipulation T1098

Sample rules:

eq: user 2 rules

Modify Authentication Process T1556, Credentials from Password Stores T1555

Sample rules:

target.url 5 values eq: https://graph.microsoft.com/v1.0/groups (4 rules)

eq: https://graph.microsoft.com/v1.0/groups 4 rules

Sample rules:

eq: https://graph.microsoft.com/beta/rolemanagement/directory/estimateaccess 3 rules

Sample rules:

eq: https://graph.microsoft.com/v1.0/applications 2 rules

Sample rules:

eq: https://graph.microsoft.com/v1.0/users 2 rules

Sample rules:

regex_match: ^https://graph\.microsoft\.com/v1\.0/drives/.*/content$ 2 rules

Sample rules:

AuditPolicyChanges 5 values contains: %%8448 (3 rules)

contains: %%8448 3 rules

Disable or Modify Tools T1685, Disable or Modify Windows Event Log T1685.001, Disable or Modify Tools T1562, Disable or Modify Windows Event Log T1562.002

Sample rules:

contains: %%8450 3 rules

Disable or Modify Tools T1685, Disable or Modify Windows Event Log T1685.001, Disable or Modify Tools T1562, Disable or Modify Windows Event Log T1562.002

Sample rules:

in: %%8448 2 rules

Sample rules:

in: %%8448, %%8450 2 rules

Sample rules:

in: %%8450 2 rules

Sample rules:

a1 5 values ends_with: .jpg (3 rules)

ends_with: .jpg 3 rules

Obfuscated Files or Information T1027, Steganography T1027.003, Screen Capture T1113

Sample rules:

ends_with: .png 3 rules

Obfuscated Files or Information T1027, Steganography T1027.003, Screen Capture T1113

Sample rules:

eq: -sel 2 rules

Sample rules:

eq: -selection 2 rules

Remote System Discovery T1018, Network Service Discovery T1046

Sample rules:

eq: /bin/sh 2 rules

Masquerading T1036, Rename Legitimate Utilities T1036.003, Command and Scripting Interpreter T1059, Unix Shell T1059.004

Sample rules:

data.description 5 values eq: create or update the anomaly detection captcha (3 rules)

eq: create or update the anomaly detection captcha 3 rules

Sample rules:

eq: update brute-force settings 3 rules

Sample rules:

eq: update suspicious ip throttling settings 3 rules

Sample rules:

eq: Set the Multi-factor Authentication policies 2 rules

Sample rules:

eq: Updates risk assessment configs 2 rules

Sample rules:

event 5 values eq: session.command (3 rules)

eq: session.command 3 rules

Sample rules:

eq: user.login 3 rules

Sample rules:

eq: CWS_EVENT 2 rules

Sample rules:

in: group.feature_flags.edit 2 rules

Sample rules:

in: org.request_access_settings.edit 2 rules

Sample rules:

event_count 5 values gt: 0 (3 rules)

gt: 0 3 rules

System Network Configuration Discovery T1016, Remote System Discovery T1018, Permission Groups Discovery T1069, Domain Groups T1069.002, Account Discovery T1087, Domain Account T1087.002

Sample rules:

gt: 2 3 rules

System Network Configuration Discovery T1016, Remote System Discovery T1018, Brute Force T1110, Password Guessing T1110.001

Sample rules:

lt: 5 3 rules

System Script Proxy Execution T1216, System Binary Proxy Execution T1218, OS Credential Dumping T1003, LSASS Memory T1003.001

Sample rules:

gt: 100 2 rules

Sample rules:

lt: 10 2 rules

OS Credential Dumping T1003, LSASS Memory T1003.001, Indicator Removal T1070, Timestomp T1070.006

Sample rules:

informationType_s 5 values eq: Business Information (3 rules)

eq: Business Information 3 rules

Sample rules:

eq: Financial Information 3 rules

Sample rules:

eq: HR Information 3 rules

Sample rules:

eq: Legal Information 3 rules

Sample rules:

eq: Governance Information 2 rules

Sample rules:

EventResult 5 values eq: Blocked (2 rules)

eq: Blocked 2 rules

Sample rules:

eq: Failure 2 rules

Brute Force T1110, Valid Accounts T1078, Account Manipulation T1098

Sample rules:

eq: Success 2 rules

Valid Accounts T1078, Account Manipulation T1098

Sample rules:

eq: failed 2 rules

Sample rules:

eq: file 2 rules

Sample rules:

InterfaceUuid 5 values eq: 1ff70682-0a51-30e8-076d-740be8cee98b (2 rules)

eq: 1ff70682-0a51-30e8-076d-740be8cee98b 2 rules

Sample rules:

eq: 338cd001-2244-31f1-aaaa-900038001003 2 rules

Modify Registry T1112

Sample rules:

eq: 378e52b0-c0a9-11cf-822d-00aa0051e40f 2 rules

System Owner/User Discovery T1033

Sample rules:

eq: 4b324fc8-1670-01d3-1278-5a47bf6ee188 2 rules

Sample rules:

eq: 86d35949-83c9-4044-b424-db363231fd0c 2 rules

System Owner/User Discovery T1033, System Information Discovery T1082

Sample rules:

a0 5 values eq: cp (2 rules)

eq: cp 2 rules

Masquerading T1036, Rename Legitimate Utilities T1036.003, Command and Scripting Interpreter T1059, Unix Shell T1059.004

Sample rules:

eq: hostname 2 rules

Sample rules:

eq: steghide 2 rules

Obfuscated Files or Information T1027, Steganography T1027.003

Sample rules:

eq: uname 2 rules

System Owner/User Discovery T1033, System Information Discovery T1082

Sample rules:

eq: xclip 2 rules

Sample rules:

o365.audit.Actor.Type 5 values in: 0 (2 rules)

in: 0 2 rules

Sample rules:

in: 10 2 rules

Sample rules:

in: 2 2 rules

Sample rules:

in: 3 2 rules

Sample rules:

in: 5 2 rules

Sample rules:

strings.replace_confusables(subject.base) 5 values contains: sendgrid (2 rules)

contains: sendgrid 2 rules

Sample rules:

regex_match:

(?:\bs\s?e\s?x\b|horny|hook.?up|private room|wanna meet|wants to meet|naked|porn|webcam|nudes?|sexting|erotic|kinky|seduce|adult community|cam shows|local (?:girls?|women|single)|bed partner)

2 rules

Sample rules:

Sample rules:

regex_match: \+?(?:[ilo0-9]{1,2})?\s?$?\d{3}$?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4} 2 rules

Sample rules:

regex_match: \+?(?:[ilo0-9]{1}.)?$?[ilo0-9]{3}?$?.[ilo0-9]{3}.?[ilo0-9]{4} 2 rules

Sample rules:

recipients.to 4 values length_compare: 1 (71 rules)

length_compare: 1 71 rules

Sample rules (showing 8 of 71):

length_compare: 0 40 rules

Sample rules (showing 8 of 40):

length_compare: 10 2 rules

Sample rules:

length_compare: 2 2 rules

Sample rules:

responseStatus.code 4 values starts_with: 2 (24 rules)

starts_with: 2 24 rules

Sample rules (showing 8 of 24):

eq: 403 4 rules, 3 vendors

Sample rules:

eq: 401 2 rules, 2 vendors

Sample rules:

ne: 403 2 rules

Sample rules:

metadata.log_type 4 values eq: GCP_CLOUDAUDIT (22 rules)

eq: GCP_CLOUDAUDIT 22 rules

Disable or Modify Tools T1562, Account Manipulation T1098, Data Destruction T1485, Exfiltration Over Web Service T1567, Transfer Data to Cloud Account T1537, Account Access Removal T1531

Sample rules (showing 8 of 22):

eq: SAP_SECURITY_AUDIT 18 rules

Access Token Manipulation T1134, Token Impersonation/Theft T1134.001, Create Process with Token T1134.002

Sample rules (showing 8 of 18):

eq: SAP_CHANGE_DOCUMENT 8 rules

Sample rules:

eq: SAP_HANA_AUDIT 2 rules

Sample rules:

status 4 values eq: success (21 rules)

eq: success 21 rules, 2 vendors

Valid Accounts T1078, Encrypted Channel T1573, Account Manipulation T1098, Disable or Modify System Firewall T1686, Cloud Firewall T1686.001, Cloud Accounts T1078.004

Sample rules (showing 8 of 21):

eq: SUCCESS 16 rules

Sample rules (showing 8 of 16):

eq: 200 3 rules

Sample rules:

eq: failure 3 rules

Sample rules:

process.Ext.relative_file_name_modify_time 4 values le: 500 (21 rules)

le: 500 21 rules

Email Collection T1114, Local Email Collection T1114.001, Inter-Process Communication T1559, Component Object Model T1559.001, Application Layer Protocol T1071, Ingress Tool Transfer T1105

Sample rules (showing 8 of 21):

le: 300 9 rules

Sample rules (showing 8 of 9):

le: 1800 6 rules

Sample rules:

le: 900 6 rules

Sample rules:

EventLog 4 values eq: rpcfw (17 rules)

eq: rpcfw 17 rules

Scheduled Task/Job T1053, At T1053.002, System Owner/User Discovery T1033, Remote Services T1021, Distributed Component Object Model T1021.003, Windows Management Instrumentation T1047

Sample rules (showing 8 of 17):

eq: microsoft-windows-sysmon/operational 7 rules

OS Credential Dumping T1003, Remote Services T1021, Distributed Component Object Model T1021.003, Event Triggered Execution T1546, LSASS Memory T1003.001, AppCert DLLs T1546.009

Sample rules:

eq: Microsoft-Windows-Sysmon/Operational 3 rules

Event Triggered Execution T1546, Accessibility Features T1546.008, Account Manipulation T1098, OS Credential Dumping T1003, LSASS Memory T1003.001

Sample rules:

eq: Application 2 rules

Automated Exfiltration T1020

Sample rules:

SourcePort 4 values ge: 49152 (16 rules)

ge: 49152 16 rules

Remote Services T1021, Use Alternate Authentication Material T1550, Pass the Ticket T1550.003, Steal or Forge Kerberos Tickets T1558, Kerberoasting T1558.003, Remote System Discovery T1018

Sample rules (showing 8 of 16):

eq: 3389 3 rules

Remote Services T1021, Remote Desktop Protocol T1021.001, Protocol Tunneling T1572, Proxy T1090, Internal Proxy T1090.001, External Proxy T1090.002

Sample rules:

gt: 49151 2 rules

Remote Services T1021, Distributed Component Object Model T1021.003, Inter-Process Communication T1559, Component Object Model T1559.001, System Binary Proxy Execution T1218, Mshta T1218.005

Sample rules:

regex_match: (?i)3389|rdp 2 rules

Remote Services T1021, Remote Desktop Protocol T1021.001, External Remote Services T1133

Sample rules:

esf.event_type 4 values eq: 9 (15 rules)

eq: 9 15 rules

Sample rules (showing 8 of 15):

eq: 17 3 rules

Boot or Logon Autostart Execution T1547, Kernel Modules and Extensions T1547.006, Rootkit T1014

Sample rules:

eq: 27 3 rules

Service Stop T1489, Command and Scripting Interpreter T1059, Disable or Modify Tools T1562, Disable or Modify Tools T1562.001

Sample rules:

eq: 65 3 rules

Inter-Process Communication T1559, Exploitation for Privilege Escalation T1068

Sample rules:

serviceName 4 values eq: accounts (13 rules)

eq: accounts 13 rules

Sample rules (showing 8 of 13):

eq: ssoConfigBackend 3 rules

Sample rules:

eq: workspace 3 rules

Sample rules:

eq: deltaSharingAccess 2 rules

Sample rules:

ObservableKey 4 values eq: ipv4-addr:value (12 rules)

eq: ipv4-addr:value 12 rules

Application Layer Protocol T1071, Exploit Public-Facing Application T1190, Brute Force T1110, Exfiltration Over C2 Channel T1041, Dynamic Resolution T1568

Sample rules (showing 8 of 12):

eq: domain-name:value 4 rules

Phishing T1566, Application Layer Protocol T1071, Dynamic Resolution T1568

Sample rules:

eq: url:value 3 rules

Sample rules:

contains: file:hashes 2 rules

Command and Scripting Interpreter T1059, Drive-by Compromise T1189, Compromise Host Software Binary T1554

Sample rules:

WindowType 4 values eq: detection (10 rules)

eq: detection 10 rules

Sample rules (showing 8 of 10):

eq: training 10 rules

Sample rules (showing 8 of 10):

in: detection 10 rules

Sample rules (showing 8 of 10):

in: training 10 rules

Sample rules (showing 8 of 10):

Esql.event_count 4 values ge: 10 (8 rules)

ge: 10 8 rules

Cloud Infrastructure Discovery T1580, Cloud Service Discovery T1526, Automated Exfiltration T1020, Data Destruction T1485, Data Manipulation T1565, Stored Data Manipulation T1565.001

Sample rules:

lt: 5 3 rules

Sample rules:

ge: 100 2 rules

Sample rules:

gt: 50 2 rules

Sample rules:

AuthenticationPackageName 4 values eq: ntlm (7 rules)

eq: ntlm 7 rules, 3 vendors

Remote Services T1021, SMB/Windows Admin Shares T1021.002, Adversary-in-the-Middle T1557, Name Resolution Poisoning and SMB Relay T1557.001, Account Manipulation T1098, Access Token Manipulation T1134

Sample rules:

eq: kerberos 5 rules, 3 vendors

Adversary-in-the-Middle T1557, Steal or Forge Kerberos Tickets T1558, Abuse Elevation Control Mechanism T1548, OS Credential Dumping T1003, DCSync T1003.006, Forced Authentication T1187

Sample rules:

eq: negotiate 4 rules

Use Alternate Authentication Material T1550, Pass the Hash T1550.002, Access Token Manipulation T1134, Token Impersonation/Theft T1134.001, Valid Accounts T1078, Default Accounts T1078.001

Sample rules:

eq: NTLM 2 rules, 2 vendors

Forced Authentication T1187, Adversary-in-the-Middle T1557, Name Resolution Poisoning and SMB Relay T1557.001

Sample rules:

SourceIP 4 values is_not_null: (7 rules)

is_not_null: 7 rules

Sample rules:

cross_field_compare: nextSourceIP 2 rules

Sample rules:

eq: IPList 2 rules

Application Layer Protocol T1071, OS Credential Dumping T1003

Sample rules:

eq: suspicious_signins 2 rules

Valid Accounts T1078, Brute Force T1110

Sample rules:

facility 4 values in: ha_em (7 rules)

in: ha_em 7 rules

Sample rules:

in: aaa 5 rules

Sample rules:

in: parser 3 rules

Sample rules:

eq: pm 2 rules

Sample rules:

gcp::service_name 4 values eq: admin.googleapis.com (7 rules)

eq: admin.googleapis.com 7 rules

Account Manipulation T1098, Additional Cloud Roles T1098.003

Sample rules:

eq: storage.googleapis.com 4 rules

Data Encrypted for Impact T1486, Disable or Modify Tools T1562, Data Destruction T1485, Data from Cloud Storage T1530, Transfer Data to Cloud Account T1537

Sample rules:

eq: login.googleapis.com 3 rules

Valid Accounts T1078, Email Collection T1114, Email Forwarding Rule T1114.003, Cloud Accounts T1078.004

Sample rules:

eq: cloudkms.googleapis.com 2 rules

Data Encrypted for Impact T1486, Disable or Modify Tools T1562

Sample rules:

kubernetes.audit.stage 4 values eq: responsecomplete (7 rules)

eq: responsecomplete 7 rules

Account Manipulation T1098, Additional Container Cluster Roles T1098.006, Valid Accounts T1078, Container Administration Command T1609, Deploy Container T1610

Sample rules:

in: ResponseComplete 5 rules

Container Administration Command T1609, Command and Scripting Interpreter T1059, Unix Shell T1059.004, Permission Groups Discovery T1069, Account Discovery T1087, Deploy Container T1610

Sample rules:

in: ResponseStarted 5 rules

Container Administration Command T1609, Command and Scripting Interpreter T1059, Unix Shell T1059.004, Permission Groups Discovery T1069, Account Discovery T1087, Deploy Container T1610

Sample rules:

eq: ResponseComplete 2 rules

Indicator Removal T1070, File Deletion T1070.004

Sample rules:

mnemonic 4 values in: log (7 rules)

in: log 7 rules

Sample rules:

in: aaa_accounting_message 5 rules

Sample rules:

in: cfglog_loggedcmd 3 rules

Sample rules:

eq: err_disable 2 rules

Sample rules:

SignatureStatus 4 values eq: trusted (6 rules)

eq: trusted 6 rules

Sample rules:

eq: unavailable 2 rules, 2 vendors

Hijack Execution Flow T1574, DLL T1574.001, Masquerading T1036, Match Legitimate Resource Name or Location T1036.005, Shared Modules T1129

Sample rules:

eq: errorBadDigest 2 rules

Sample rules:

ne: valid 2 rules

Hijack Execution Flow T1574, DLL T1574.001, Boot or Logon Autostart Execution T1547

Sample rules:

TI_ipEntity 4 values ne: NO_IP (6 rules)

ne: NO_IP 6 rules

Sample rules:

eq: ActivityIPs 2 rules

Sample rules:

eq: IPs 2 rules

Sample rules:

eq: SigninIPs 2 rules

Disable or Modify Tools T1562, Disable or Modify Tools T1562.001

Sample rules:

TargetDomainName 4 values ne: NT AUTHORITY (4 rules)

ne: NT AUTHORITY 4 rules

Windows Management Instrumentation T1047, Command and Scripting Interpreter T1059, Visual Basic T1059.005, JavaScript T1059.007, Phishing T1566, Spearphishing Attachment T1566.001

Sample rules:

in: contoso 2 rules

Sample rules:

in: contoso.local 2 rules

Sample rules:

in: put your ad domains here! 2 rules

Sample rules:

action_s 4 values eq: anomalyscoring (4 rules)

eq: anomalyscoring 4 rules

Sample rules:

eq: block 4 rules

Sample rules:

eq: Blocked 2 rules

Sample rules:

eq: Matched 2 rules

Sample rules:

dc_process 4 values gt: 3 (4 rules)

gt: 3 4 rules

System Information Discovery T1082, Account Discovery T1087, System Service Discovery T1007, System Owner/User Discovery T1033, System Network Connections Discovery T1049, Process Discovery T1057

Sample rules:

lt: 10 4 rules

System Binary Proxy Execution T1218, Msiexec T1218.007, Regsvr32 T1218.010

Sample rules:

ge: 1 2 rules

Sample rules:

gt: 5 2 rules

Windows Management Instrumentation T1047, System Information Discovery T1082

Sample rules:

user.effective.id 4 values eq: 0 (4 rules)

eq: 0 4 rules

Sample rules:

starts_with: S-1-12- 4 rules

Access Token Manipulation T1134, Token Impersonation/Theft T1134.001, Create Process with Token T1134.002

Sample rules:

starts_with: S-1-5-21 4 rules

Access Token Manipulation T1134, Token Impersonation/Theft T1134.001, Create Process with Token T1134.002

Sample rules:

is_not_null: 3 rules

Access Token Manipulation T1134, Token Impersonation/Theft T1134.001, Create Process with Token T1134.002

Sample rules:

AccessMask 4 values eq: 0x100 (3 rules)

eq: 0x100 3 rules, 2 vendors

OS Credential Dumping T1003, DCSync T1003.006, Valid Accounts T1078, Domain Accounts T1078.002

Sample rules:

eq: 0x6 3 rules, 2 vendors

Compromise Host Software Binary T1554

Sample rules:

eq: 0x40000 2 rules, 2 vendors

File and Directory Permissions Modification T1222, Windows Permissions T1222.001, Account Manipulation T1098

Sample rules:

eq: 0x2 2 rules

OS Credential Dumping T1003, LSA Secrets T1003.004, Remote Services T1021, SMB/Windows Admin Shares T1021.002

Sample rules:

AppId 4 values eq: * (3 rules)

eq: * 3 rules

Email Collection T1114, Remote Email Collection T1114.002

Sample rules:

eq: 00000003-0000-0000-c000-000000000000 2 rules

Email Collection T1114, Remote Email Collection T1114.002

Sample rules:

eq: FociClientApplications 2 rules

Forge Web Credentials T1606, Cloud Administration Command T1651

Sample rules:

is_not_null: 2 rules

Sample rules:

Esql.alerts_count 4 values le: 5 (3 rules)

le: 5 3 rules

Sample rules:

le: 10 2 rules

Sample rules:

le: 20 2 rules

Sample rules:

le: 50 2 rules

Sample rules:

GroupName 4 values in: privilegedroleadmins (3 rules)

in: privilegedroleadmins 3 rules

Valid Accounts T1078, Account Manipulation T1098

Sample rules:

in: tenantadmins 3 rules

Valid Accounts T1078, Account Manipulation T1098

Sample rules:

in: useraccountadmins 3 rules

Valid Accounts T1078, Account Manipulation T1098

Sample rules:

in: privilegedauthenticationadmins 2 rules

Valid Accounts T1078, Account Manipulation T1098

Sample rules:

OpNum 4 values eq: 1 (3 rules)

eq: 1 3 rules

Sample rules:

eq: 0 2 rules

Sample rules:

eq: 12 2 rules

Scheduled Task/Job T1053, At T1053.002, System Owner/User Discovery T1033

Sample rules:

eq: 13 2 rules

Scheduled Task/Job T1053, At T1053.002, Modify Registry T1112

Sample rules:

TableName 4 values is_not_null: (3 rules)

is_not_null: 3 rules

Sample rules:

eq: BankAccountTable 2 rules

Sample rules:

eq: UserInfo 2 rules

Sample rules:

ne: select 2 rules

Sample rules:

azure_ad::signin_category 4 values in: noninteractiveusersigninlogs (3 rules)

in: noninteractiveusersigninlogs 3 rules

Brute Force T1110, Password Guessing T1110.001, Password Spraying T1110.003, Credential Stuffing T1110.004

Sample rules:

in: signinlogs 3 rules

Brute Force T1110, Password Guessing T1110.001, Password Spraying T1110.003, Credential Stuffing T1110.004

Sample rules:

eq: NonInteractiveUserSignInLogs 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Account Manipulation T1098, Device Registration T1098.005, Steal Application Access Token T1528, Use Alternate Authentication Material T1550

Sample rules:

eq: serviceprincipalsigninlogs 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Account Manipulation T1098, Additional Cloud Credentials T1098.001, Use Alternate Authentication Material T1550, Application Access Token T1550.001

Sample rules:

kubernetes.audit.user.username 4 values is_null: (3 rules)

is_null: 3 rules

Permission Groups Discovery T1069, Cloud Groups T1069.003, Container and Resource Discovery T1613, Account Manipulation T1098, Additional Container Cluster Roles T1098.006

Sample rules:

starts_with: system:serviceaccount: 3 rules

Sample rules:

in: system:anonymous 2 rules

Sample rules:

in: system:unauthenticated 2 rules

Use Alternate Authentication Material T1550, Steal Web Session Cookie T1539

Sample rules:

m365::UserType 4 values in: 0 (3 rules)

in: 0 3 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Phishing T1566, Spearphishing Link T1566.002, Email Collection T1114, Remote Email Collection T1114.002

Sample rules:

in: 10 3 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Phishing T1566, Spearphishing Link T1566.002, Email Collection T1114, Remote Email Collection T1114.002

Sample rules:

in: 2 3 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Phishing T1566, Spearphishing Link T1566.002, Email Collection T1114, Remote Email Collection T1114.002

Sample rules:

in: 3 3 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Phishing T1566, Spearphishing Link T1566.002, Email Collection T1114, Remote Email Collection T1114.002

Sample rules:

c-uri 4 values contains: /mgmt/tm/util/bash (2 rules)

contains: /mgmt/tm/util/bash 2 rules, 2 vendors

Sample rules:

contains: /mshtml_c7/ 2 rules

Sample rules:

contains: /powershell 2 rules

Sample rules:

ends_with: .exe 2 rules

Sample rules:

attachedMimeType 4 values contains: rar (2 rules)

contains: rar 2 rules

Sample rules:

contains: tar 2 rules

Sample rules:

contains: x-7z-compressed 2 rules

Sample rules:

contains: zip 2 rules

Sample rules:

auditd.data.syscall 4 values eq: mprotect (2 rules)

eq: mprotect 2 rules

Sample rules:

eq: socket 2 rules

Sample rules:

in: finit_module 2 rules

Sample rules:

in: init_module 2 rules

Sample rules:

dll.code_signature.status 4 values eq: errorbaddigest (2 rules)

eq: errorbaddigest 2 rules

Masquerading T1036, Invalid Code Signature T1036.001

Sample rules:

eq: errorexpired 2 rules

Masquerading T1036, Invalid Code Signature T1036.001, Exploitation for Privilege Escalation T1068, Subvert Trust Controls T1553, Code Signing T1553.002

Sample rules:

eq: errorrevoked 2 rules

Masquerading T1036, Invalid Code Signature T1036.001, Exploitation for Privilege Escalation T1068, Subvert Trust Controls T1553, Code Signing T1553.002

Sample rules:

eq: erroruntrustedroot 2 rules

Masquerading T1036, Invalid Code Signature T1036.001

Sample rules:

file_ext 4 values in: .bat (2 rules)

in: .bat 2 rules

Sample rules:

in: .ps1 2 rules

Sample rules:

in: .scr 2 rules

Sample rules:

in: .vbs 2 rules

Sample rules:

process.executable.name 4 values in: bash (2 rules)

in: bash 2 rules

Sample rules:

in: csh 2 rules

Sample rules:

in: sh 2 rules

Sample rules:

in: tcsh 2 rules

Sample rules:

event.outcome 3 values eq: success (369 rules)

eq: success 369 rules

Account Manipulation T1098, Valid Accounts T1078, Disable or Modify Tools T1562, Cloud Accounts T1078.004, Disable or Modify Tools T1562.001, Disable or Modify Cloud Log T1562.008

Sample rules (showing 8 of 369):

eq: failure 23 rules

Brute Force T1110, Password Guessing T1110.001, Password Spraying T1110.003, Credential Stuffing T1110.004, Account Manipulation T1098, Permission Groups Discovery T1069

Sample rules (showing 8 of 23):

in: success 2 rules

Disable or Modify Tools T1562, Cloud Firewall T1562.007

Sample rules:

process.code_signature.trusted 3 values eq: false (115 rules)

eq: false 115 rules

Command and Scripting Interpreter T1059, Unix Shell T1059.004, Credentials from Password Stores T1555, Event Triggered Execution T1546, Application Layer Protocol T1071, Masquerading T1036

Sample rules (showing 8 of 115):

eq: true 14 rules

Masquerading T1036, Invalid Code Signature T1036.001, Hijack Execution Flow T1574, DLL T1574.001

Sample rules (showing 8 of 14):

ne: true 8 rules

Sample rules:

security_result.action 3 values eq: ALLOW (102 rules)

eq: ALLOW 102 rules

Disable or Modify Tools T1562, Valid Accounts T1078, Account Manipulation T1098, Additional Cloud Roles T1098.003, Cloud Accounts T1078.004, Credentials from Password Stores T1555

Sample rules (showing 8 of 102):

eq: BLOCK 17 rules

Brute Force T1110, Valid Accounts T1078, Password Guessing T1110.001, Password Spraying T1110.003, Phishing T1566, Multi-Factor Authentication Request Generation T1621

Sample rules (showing 8 of 17):

eq: CHALLENGE 2 rules

Sample rules:

aws::errorMessage 3 values is_null: (48 rules)

is_null: 48 rules, 2 vendors

Account Manipulation T1098, Additional Cloud Roles T1098.003, Domain or Tenant Policy Modification T1484, Transfer Data to Cloud Account T1537, Disable or Modify Tools T1562, Data Encrypted for Impact T1486

Sample rules (showing 8 of 48):

eq: failed authentication 4 rules, 2 vendors

Compromise Accounts T1586, Cloud Accounts T1586.003, Brute Force T1110, Multi-Factor Authentication Request Generation T1621, Password Guessing T1110.001

Sample rules:

is_not_null: 2 rules, 2 vendors

Brute Force T1110, Unsecured Credentials T1552

Sample rules:

stage 3 values eq: responsecomplete (46 rules)

eq: responsecomplete 46 rules

Sample rules (showing 8 of 46):

eq: ResponseComplete 2 rules

Sample rules:

is_not_null: 2 rules

Sample rules:

process_id 3 values ne: 4 (44 rules)

ne: 4 44 rules

Use Alternate Authentication Material T1550, Pass the Ticket T1550.003, Steal or Forge Kerberos Tickets T1558, Kerberoasting T1558.003, AS-REP Roasting T1558.004, Remote Services T1021

Sample rules (showing 8 of 44):

eq: 4 19 rules

Remote Services T1021, SMB/Windows Admin Shares T1021.002, Lateral Tool Transfer T1570, Masquerading T1036, Invalid Code Signature T1036.001, Data Destruction T1485

Sample rules (showing 8 of 19):

eq: 0 3 rules, 2 vendors

Create or Modify System Process T1543, Windows Service T1543.003, Adversary-in-the-Middle T1557, Steal or Forge Kerberos Tickets T1558

Sample rules:

event.kind 3 values eq: alert (38 rules)

eq: alert 38 rules, 2 vendors

Sample rules (showing 8 of 38):

eq: signal 9 rules

Sample rules (showing 8 of 9):

eq: event 2 rules

Sample rules:

graph.metadata.source_type 3 values eq: GLOBAL_CONTEXT (20 rules)

eq: GLOBAL_CONTEXT 20 rules

Proxy T1090, Multi-hop Proxy T1090.003, Account Manipulation T1098, Remote Access Tools T1219

Sample rules (showing 8 of 20):

eq: ENTITY_CONTEXT 10 rules

Remote Services T1021, SMB/Windows Admin Shares T1021.002, Brute Force T1110, Password Guessing T1110.001, User Execution T1204, Malicious File T1204.002

Sample rules (showing 8 of 10):

eq: DERIVED_CONTEXT 9 rules

Sample rules (showing 8 of 9):

ConfidenceScore 3 values ge: 50 (18 rules)

ge: 50 18 rules

Sample rules (showing 8 of 18):

ge: 80 18 rules

Sample rules (showing 8 of 18):

lt: 80 18 rules

Sample rules (showing 8 of 18):

ProviderName 3 values eq: IoTSecurity (15 rules)

eq: IoTSecurity 15 rules

Sample rules (showing 8 of 15):

eq: MDATP 7 rules

Data Encrypted for Impact T1486, Exploit Public-Facing Application T1190

Sample rules:

eq: mdatp 6 rules

OS Credential Dumping T1003, System Services T1569, Supply Chain Compromise T1195, Exploit Public-Facing Application T1190, Scheduled Task/Job T1053

Sample rules:

HttpRequestMethod 3 values eq: get (12 rules)

eq: get 12 rules

Sample rules (showing 8 of 12):

in: post 12 rules

Sample rules (showing 8 of 12):

in: put 12 rules

Sample rules (showing 8 of 12):

body.current_thread.links 3 values length_compare: 0 (12 rules)

length_compare: 0 12 rules

Sample rules (showing 8 of 12):

length_compare: 10 9 rules

Sample rules (showing 8 of 9):

length_compare: 1 3 rules

Sample rules:

category 3 values eq: signinlogs (12 rules)

eq: signinlogs 12 rules

Compromise Accounts T1586, Cloud Accounts T1586.003, Valid Accounts T1078, Brute Force T1110, Cloud Accounts T1078.004, Password Spraying T1110.003

Sample rules (showing 8 of 12):

eq: auditlogs 6 rules

Account Manipulation T1098, Additional Cloud Roles T1098.003, Modify Authentication Process T1556, Multi-Factor Authentication T1556.006, Additional Email Delegate Permissions T1098.002, Compromise Accounts T1586

Sample rules:

eq: success 3 rules, 2 vendors

Modify Authentication Process T1556, Multi-Factor Authentication T1556.006

Sample rules:

All_Changes.action 3 values eq: created (11 rules)

eq: created 11 rules

Valid Accounts T1078, Default Accounts T1078.001, Account Manipulation T1098, Device Registration T1098.005

Sample rules (showing 8 of 11):

eq: started 4 rules

Sample rules:

eq: modified 3 rules

Sample rules:

EmailSenderAddress 3 values is_not_null: (11 rules)

is_not_null: 11 rules

Phishing T1566, Application Layer Protocol T1071

Sample rules (showing 8 of 11):

eq: OfficeActivityUPNs 2 rules

Sample rules:

eq: SigninUPNs 2 rules

Application Layer Protocol T1071, OS Credential Dumping T1003, Event Triggered Execution T1546

Sample rules:

DvcAction 3 values eq: allowed (8 rules)

eq: allowed 8 rules

Sample rules:

eq: open 4 rules

Sample rules:

eq: close 2 rules

Sample rules:

process.Ext.api.metadata.target_address_name 3 values eq: Unbacked (8 rules)

eq: Unbacked 8 rules

Sample rules:

starts_with: ? 3 rules

Sample rules:

eq: mswsock.dll 2 rules

Sample rules:

EventCategory 3 values eq: firewall (7 rules)

eq: firewall 7 rules

Sample rules:

in: DKIMConfiguration 2 rules

Sample rules:

in: SPFConfiguration 2 rules

Sample rules:

execve_command 3 values in: *find* (7 rules)

in: *find* 7 rules

File and Directory Discovery T1083, Credentials from Password Stores T1555, Password Managers T1555.005, Unsecured Credentials T1552, Private Keys T1552.004

Sample rules:

in: *grep* 7 rules

File and Directory Discovery T1083, Credentials from Password Stores T1555, Password Managers T1555.005, Unsecured Credentials T1552, Private Keys T1552.004

Sample rules:

in: *.key* 2 rules

Unsecured Credentials T1552, Private Keys T1552.004

Sample rules:

okta::outcome.result 3 values eq: SUCCESS (6 rules)

eq: SUCCESS 6 rules, 2 vendors

Valid Accounts T1078, Cloud Accounts T1078.004, Multi-Factor Authentication Request Generation T1621, Modify Authentication Process T1556, Account Manipulation T1098, Multi-Factor Authentication T1556.006

Sample rules:

eq: success 4 rules, 2 vendors

Valid Accounts T1078, Cloud Accounts T1078.004, Brute Force T1110, Password Guessing T1110.001, Password Spraying T1110.003, Credential Stuffing T1110.004

Sample rules:

eq: failure 3 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Use Alternate Authentication Material T1550, Application Access Token T1550.001, Trusted Relationship T1199

Sample rules:

sha256 3 values is_not_null: (6 rules)

is_not_null: 6 rules, 2 vendors

Application Layer Protocol T1071, Proxy T1090, Multi-hop Proxy T1090.003, Remote Services T1021, Direct Cloud VM Connections T1021.008, Cloud Administration Command T1651

Sample rules:

contains: sha256hashes 3 rules

Sample rules:

eq: c92c158d7c37fea795114fa6491fe5f145ad2f8c08776b18ae79db811e8e36a3 2 rules

Remote System Discovery T1018, System Network Configuration Discovery T1016, Permission Groups Discovery T1069, Domain Groups T1069.002, Account Discovery T1087, Domain Account T1087.002

Sample rules:

azure.platformlogs.category 3 values in: kube-audit (6 rules)

in: kube-audit 6 rules

Adversary-in-the-Middle T1557, Steal or Forge Authentication Certificates T1649, Steal Application Access Token T1528, Indicator Removal T1070, Permission Groups Discovery T1069, Cloud Groups T1069.003

Sample rules:

in: kube-audit-admin 6 rules

Adversary-in-the-Middle T1557, Steal or Forge Authentication Certificates T1649, Steal Application Access Token T1528, Indicator Removal T1070, Permission Groups Discovery T1069, Cloud Groups T1069.003

Sample rules:

eq: kube-audit 5 rules

Container Administration Command T1609, Exploitation of Remote Services T1210, Unsecured Credentials T1552, Container API T1552.007

Sample rules:

c_process 3 values lt: 3 (6 rules)

lt: 3 6 rules

User Execution T1204, Malicious File T1204.002, Command and Scripting Interpreter T1059, Windows Command Shell T1059.003, Unix Shell T1059.004, Unsecured Credentials T1552

Sample rules:

lt: 25 4 rules

Remote Services T1021, Windows Remote Management T1021.006, Windows Management Instrumentation T1047, Unsecured Credentials T1552, Credentials In Files T1552.001

Sample rules:

lt: 10 2 rules

Command and Scripting Interpreter T1059, Automated Exfiltration T1020, Windows Command Shell T1059.003, Automated Collection T1119, Unix Shell T1059.004, File and Directory Permissions Modification T1222

Sample rules:

graph.metadata.vendor_name 3 values eq: VirusTotal (6 rules)

eq: VirusTotal 6 rules

Use Alternate Authentication Material T1550, Pass the Hash T1550.002, Access Token Manipulation T1134, Create Process with Token T1134.002

Sample rules:

eq: WHOIS 5 rules

Sample rules:

eq: Google Cloud Threat Intelligence 4 rules

Proxy T1090, Multi-hop Proxy T1090.003, Remote Access Tools T1219

Sample rules:

http.response.status_code 3 values eq: 200 (6 rules)

eq: 200 6 rules

Sample rules:

in: 303 2 rules

Ingress Tool Transfer T1105, Exploit Public-Facing Application T1190, Server Software Component T1505, Web Shell T1505.003

Sample rules:

in: 500 2 rules

Sample rules:

LogonProcessName 3 values eq: seclogo (5 rules)

eq: seclogo 5 rules, 2 vendors

Sample rules:

eq: ntlmssp 2 rules

Use Alternate Authentication Material T1550, Pass the Hash T1550.002, Adversary-in-the-Middle T1557, Name Resolution Poisoning and SMB Relay T1557.001

Sample rules:

starts_with: Advapi 2 rules

Sample rules:

SubjectUserSid 3 values starts_with: S-1-5-21- (5 rules)

starts_with: S-1-5-21- 5 rules

Create Account T1136, Account Manipulation T1098, Permission Groups Discovery T1069, Local Groups T1069.001, Masquerading T1036

Sample rules:

eq: s-1-5-18 4 rules, 3 vendors

OS Credential Dumping T1003, LSASS Memory T1003.001, Access Token Manipulation T1134, Token Impersonation/Theft T1134.001, Account Manipulation T1098, DCSync T1003.006

Sample rules:

starts_with: S-1-5-21 2 rules, 2 vendors

Steal or Forge Kerberos Tickets T1558, Golden Ticket T1558.001

Sample rules:

additional.fields["msg_1"] 3 values regex_match: ^AU1$|^AU5$ (5 rules)

regex_match: ^AU1$|^AU5$ 5 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Multi-Factor Authentication Request Generation T1621

Sample rules:

eq: AU7 3 rules

Sample rules:

eq: CUZ 2 rules

Sample rules:

file.size 3 values ge: 30000 (5 rules)

ge: 30000 5 rules

OS Credential Dumping T1003, Security Account Manager T1003.002, Remote Services T1021, SMB/Windows Admin Shares T1021.002, Exfiltration Over Alternative Protocol T1048, LSASS Memory T1003.001

Sample rules:

gt: 0 3 rules

Sample rules:

ge: 100000000 2 rules

Sample rules:

http.request.method 3 values eq: get (5 rules)

eq: get 5 rules

Sample rules:

eq: post 5 rules

Sample rules:

eq: POST 3 rules

Sample rules:

okta::outcome.reason 3 values in: invalid_credentials (5 rules)

in: invalid_credentials 5 rules

Brute Force T1110, Password Guessing T1110.001, Password Spraying T1110.003, Credential Stuffing T1110.004

Sample rules:

in: locked_out 5 rules

Brute Force T1110, Password Guessing T1110.001, Password Spraying T1110.003, Credential Stuffing T1110.004

Sample rules:

eq: INVALID_CREDENTIALS 2 rules

Sample rules:

source_count 3 values ge: 4 (5 rules)

ge: 4 5 rules

Sample rules:

ge: 2 3 rules

Sample rules:

ge: 5 3 rules

Sample rules:

TicketOptions 3 values eq: 0x40810000 (4 rules)

eq: 0x40810000 4 rules, 3 vendors

Steal or Forge Kerberos Tickets T1558, Kerberoasting T1558.003, Golden Ticket T1558.001

Sample rules:

eq: 0x40800000 2 rules

Steal or Forge Kerberos Tickets T1558, Kerberoasting T1558.003, Golden Ticket T1558.001

Sample rules:

eq: 0x40810010 2 rules

Steal or Forge Kerberos Tickets T1558, Kerberoasting T1558.003, Golden Ticket T1558.001

Sample rules:

NetworkApplicationProtocol 3 values eq: smtp (4 rules)

eq: smtp 4 rules

Sample rules:

in: http 2 rules

Sample rules:

in: https 2 rules

Sample rules:

appDisplayName 3 values contains: copilot (4 rules)

contains: copilot 4 rules

Sample rules:

eq: m365chatclient 4 rules

Sample rules:

eq: officeaiappchatcopilot 3 rules

Sample rules:

body.plain.raw 3 values regex_match:

[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}]

(4 rules)

regex_match:

[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}]

4 rules

Sample rules:

is_null: 3 rules

Sample rules:

regex_match: ^\s*$ 2 rules

Sample rules:

method 3 values in: post (4 rules)

in: post 4 rules

Sample rules:

in: put 4 rules

Sample rules:

eq: post 2 rules, 2 vendors

Sample rules:

response.statusCode 3 values in: 401 (4 rules)

in: 401 4 rules

Sample rules:

in: 403 4 rules

Sample rules:

eq: 200 2 rules

Sample rules:

result 3 values eq: exploited (4 rules)

eq: exploited 4 rules

Sample rules:

eq: true 3 rules

Use Alternate Authentication Material T1550, Create Account T1136

Sample rules:

eq: success 2 rules

Account Manipulation T1098, Additional Cloud Roles T1098.003

Sample rules:

strings.icontains 3 values func_call: strings.icontains(body.current_thread.text) (4 rules)

func_call: strings.icontains(body.current_thread.text) 4 rules

Sample rules:

func_call: strings.icontains(subject.subject) 4 rules

Sample rules:

func_call: strings.icontains(sender.display_name) 3 rules

Sample rules:

objectRef.namespace 3 values in: kube-public (3 rules)

in: kube-public 3 rules, 2 vendors

User Execution T1204

Sample rules:

in: kube-system 3 rules, 2 vendors

User Execution T1204

Sample rules:

ne: kube-system 2 rules

Sample rules:

Company 3 values eq: anydesk software gmbh (3 rules)

eq: anydesk software gmbh 3 rules

Remote Access Tools T1219, Remote Desktop Software T1219.002

Sample rules:

eq: microsoft corporation 2 rules, 2 vendors

Software Deployment Tools T1072, System Binary Proxy Execution T1218, Boot or Logon Autostart Execution T1547, Hijack Execution Flow T1574, DLL T1574.001

Sample rules:

eq: logmein, inc. 2 rules

Remote Access Tools T1219, Remote Desktop Software T1219.002

Sample rules:

EventMessage 3 values eq: login (3 rules)

eq: login 3 rules

Sample rules:

contains: behavior monitoring 2 rules

Sample rules:

eq: user's password changed 2 rules

Sample rules:

TargetUserSid 3 values eq: s-1-5-7 (3 rules)

eq: s-1-5-7 3 rules

Network Service Discovery T1046, Access Token Manipulation T1134, Token Impersonation/Theft T1134.001

Sample rules:

starts_with: S-1-5-21- 3 rules

Abuse Elevation Control Mechanism T1548, Network Service Discovery T1046, Valid Accounts T1078

Sample rules:

ends_with: -500 2 rules

Abuse Elevation Control Mechanism T1548, Steal or Forge Kerberos Tickets T1558, Golden Ticket T1558.001

Sample rules:

Total 3 values gt: 15 (3 rules)

gt: 15 3 rules

Sample rules:

gt: 25 2 rules

Sample rules:

gt: 5 2 rules

Valid Accounts T1078, Brute Force T1110, Command and Scripting Interpreter T1059

Sample rules:

aws::userIdentity.accessKeyId 3 values starts_with: AKIA (3 rules)

starts_with: AKIA 3 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Cloud Service Discovery T1526, Account Manipulation T1098, Additional Cloud Credentials T1098.001

Sample rules:

is_not_null: 2 rules

Sample rules:

starts_with: ASIA 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Account Manipulation T1098, Device Registration T1098.005, Modify Authentication Process T1556, Multi-Factor Authentication T1556.006

Sample rules:

group.name 3 values eq: ACCOUNT (3 rules)

eq: ACCOUNT 3 rules

Sample rules:

eq: LOGIN 2 rules

Sample rules:

is_not_null: 2 rules

Sample rules:

headers.auth_summary.spf.details.designator 3 values ends_with: .dropbox.com (3 rules)

ends_with: .dropbox.com 3 rules

Sample rules:

contains: +srs= 2 rules

Sample rules:

ends_with: .intuit.com 2 rules

Sample rules:

headers.return_path.domain.domain 3 values eq: sendgrid.net (3 rules)

eq: sendgrid.net 3 rules

Sample rules:

cross_field_compare: sender.email.domain.domain 2 rules

Sample rules:

ne: calendar-server.bounces.google.com 2 rules

Sample rules:

responseElements.ConsoleLogin 3 values eq: Failure (3 rules)

eq: Failure 3 rules

Sample rules:

eq: Success 2 rules

Steal or Forge Authentication Certificates T1649

Sample rules:

eq: failure 2 rules

Sample rules:

subsystem 3 values eq: com.apple.sudo (3 rules)

eq: com.apple.sudo 3 rules

Sample rules:

eq: com.apple.tcc 3 rules

Sample rules:

eq: com.apple.securityd 2 rules

Sample rules:

Attributes 3 values contains: cdc: (2 rules)

contains: cdc: 2 rules

Sample rules:

contains: certificatetemplate: 2 rules

Steal or Forge Authentication Certificates T1649, Use Alternate Authentication Material T1550

Sample rules:

eq: *san:*upn* 2 rules

Steal or Forge Authentication Certificates T1649, Use Alternate Authentication Material T1550

Sample rules:

Changes 3 values in: failure removed (2 rules)

in: failure removed 2 rules

Sample rules:

in: success removed 2 rules

Sample rules:

in: success removed, failure removed 2 rules

Command and Scripting Interpreter T1059, PowerShell T1059.001

Sample rules:

EventCategoryType 3 values in: exchange (2 rules)

in: exchange 2 rules

Sample rules:

in: exchangeserver 2 rules

Sample rules:

in: gmail 2 rules

Sample rules:

EventResultDetails 3 values in: nxdomain (2 rules)

in: nxdomain 2 rules

Sample rules:

in: refused 2 rules

Sample rules:

in: servfail 2 rules

Sample rules:

PipeName 3 values eq: \psexesvc (2 rules)

eq: \psexesvc 2 rules

System Services T1569, Service Execution T1569.002

Sample rules:

eq: \sdlrpc 2 rules

Native API T1106, Process Injection T1055

Sample rules:

starts_with: \PSHost 2 rules

Sample rules:

SrcGeoCountry 3 values in: cn (2 rules)

in: cn 2 rules

Sample rules:

in: hk 2 rules

Sample rules:

is_not_null: 2 rules

Disable or Modify Tools T1562, Account Manipulation T1098

Sample rules:

azure.activitylogs.operation_name 3 values eq: microsoft.compute/snapshots/delete (2 rules)

eq: microsoft.compute/snapshots/delete 2 rules

Data Destruction T1485, Inhibit System Recovery T1490

Sample rules:

eq: microsoft.kubernetes/connectedclusters/listclusterusercredential/action 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Unsecured Credentials T1552, Container API T1552.007, Steal Application Access Token T1528

Sample rules:

eq: microsoft.storage/storageaccounts/delete 2 rules

Data Destruction T1485, Service Stop T1489

Sample rules:

cs-uri-stem 3 values contains: .jsp (2 rules)

contains: .jsp 2 rules

Sample rules:

contains: /irj/ 2 rules

Sample rules:

contains: /oauth/idp/.well-known/openid-configuration 2 rules

Sample rules:

dll.Ext.defense_evasions 3 values eq: process tampering: code integrity violation (2 rules)

eq: process tampering: code integrity violation 2 rules

Sample rules:

eq: process tampering: image has been accessed before mapping 2 rules

Sample rules:

eq: process tampering: image is writable 2 rules

Sample rules:

level 3 values eq: error (2 rules)

eq: error 2 rules

Sample rules:

in: Critical 2 rules

Sample rules:

in: High 2 rules

Sample rules:

okta::severity 3 values eq: High (2 rules)

eq: High 2 rules

Sample rules:

in: critical 2 rules

Sample rules:

in: high 2 rules

Sample rules:

operation 3 values eq: rpcaddprintprocessor (2 rules)

eq: rpcaddprintprocessor 2 rules

Sample rules:

eq: rpcasyncaddprintprocessor 2 rules

Sample rules:

wildcard: REST.*.OBJECT 2 rules

Sample rules:

process.Ext.api.parameters.buffer 3 values contains: http (2 rules)

contains: http 2 rules

Sample rules:

contains: while ( 2 rules

Sample rules:

contains: while( 2 rules

Sample rules:

process.name.caseless 3 values in: powershell.exe (2 rules)

in: powershell.exe 2 rules

Sample rules:

in: powershell_ise.exe 2 rules

Sample rules:

in: pwsh.exe 2 rules

Sample rules:

security_result.category_details 3 values eq: APPLICATION_SETTINGS (2 rules)

eq: APPLICATION_SETTINGS 2 rules

Sample rules:

eq: DELEGATED_ADMIN_SETTINGS 2 rules

Disable or Modify Tools T1562

Sample rules:

eq: USER_SETTINGS 2 rules

Data Staged T1074, Account Manipulation T1098

Sample rules:

target.application 3 values eq: cloudresourcemanager.googleapis.com (2 rules)

eq: cloudresourcemanager.googleapis.com 2 rules

Sample rules:

eq: iam.amazonaws.com 2 rules

Account Access Removal T1531, Disable or Modify Tools T1562

Sample rules:

eq: storage.googleapis.com 2 rules

Sample rules:

xamzacl 3 values in: authenticated-read (2 rules)

in: authenticated-read 2 rules

Sample rules:

in: public-read 2 rules

Sample rules:

in: public-read-write 2 rules

OS Credential Dumping T1003, Security Account Manager T1003.002

Sample rules:

{}.RequiredAppPermissions{}.EntitlementId 3 values eq: 06b708a9-e830-4db3-a914-8e69da51d44f (2 rules)

eq: 06b708a9-e830-4db3-a914-8e69da51d44f 2 rules

Sample rules:

eq: 9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8 2 rules

OS Credential Dumping T1003, Security Account Manager T1003.002

Sample rules:

eq: dc890d15-9560-4a4c-9b7f-a736ec74ec40 2 rules

Account Manipulation T1098, Additional Email Delegate Permissions T1098.002, Additional Cloud Roles T1098.003

Sample rules:

process.code_signature.exists 2 values eq: false (119 rules)

eq: false 119 rules

Command and Scripting Interpreter T1059, Unix Shell T1059.004, Credentials from Password Stores T1555, Event Triggered Execution T1546, Application Layer Protocol T1071, Unsecured Credentials T1552

Sample rules (showing 8 of 119):

eq: true 2 rules

User Execution T1204, Malicious File T1204.002

Sample rules:

resultType 2 values in: Succeeded (51 rules)

in: Succeeded 51 rules

Data Destruction T1485, Inhibit System Recovery T1490, Disable or Modify Cloud Log T1562.008, Disable or Modify Tools T1562, Data from Cloud Storage T1530, Cloud Accounts T1078.004

Sample rules (showing 8 of 51):

in: Success 51 rules

Data Destruction T1485, Inhibit System Recovery T1490, Disable or Modify Cloud Log T1562.008, Disable or Modify Tools T1562, Data from Cloud Storage T1530, Cloud Accounts T1078.004

Sample rules (showing 8 of 51):

headers.in_reply_to 2 values is_null: (45 rules)

is_null: 45 rules

Sample rules (showing 8 of 45):

is_not_null: 2 rules

Sample rules:

headers.auth_summary.dmarc.pass 2 values eq: true (36 rules)

eq: true 36 rules

Sample rules (showing 8 of 36):

is_null: 6 rules

Sample rules:

process.thread.Ext.call_stack_final_user_module.hash.sha256 2 values is_not_null: (30 rules)

is_not_null: 30 rules

Sample rules (showing 8 of 30):

starts_with: ? 3 rules

Sample rules:

recipients.cc 2 values length_compare: 0 (27 rules)

length_compare: 0 27 rules

Sample rules (showing 8 of 27):

length_compare: 1 4 rules

Sample rules:

container.id 2 values wildcard: * (26 rules)

wildcard: * 26 rules

Command and Scripting Interpreter T1059, Unix Shell T1059.004, Permission Groups Discovery T1069, Account Discovery T1087, Container Administration Command T1609, Deploy Container T1610

Sample rules (showing 8 of 26):

starts_with: ? 22 rules

Sample rules (showing 8 of 22):

Web.status 2 values eq: 200 (25 rules)

eq: 200 25 rules

Sample rules (showing 8 of 25):

in: 200 2 rules

Sample rules:

kubernetes.audit.annotations.authorization_k8s_io/decision 2 values eq: allow (25 rules)

eq: allow 25 rules

Account Manipulation T1098, Additional Container Cluster Roles T1098.006, Deploy Container T1610, Escape to Host T1611, Container Administration Command T1609, Permission Groups Discovery T1069

Sample rules (showing 8 of 25):

eq: forbid 4 rules

Sample rules:

Resource 2 values eq: * (23 rules)

eq: * 23 rules

Account Manipulation T1098, Additional Cloud Roles T1098.003, Domain or Tenant Policy Modification T1484

Sample rules (showing 8 of 23):

starts_with: http 2 rules, 2 vendors

Credentials from Password Stores T1555, Windows Credential Manager T1555.004, OS Credential Dumping T1003

Sample rules:

body.previous_threads 2 values length_compare: 0 (23 rules)

length_compare: 0 23 rules

Sample rules (showing 8 of 23):

length_compare: 1 5 rules

Sample rules:

jevt.rawtime 2 values is_not_null: (23 rules)

is_not_null: 23 rules

Sample rules (showing 8 of 23):

is_null: 4 rules

Sample rules:

MessageType 2 values eq: 2 (21 rules)

eq: 2 21 rules

Sample rules (showing 8 of 21):

eq: 0 15 rules

Sample rules (showing 8 of 15):

dll.code_signature.trusted 2 values eq: false (21 rules)

eq: false 21 rules

Masquerading T1036, Invalid Code Signature T1036.001

Sample rules (showing 8 of 21):

ne: true 2 rules

Masquerading T1036, Invalid Code Signature T1036.001, Create or Modify System Process T1543, Windows Service T1543.003, System Services T1569, Service Execution T1569.002

Sample rules:

RecommendedActions 2 values contains: block (18 rules)

contains: block 18 rules

Sample rules (showing 8 of 18):

contains: monitor 18 rules

Sample rules (showing 8 of 18):

priority_s 2 values eq: P1 (16 rules)

eq: P1 16 rules

Sample rules (showing 8 of 16):

eq: P2 16 rules

Sample rules (showing 8 of 16):

network.http.method 2 values eq: GET (14 rules)

eq: GET 14 rules

Exfiltration Over Alternative Protocol T1048, Exfiltration Over Asymmetric Encrypted Non-C2 Protocol T1048.002

Sample rules (showing 8 of 14):

eq: POST 7 rules

Sample rules:

recipients.to[0].email.domain.valid 2 values eq: true (14 rules)

eq: true 14 rules

Sample rules (showing 8 of 14):

eq: false 9 rules

Sample rules (showing 8 of 9):

process.parent.user.id 2 values ne: 0 (13 rules)

ne: 0 13 rules

Sample rules (showing 8 of 13):

ge: 1000 2 rules

Sample rules:

network.http.response_code 2 values eq: 200 (12 rules)

eq: 200 12 rules

Sample rules (showing 8 of 12):

eq: 401 2 rules

Sample rules:

azure_ad::logged_by_service 2 values eq: core directory (11 rules)

eq: core directory 11 rules, 2 vendors

Valid Accounts T1078, Cloud Accounts T1078.004, Account Manipulation T1098, Additional Cloud Roles T1098.003, Use Alternate Authentication Material T1550, Steal Application Access Token T1528

Sample rules (showing 8 of 11):

eq: authentication methods 2 rules, 2 vendors

Account Manipulation T1098, Modify Authentication Process T1556

Sample rules:

azure_ad::user_type 2 values eq: member (11 rules)

eq: member 11 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Use Alternate Authentication Material T1550, Application Access Token T1550.001, Steal Application Access Token T1528, Brute Force T1110

Sample rules (showing 8 of 11):

eq: Member 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Account Manipulation T1098, Device Registration T1098.005, Steal Application Access Token T1528, Use Alternate Authentication Material T1550

Sample rules:

kibana.alert.risk_score 2 values gt: 21 (11 rules)

gt: 21 11 rules

Sample rules (showing 8 of 11):

ge: 73 2 rules

Sample rules:

process.parent.group.id 2 values ne: 0 (11 rules)

ne: 0 11 rules

Sample rules (showing 8 of 11):

ge: 1000 2 rules

Sample rules:

action_id_s 2 values contains: bcm (10 rules)

contains: bcm 10 rules

Sample rules (showing 8 of 10):

contains: rcm 10 rules

Sample rules (showing 8 of 10):

uid 2 values is_not_null: (10 rules)

is_not_null: 10 rules

Sample rules (showing 8 of 10):

ne: 0 2 rules

Exploitation for Privilege Escalation T1068

Sample rules:

Signed 2 values eq: false (9 rules)

eq: false 9 rules, 2 vendors

Hijack Execution Flow T1574, DLL T1574.001, OS Credential Dumping T1003, LSASS Memory T1003.001, Masquerading T1036, Match Legitimate Resource Name or Location T1036.005

Sample rules (showing 8 of 9):

eq: true 2 rules

Account Access Removal T1531

Sample rules:

CommonSecurityLog_TimeGenerated 2 values cross_field_compare: ValidUntil (9 rules)

cross_field_compare: ValidUntil 9 rules

Sample rules (showing 8 of 9):

cross_field_compare: ExpirationDateTime 7 rules

Sample rules:

RoleName 2 values contains: admin (9 rules)

contains: admin 9 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Account Manipulation T1098, Additional Cloud Credentials T1098.001

Sample rules (showing 8 of 9):

eq: global administrator 2 rules

Sample rules:

beta.profile.by_reply_to 2 values func_call: beta.profile.by_reply_to().prevalence == new (8 rules)

func_call: beta.profile.by_reply_to().prevalence == new 8 rules

Sample rules:

func_call: beta.profile.by_reply_to().any_messages_malicious_or_spam 3 rules

Sample rules:

dc_host 2 values eq: 1 (8 rules)

eq: 1 8 rules

Command and Scripting Interpreter T1059, Unix Shell T1059.004, Unsecured Credentials T1552, Credentials In Files T1552.001, Windows Command Shell T1059.003, User Execution T1204

Sample rules:

lt: 3 2 rules

Process Injection T1055, Service Stop T1489, Disable or Modify Tools T1562, Disable or Modify Tools T1562.001

Sample rules:

http_method 2 values eq: post (8 rules)

eq: post 8 rules

Sample rules:

eq: get 2 rules

Sample rules:

okta::actor.alternateId 2 values is_not_null: (7 rules)

is_not_null: 7 rules, 2 vendors

Brute Force T1110, Password Guessing T1110.001, Password Spraying T1110.003, Credential Stuffing T1110.004, Valid Accounts T1078, Cloud Accounts T1078.004

Sample rules:

ne: system@okta.com 2 rules

Steal Web Session Cookie T1539, Use Alternate Authentication Material T1550, Web Session Cookie T1550.004

Sample rules:

DestinationIP 2 values is_not_null: (7 rules)

is_not_null: 7 rules

Sample rules:

eq: IPList 2 rules

Application Layer Protocol T1071, OS Credential Dumping T1003

Sample rules:

EventSubType 2 values ne: AttackAttempt (7 rules)

ne: AttackAttempt 7 rules

Sample rules:

eq: attackattempt 2 rules

Sample rules:

SuspiciousLevel 2 values eq: high suspicious attack (7 rules)

eq: high suspicious attack 7 rules

Sample rules:

eq: low suspicious attack 2 rules

Sample rules:

endgame.metadata.type 2 values eq: detection (7 rules)

eq: detection 7 rules

Sample rules:

eq: prevention 7 rules

Sample rules:

event_platform 2 values eq: Win (7 rules)

eq: Win 7 rules

Sample rules:

eq: Mac 3 rules

Sample rules:

filter(attachments, .file_type == 'pdf') 2 values length_compare: 1 (7 rules)

length_compare: 1 7 rules

Sample rules:

length_compare: 0 4 rules

Sample rules:

message_id 2 values in: 111008 (7 rules)

in: 111008 7 rules

Sample rules:

in: 111010 7 rules

Sample rules:

objectRef.subresource 2 values is_null: (7 rules)

is_null: 7 rules

Sample rules:

is_not_null: 2 rules

Sample rules:

prefix 2 values eq: src_ (7 rules)

eq: src_ 7 rules

Command and Scripting Interpreter T1059, PowerShell T1059.001, Exploit Public-Facing Application T1190, Brute Force T1110, Password Guessing T1110.001, External Remote Services T1133

Sample rules:

eq: geo 2 rules

Exploit Public-Facing Application T1190

Sample rules:

process.parent.interactive 2 values eq: false (7 rules)

eq: false 7 rules

Sample rules:

eq: true 2 rules

Sample rules:

source.as.organization.name 2 values is_not_null: (7 rules)

is_not_null: 7 rules

Unsecured Credentials T1552, Account Discovery T1087, Cloud Account T1087.004, Serverless Execution T1648, Valid Accounts T1078, Cloud Accounts T1078.004

Sample rules:

ne: microsoft-corp-msn-as-block 3 rules

Brute Force T1110, Password Guessing T1110.001, Password Spraying T1110.003, Credential Stuffing T1110.004, Valid Accounts T1078, Cloud Accounts T1078.004

Sample rules:

AccountType 2 values eq: User (6 rules)

eq: User 6 rules

Valid Accounts T1078, Account Manipulation T1098, Account Discovery T1087, Local Account T1087.001

Sample rules:

eq: user 5 rules

Valid Accounts T1078, Account Manipulation T1098, Brute Force T1110

Sample rules:

DstBytes 2 values ne: 0 (6 rules)

ne: 0 6 rules

Sample rules:

gt: 0 2 rules

Sample rules:

Esql.recent 2 values le: 6 (6 rules)

le: 6 6 rules

Remote Access Tools T1219, Remote Desktop Software T1219.002

Sample rules:

le: 10 5 rules

Sample rules:

Esql.script_block_length 2 values gt: 500 (6 rules)

gt: 500 6 rules

Obfuscated Files or Information T1027, Command Obfuscation T1027.010, Command and Scripting Interpreter T1059, PowerShell T1059.001, Deobfuscate/Decode Files or Information T1140

Sample rules:

gt: 1000 3 rules

Obfuscated Files or Information T1027, Command Obfuscation T1027.010, Command and Scripting Interpreter T1059, PowerShell T1059.001, Deobfuscate/Decode Files or Information T1140

Sample rules:

Esql.script_block_pattern_count 2 values ge: 1 (6 rules)

ge: 1 6 rules

Obfuscated Files or Information T1027, Command Obfuscation T1027.010, Command and Scripting Interpreter T1059, PowerShell T1059.001, Deobfuscate/Decode Files or Information T1140

Sample rules:

ge: 2 2 rules

Obfuscated Files or Information T1027, Command Obfuscation T1027.010, Command and Scripting Interpreter T1059, PowerShell T1059.001, Deobfuscate/Decode Files or Information T1140

Sample rules:

EventResourceId 2 values eq: traffic (6 rules)

eq: traffic 6 rules

Sample rules:

eq: threat 3 rules

Sample rules:

Initiator 2 values ne: MS-PIM (6 rules)

ne: MS-PIM 6 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Account Access Removal T1531, Account Manipulation T1098, Additional Cloud Credentials T1098.001

Sample rules:

ne: MS-PIM-Fairfax 4 rules

Account Access Removal T1531, Account Manipulation T1098, Additional Cloud Credentials T1098.001, Valid Accounts T1078, Cloud Accounts T1078.004

Sample rules:

azure_ad::modified_properties_new 2 values gt: 0 (6 rules)

gt: 0 6 rules

Account Manipulation T1098, Steal Application Access Token T1528, Additional Cloud Roles T1098.003, Use Alternate Authentication Material T1550, Valid Accounts T1078, Cloud Accounts T1078.004

Sample rules:

contains: addresstype 3 rules

Steal Application Access Token T1528, Use Alternate Authentication Material T1550

Sample rules:

file.Ext.windows.zone_identifier 2 values eq: 3 (6 rules)

eq: 3 6 rules

User Execution T1204, Malicious File T1204.002, Phishing T1566, Spearphishing Attachment T1566.001, Spearphishing Link T1566.002

Sample rules:

gt: 1 3 rules

User Execution T1204, Malicious File T1204.002, Phishing T1566, Spearphishing Attachment T1566.001, Spearphishing Link T1566.002, System Binary Proxy Execution T1218

Sample rules:

github.programmatic_access_type 2 values in: fine-grained personal access token (6 rules)

in: fine-grained personal access token 6 rules

Data from Information Repositories T1213, Code Repositories T1213.003, Serverless Execution T1648

Sample rules:

in: oauth access token 6 rules

Data from Information Repositories T1213, Code Repositories T1213.003, Serverless Execution T1648

Sample rules:

outcome.result 2 values eq: SUCCESS (6 rules)

eq: SUCCESS 6 rules

Valid Accounts T1078, Steal Application Access Token T1528

Sample rules:

eq: failure 2 rules, 2 vendors

Phishing T1566, Multi-Factor Authentication Request Generation T1621

Sample rules:

ResultStatus 2 values eq: success (5 rules)

eq: success 5 rules, 2 vendors

Steal Application Access Token T1528, Valid Accounts T1078, Multi-Factor Authentication Request Generation T1621, Account Manipulation T1098, Additional Cloud Roles T1098.003

Sample rules:

eq: succeeded 2 rules

Email Collection T1114, Valid Accounts T1078, Account Manipulation T1098

Sample rules:

data.details.response.body.enabled 2 values eq: false (5 rules)

eq: false 5 rules, 2 vendors

Sample rules:

eq: true 2 rules

Sample rules:

DNS_TimeGenerated 2 values cross_field_compare: ExpirationDateTime (5 rules)

cross_field_compare: ExpirationDateTime 5 rules

Sample rules:

cross_field_compare: ValidUntil 3 rules

Sample rules:

EVENT_TYPE 2 values eq: LOGIN (5 rules)

eq: LOGIN 5 rules

Sample rules:

in: ApiConnectedApp 2 rules

Sample rules:

OnboardingStatus 2 values ne: Onboarded (5 rules)

ne: Onboarded 5 rules

Remote Services T1021, Remote Desktop Protocol T1021.001, Credentials from Password Stores T1555, Windows Credential Manager T1555.004, Forge Web Credentials T1606, Remote System Discovery T1018

Sample rules:

eq: Onboarded 2 rules

Sample rules:

RemoteIPType 2 values eq: Public (5 rules)

eq: Public 5 rules

System Binary Proxy Execution T1218, Regsvr32 T1218.010, Rundll32 T1218.011, Exploit Public-Facing Application T1190, Modify Authentication Process T1556

Sample rules:

ne: Loopback 3 rules

Brute Force T1110, Password Spraying T1110.003, Forced Authentication T1187, Adversary-in-the-Middle T1557, Name Resolution Poisoning and SMB Relay T1557.001

Sample rules:

SChannelName 2 values cross_field_compare: src (5 rules)

cross_field_compare: src 5 rules

Sample rules:

eq: * 4 rules

Application Layer Protocol T1071, OS Credential Dumping T1003

Sample rules:

current 2 values eq: true (5 rules)

eq: true 5 rules

Sample rules:

ne: false 3 rules

Sample rules:

m365::TimeGenerated 2 values cross_field_compare: ExpirationDateTime (5 rules)

cross_field_compare: ExpirationDateTime 5 rules

Sample rules:

cross_field_compare: ValidUntil 3 rules

Sample rules:

match 2 values is_not_null: (5 rules)

is_not_null: 5 rules

Command and Scripting Interpreter T1059, PowerShell T1059.001, Access Token Manipulation T1134, SID-History Injection T1134.005, Data Destruction T1485

Sample rules:

eq: 0 2 rules

Create Account T1136, Cloud Account T1136.003

Sample rules:

properties.authenticationDetails{}.succeeded 2 values eq: false (5 rules)

eq: false 5 rules

Brute Force T1110, Password Spraying T1110.003, Credential Stuffing T1110.004, Compromise Accounts T1586, Cloud Accounts T1586.003, Password Guessing T1110.001

Sample rules:

eq: true 5 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Compromise Accounts T1586, Cloud Accounts T1586.003, Browser Session Hijacking T1185, Brute Force T1110

Sample rules:

properties.status.errorCode 2 values eq: 50126 (5 rules)

eq: 50126 5 rules

Brute Force T1110, Password Spraying T1110.003, Credential Stuffing T1110.004, Compromise Accounts T1586, Cloud Accounts T1586.003, Password Guessing T1110.001

Sample rules:

eq: 500121 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Compromise Accounts T1586, Cloud Accounts T1586.003, Multi-Factor Authentication Request Generation T1621

Sample rules:

resource 2 values in: clusterroles (5 rules)

in: clusterroles 5 rules

Cloud Accounts T1078.004, File and Directory Permissions Modification T1222, Disable or Modify Tools T1562.001, Remote Services T1021, Account Manipulation T1098

Sample rules:

in: roles 5 rules

Cloud Accounts T1078.004, File and Directory Permissions Modification T1222, Disable or Modify Tools T1562.001, Remote Services T1021, Account Manipulation T1098

Sample rules:

state 2 values eq: ACTIVE (5 rules)

eq: ACTIVE 5 rules

Sample rules:

eq: successful 2 rules

Sample rules:

ClientIP 2 values is_not_null: (4 rules)

is_not_null: 4 rules

Remote Services T1021

Sample rules:

eq: IPList 2 rules

Sample rules:

EntityName 2 values eq: organization (4 rules)

eq: organization 4 rules

Valid Accounts T1078, Impair Defenses T1629, Abuse Elevation Control Mechanism T1548

Sample rules:

eq: systemuser 3 rules

Valid Accounts T1078, Abuse Elevation Control Mechanism T1548, Valid Accounts T0859, Account Manipulation T1098, Exploitation for Privilege Escalation T1404, Abuse Elevation Control Mechanism T1626

Sample rules:

Esql.verdict 2 values in: suspicious (4 rules)

in: suspicious 4 rules

Sample rules:

in: tp 4 rules

Sample rules:

SigninLogs_TimeGenerated 2 values cross_field_compare: ExpirationDateTime (4 rules)

cross_field_compare: ExpirationDateTime 4 rules

Application Layer Protocol T1071, Phishing T1566

Sample rules:

cross_field_compare: ValidUntil 3 rules

Application Layer Protocol T1071, Phishing T1566

Sample rules:

Target.process.executable 2 values is_not_null: (4 rules)

is_not_null: 4 rules

Sample rules:

ne: process.executable 3 rules

Sample rules:

ThreatLevel 2 values eq: dangerous (4 rules)

eq: dangerous 4 rules

Sample rules:

eq: suspicious 4 rules

Sample rules:

beta.parse_exif 2 values func_call: beta.parse_exif(file.message_screenshot()).image_height < 2000 (4 rules)

func_call: beta.parse_exif(file.message_screenshot()).image_height < 2000 4 rules

Sample rules:

func_call: beta.parse_exif(file.message_screenshot()).image_width < 2000 4 rules

Sample rules:

dc_process_name 2 values gt: 2 (4 rules)

gt: 2 4 rules

System Owner/User Discovery T1033, System Service Discovery T1007, Process Discovery T1057, Command and Scripting Interpreter T1059, Windows Command Shell T1059.003, Unix Shell T1059.004

Sample rules:

gt: 1 2 rules

System Service Discovery T1007, System Owner/User Discovery T1033, System Network Connections Discovery T1049, Process Discovery T1057, System Information Discovery T1082, Account Discovery T1087

Sample rules:

distinct(body.links, .href_url.domain.root_domain) 2 values length_compare: 10 (4 rules)

length_compare: 10 4 rules

Sample rules:

length_compare: 3 2 rules

Sample rules:

event0.process.command_line 2 values contains: file.name (4 rules)

contains: file.name 4 rules

Indicator Removal T1070, File Deletion T1070.004, Masquerading T1036, Match Legitimate Resource Name or Location T1036.005

Sample rules:

contains: file.path 2 rules

Command and Scripting Interpreter T1059, Python T1059.006, Indicator Removal T1070, File Deletion T1070.004, Ingress Tool Transfer T1105

Sample rules:

file.Ext.entropy 2 values ge: 6 (4 rules)

ge: 6 4 rules

Sample rules:

ge: 7 4 rules

Sample rules:

graph.entity.file.prevalence.rolling_max 2 values gt: 0 (4 rules)

gt: 0 4 rules

Sample rules:

le: 3 3 rules

Sample rules:

headers.message_id 2 values ends_with: @odspnotify> (4 rules)

ends_with: @odspnotify> 4 rules

Sample rules:

starts_with: <Share- 3 rules

Sample rules:

m365::Folder.Path 2 values in: \\recoverable items\\deletions (4 rules)

in: \\recoverable items\\deletions 4 rules

Indicator Removal T1070, Clear Mailbox Data T1070.008, Data Destruction T1485, Email Collection T1114, Local Email Collection T1114.001

Sample rules:

in: \\sent items 4 rules

Indicator Removal T1070, Clear Mailbox Data T1070.008, Data Destruction T1485, Email Collection T1114, Local Email Collection T1114.001

Sample rules:

process.thread.Ext.call_stack_final_user_module.protection_provenance_path 2 values is_not_null: (4 rules)

is_not_null: 4 rules

Sample rules:

wildcard: c:\windows\microsoft.net\framework*\clr.dll 3 rules

Sample rules:

process_guid 2 values eq: event0.process.entity_id (4 rules)

eq: event0.process.entity_id 4 rules

System Services T1569, Launchctl T1569.001

Sample rules:

eq: event1.process.entity_id 2 rules

Sample rules:

registry.hive 2 values eq: HKEY_USERS (4 rules)

eq: HKEY_USERS 4 rules

Sample rules:

eq: hkey_users 2 rules

Modify Registry T1112, Boot or Logon Autostart Execution T1547, Registry Run Keys / Startup Folder T1547.001

Sample rules:

signature 2 values eq: consolelogin (4 rules)

eq: consolelogin 4 rules

Sample rules:

eq: user.session.start 2 rules

Brute Force T1110, Password Spraying T1110.003, Compromise Accounts T1586, Cloud Accounts T1586.003

Sample rules:

target.resource.product_object_id 2 values eq: %sap_sensitive_roles.role (4 rules)

eq: %sap_sensitive_roles.role 4 rules

Sample rules:

eq: 1b730954-1685-4b74-9bfd-dac224a7b894 3 rules

Account Manipulation T1098, Additional Cloud Credentials T1098.001, Valid Accounts T1078, Cloud Accounts T1078.004, Remote Services T1021, Cloud Services T1021.007

Sample rules:

additionalEventData.MFAUsed 2 values eq: no (3 rules)

eq: no 3 rules, 2 vendors

Valid Accounts T1078, Cloud Accounts T1078.004, Compromise Accounts T1586, Cloud Accounts T1586.003

Sample rules:

eq: yes 3 rules, 2 vendors

Compromise Accounts T1586, Cloud Accounts T1586.003, Multi-Factor Authentication Request Generation T1621, Valid Accounts T1078

Sample rules:

AdditionalFields 2 values contains: esaurldetails (3 rules)

contains: esaurldetails 3 rules

Sample rules:

contains: esaampverdict 2 rules

Sample rules:

Alert_TimeGenerated 2 values cross_field_compare: ExpirationDateTime (3 rules)

cross_field_compare: ExpirationDateTime 3 rules

Sample rules:

cross_field_compare: ValidUntil 3 rules

Sample rules:

All_Traffic.action 2 values in: allow (3 rules)

in: allow 3 rules

Sample rules:

in: allowed 3 rules

Sample rules:

CloudAppEvents_TimeGenerated 2 values cross_field_compare: ExpirationDateTime (3 rules)

cross_field_compare: ExpirationDateTime 3 rules

Application Layer Protocol T1071, Phishing T1566

Sample rules:

cross_field_compare: ValidUntil 3 rules

Application Layer Protocol T1071, Phishing T1566

Sample rules:

Esql.rule_severity_values 2 values eq: 73 (3 rules)

eq: 73 3 rules

Sample rules:

eq: 99 3 rules

Sample rules:

HitTime 2 values cross_field_compare: ExpirationDateTime (3 rules)

cross_field_compare: ExpirationDateTime 3 rules

Sample rules:

cross_field_compare: TimeGenerated 3 rules

Sample rules:

IPAddresses 2 values is_not_null: (3 rules)

is_not_null: 3 rules

Sample rules:

eq: IPList 2 rules

Application Layer Protocol T1071, OS Credential Dumping T1003

Sample rules:

IS_SUCCESS 2 values eq: NO (3 rules)

eq: NO 3 rules

Sample rules:

eq: YES 2 rules

Sample rules:

Identity 2 values ne: MS-PIM (3 rules)

ne: MS-PIM 3 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Exploitation for Privilege Escalation T1068, Abuse Elevation Control Mechanism T1548

Sample rules:

ne: MS-PIM-Fairfax 3 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Exploitation for Privilege Escalation T1068, Abuse Elevation Control Mechanism T1548

Sample rules:

LogType 2 values eq: Update (3 rules)

eq: Update 3 rules

Sample rules:

in: Update 2 rules

Sample rules:

Score 2 values ge: 50 (3 rules)

ge: 50 3 rules

Sample rules:

ge: 3 2 rules

Sample rules:

SecurityEvent_TimeGenerated 2 values cross_field_compare: ValidUntil (3 rules)

cross_field_compare: ValidUntil 3 rules

Sample rules:

cross_field_compare: ExpirationDateTime 2 rules

Sample rules:

State 2 values eq: open (3 rules)

eq: open 3 rules

Sample rules:

is_null: 3 rules

Sample rules:

UserCount 2 values gt: 0 (3 rules)

gt: 0 3 rules

Sample rules:

gt: 15 2 rules

Sample rules:

Value 2 values eq: False (3 rules)

eq: False 3 rules

Impair Defenses T1629, Exfiltration Over Web Service T1567, Valid Accounts T1078, Abuse Elevation Control Mechanism T1548

Sample rules:

is_not_null: 2 rules

Automated Exfiltration T1020, Email Collection T1114

Sample rules:

auditLevel 2 values eq: WORKSPACE_LEVEL (3 rules)

eq: WORKSPACE_LEVEL 3 rules

Sample rules:

eq: ACCOUNT_LEVEL 2 rules

Sample rules:

azure_ad::authentication_protocol 2 values eq: devicecode (3 rules)

eq: devicecode 3 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Use Alternate Authentication Material T1550, Application Access Token T1550.001, Phishing T1566, Spearphishing Link T1566.002

Sample rules:

eq: ropc 2 rules

Account Discovery T1087, Cloud Account T1087.004, Brute Force T1110, Password Spraying T1110.003, Valid Accounts T1078, Cloud Accounts T1078.004

Sample rules:

error_code 2 values is_not_null: (3 rules)

is_not_null: 3 rules

Sample rules:

ne: 394304 2 rules

Sample rules:

graph.entity.domain.prevalence.rolling_max 2 values gt: 0 (3 rules)

gt: 0 3 rules

Sample rules:

le: 3 2 rules

Sample rules:

graph.relations.relationship 2 values eq: CONTACTS (3 rules)

eq: CONTACTS 3 rules

Lateral Tool Transfer T1570, Exploitation for Credential Access T1212, Command and Scripting Interpreter T1059, PowerShell T1059.001

Sample rules:

eq: DOWNLOADED_FROM 2 rules

Sample rules:

list_ActivityStatusValue 2 values contains: succeeded (3 rules)

contains: succeeded 3 rules

Sample rules:

contains: success 3 rules

Lateral Tool Transfer T1570, Exploitation for Credential Access T1212, Command and Scripting Interpreter T1059, PowerShell T1059.001

Sample rules:

objectCategory 2 values starts_with: cn=group-policy-container (3 rules)

starts_with: cn=group-policy-container 3 rules

Domain or Tenant Policy Modification T1484, Group Policy Modification T1484.001, Disable or Modify Tools T1685, File and Directory Permissions Modification T1222, Windows Permissions T1222.001

Sample rules:

starts_with: cn=group-policy-container,cn=schema,cn=configuration,dc= 2 rules

Sample rules:

second 2 values ge: 1 (3 rules)

ge: 1 3 rules

Sample rules:

le: 300 3 rules

Sample rules:

target.resource.attribute.labels.key 2 values regex_match: NewValue_EntitlementId- (3 rules)

regex_match: NewValue_EntitlementId- 3 rules

Sample rules:

regex_match: OldValue_EntitlementId- 3 rules

Sample rules:

timestamp.current_seconds() 2 values time_arithmetic: 2592000 (3 rules)

time_arithmetic: 2592000 3 rules

Sample rules:

time_arithmetic: graph.entity.domain.creation_time.seconds 2 rules

Sample rules:

comm 2 values eq: insmod (2 rules)

eq: insmod 2 rules, 2 vendors

Boot or Logon Autostart Execution T1547, Kernel Modules and Extensions T1547.006

Sample rules:

eq: split 2 rules, 2 vendors

Data Transfer Size Limits T1030

Sample rules:

event_type_id 2 values eq: 3 (2 rules)

eq: 3 2 rules, 2 vendors

Sample rules:

eq: 11 2 rules

Sample rules:

reason 2 values eq: bypass_user (2 rules)

eq: bypass_user 2 rules, 2 vendors

Sample rules:

eq: risky application detected 2 rules

Steal Application Access Token T1528

Sample rules:

@Name 2 values eq: KeyName (2 rules)

eq: KeyName 2 rules

Sample rules:

eq: SubjectUserName 2 rules

Command and Scripting Interpreter T1059, OS Credential Dumping T1003, Account Manipulation T1098

Sample rules:

ActivityStatusValue 2 values eq: success (2 rules)

eq: success 2 rules

Sample rules:

starts_with: Accept 2 rules

Modify Cloud Compute Infrastructure T1578

Sample rules:

All_Changes.command 2 values contains: tftp-server (2 rules)

contains: tftp-server 2 rules

Sample rules:

contains: user table modified 2 rules

Sample rules:

All_Traffic.app 2 values eq: smb (2 rules)

eq: smb 2 rules

Sample rules:

in: *\\perflogs\\* 2 rules

Exfiltration Over Other Network Medium T1011, Account Discovery T1087, Domain Account T1087.002, User Execution T1204, Malicious File T1204.002

Sample rules:

AppName 2 values eq: lsass.exe (2 rules)

eq: lsass.exe 2 rules

Endpoint Denial of Service T1499, OS Credential Dumping T1003, LSASS Memory T1003.001

Sample rules:

starts_with: ConnectSyncProvisioning_ 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Account Manipulation T1098, Modify Authentication Process T1556, Hybrid Identity T1556.007, Additional Cloud Credentials T1098.001

Sample rules:

ApplicationProtocol 2 values in: pop3 (2 rules)

in: pop3 2 rules

Sample rules:

in: smtp 2 rules

Sample rules:

AzureActivity_TimeGenerated 2 values cross_field_compare: ExpirationDateTime (2 rules)

cross_field_compare: ExpirationDateTime 2 rules

Sample rules:

cross_field_compare: ValidUntil 2 rules

Sample rules:

Caller 2 values is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

regex_match: ^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+$ 2 rules

Sample rules:

DGADomain 2 values gt: 8 (2 rules)

gt: 8 2 rules

Sample rules:

regex_match: ^[A-Za-z]{0,}$ 2 rules

Sample rules:

DestinationHost 2 values contains: domains (2 rules)

contains: domains 2 rules

Application Layer Protocol T1071, Event Triggered Execution T1546

Sample rules:

is_not_null: 2 rules

Application Layer Protocol T1071, Phishing T1566

Sample rules:

DestinationHostName 2 values contains: domains (2 rules)

contains: domains 2 rules

Application Layer Protocol T1071, Event Triggered Execution T1546

Sample rules:

is_not_null: 2 rules

Sample rules:

DestinationUserID 2 values is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

regex_match: ^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+$ 2 rules

Sample rules:

DeviceNetworkEvents_TimeGenerated 2 values cross_field_compare: ExpirationDateTime (2 rules)

cross_field_compare: ExpirationDateTime 2 rules

Sample rules:

cross_field_compare: ValidUntil 2 rules

Command and Scripting Interpreter T1059, Non-Application Layer Protocol T1095, Exploit Public-Facing Application T1190, Exploitation for Client Execution T1203

Sample rules:

Direction 2 values cross_field_compare: NetworkDirection (2 rules)

cross_field_compare: NetworkDirection 2 rules

Sample rules:

eq: * 2 rules

Command and Scripting Interpreter T1059, Non-Application Layer Protocol T1095, Exploit Public-Facing Application T1190, Exploitation for Client Execution T1203

Sample rules:

DnsQueryTypeName 2 values in: A (2 rules)

in: A 2 rules

Fallback Channels T1008, Dynamic Resolution T1568

Sample rules:

in: AAAA 2 rules

Fallback Channels T1008, Dynamic Resolution T1568

Sample rules:

EmailEvents_TimeGenerated 2 values cross_field_compare: ExpirationDateTime (2 rules)

cross_field_compare: ExpirationDateTime 2 rules

Sample rules:

cross_field_compare: ValidUntil 2 rules

Forge Web Credentials T1606, Cloud Administration Command T1651

Sample rules:

Esql.document_count 2 values lt: 50 (2 rules)

lt: 50 2 rules

Sample rules:

lt: 75 2 rules

Sample rules:

Esql.region_count 2 values ge: 2 (2 rules)

ge: 2 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Steal Application Access Token T1528, Adversary-in-the-Middle T1557

Sample rules:

le: 5 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Steal Application Access Token T1528, Adversary-in-the-Middle T1557

Sample rules:

Esql.total_attempts 2 values ge: 10 (2 rules)

ge: 10 2 rules

Brute Force T1110, Password Guessing T1110.001

Sample rules:

ge: 25 2 rules

Brute Force T1110, Credential Stuffing T1110.004, Password Spraying T1110.003

Sample rules:

EventSeverity 2 values eq: High (2 rules)

eq: High 2 rules

Sample rules:

is_not_null: 2 rules

Sample rules:

EventVendor 2 values eq: ODI-X (2 rules)

eq: ODI-X 2 rules

Sample rules:

eq: Workday 2 rules

Sample rules:

GCPUserIp 2 values is_not_null: (2 rules)

is_not_null: 2 rules

Valid Accounts T1078, Native API T1106, Cloud Service Discovery T1526, Command and Scripting Interpreter T1059, Permission Groups Discovery T1069, Boot or Logon Autostart Execution T1547

Sample rules:

ne: private 2 rules

Valid Accounts T1078, Native API T1106, Cloud Service Discovery T1526, Command and Scripting Interpreter T1059, Permission Groups Discovery T1069, Boot or Logon Autostart Execution T1547

Sample rules:

IncomingTokenType 2 values eq: none (2 rules)

eq: none 2 rules

Sample rules:

ne: none 2 rules

Forge Web Credentials T1606, Cloud Administration Command T1651

Sample rules:

LogonId 2 values eq: 0 (2 rules)

eq: 0 2 rules

Exploitation for Privilege Escalation T1068, Exploit Public-Facing Application T1190, Exploitation for Client Execution T1203

Sample rules:

eq: 0x3e7 2 rules

Command and Scripting Interpreter T1059

Sample rules:

NewTargetUserName 2 values ends_with: $ (2 rules)

ends_with: $ 2 rules

Account Manipulation T1098, Masquerading T1036, Exploitation for Privilege Escalation T1068, T0136 T0136, Create Account T1136

Sample rules:

ne: *$ 2 rules

Valid Accounts T1078, Domain Accounts T1078.002

Sample rules:

ParentUser 2 values contains: authori (2 rules)

contains: authori 2 rules

Access Token Manipulation T1134, Create Process with Token T1134.002, OS Credential Dumping T1003, LSASS Memory T1003.001

Sample rules:

contains: autori 2 rules

Access Token Manipulation T1134, Create Process with Token T1134.002, OS Credential Dumping T1003, LSASS Memory T1003.001

Sample rules:

Path 2 values contains: \desktop\ (2 rules)

contains: \desktop\ 2 rules

Scheduled Task/Job T1053, Scheduled Task T1053.005

Sample rules:

contains: \downloads\ 2 rules

Scheduled Task/Job T1053, Scheduled Task T1053.005

Sample rules:

Process 2 values contains: powershell.exe (2 rules)

contains: powershell.exe 2 rules

Hide Artifacts T1564, Lateral Tool Transfer T1570

Sample rules:

eq: sdelete.exe 2 rules

Data Destruction T1485

Sample rules:

QueryType 2 values eq: select (2 rules)

eq: select 2 rules

Sample rules:

eq: show 2 rules

Sample rules:

RADIUSAuth 2 values eq: reject (2 rules)

eq: reject 2 rules

Sample rules:

is_not_null: 2 rules

Sample rules:

RenderedDescription 2 values contains: downloaded (2 rules)

contains: downloaded 2 rules

Automated Exfiltration T1020

Sample rules:

contains: uploaded 2 rules

Automated Exfiltration T1020

Sample rules:

RescanVerdict 2 values in: malware (2 rules)

in: malware 2 rules

Phishing T1566, Spearphishing Attachment T1566.001, Spearphishing Link T1566.002

Sample rules:

in: phish 2 rules

Phishing T1566, Spearphishing Attachment T1566.001, Spearphishing Link T1566.002

Sample rules:

SecondAppDisplayName 2 values in: Microsoft Azure CLI (2 rules)

in: Microsoft Azure CLI 2 rules

Forge Web Credentials T1606, Cloud Administration Command T1651

Sample rules:

in: Microsoft Azure PowerShell 2 rules

Forge Web Credentials T1606, Cloud Administration Command T1651

Sample rules:

SidHistoryMatch 2 values cross_field_compare: TargetDomainName (2 rules)

cross_field_compare: TargetDomainName 2 rules

Access Token Manipulation T1134, SID-History Injection T1134.005

Sample rules:

cross_field_compare: TargetSidmatch 2 rules

Access Token Manipulation T1134, SID-History Injection T1134.005

Sample rules:

StartTime 2 values ge: UEBAWindowStart (2 rules)

ge: UEBAWindowStart 2 rules

Exploitation for Credential Access T1212, Lateral Tool Transfer T1570

Sample rules:

le: UEBAWindowEnd 2 rules

Exploitation for Credential Access T1212, Lateral Tool Transfer T1570

Sample rules:

Syslog_TimeGenerated 2 values cross_field_compare: ExpirationDateTime (2 rules)

cross_field_compare: ExpirationDateTime 2 rules

Sample rules:

cross_field_compare: ValidUntil 2 rules

Sample rules:

TI_EmailAddress 2 values eq: RecipientAddresses (2 rules)

eq: RecipientAddresses 2 rules

Sample rules:

eq: SenderAddresses 2 rules

Sample rules:

TotalEvents 2 values gt: 30 (2 rules)

gt: 30 2 rules

Sample rules:

lt: 10 2 rules

Sample rules:

Total_TrackingReference 2 values ge: 1 (2 rules)

ge: 1 2 rules

Sample rules:

ge: 3 2 rules

Sample rules:

URI 2 values ends_with: AllUsers (2 rules)

ends_with: AllUsers 2 rules

Sample rules:

ends_with: AuthenticatedUsers 2 rules

Sample rules:

UriPath 2 values contains: /api/login (2 rules)

contains: /api/login 2 rules

Sample rules:

contains: /api/login?user= 2 rules

Sample rules:

UserAccountControl 2 values eq: %%2093 (2 rules)

eq: %%2093 2 rules

Sample rules:

eq: %%2098 2 rules

Disable or Modify Tools T1562, Account Manipulation T1098

Sample rules:

UserType 2 values in: admin (2 rules)

in: admin 2 rules

Sample rules:

in: dcadmin 2 rules

Disable or Modify Tools T1562, Account Manipulation T1098

Sample rules:

User_Id 2 values is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

regex_match: ^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+$ 2 rules

Sample rules:

XCsAppCcl 2 values eq: low (2 rules)

eq: low 2 rules

Sample rules:

eq: poor 2 rules

Sample rules:

a2 2 values eq: clip (2 rules)

eq: clip 2 rules

Sample rules:

eq: clipboard 2 rules

File and Directory Permissions Modification T1222, Windows Permissions T1222.001, Domain or Tenant Policy Modification T1484

Sample rules:

a3 2 values ends_with: .jpg (2 rules)

ends_with: .jpg 2 rules

Screen Capture T1113, Obfuscated Files or Information T1027, Steganography T1027.003

Sample rules:

ends_with: .png 2 rules

Screen Capture T1113, Obfuscated Files or Information T1027, Steganography T1027.003

Sample rules:

aceType 2 values in: access denied (2 rules)

in: access denied 2 rules

Sample rules:

in: d 2 rules

File and Directory Permissions Modification T1222, Windows Permissions T1222.001, Domain or Tenant Policy Modification T1484

Sample rules:

azure.auditlogs.properties.category 2 values eq: directorymanagement (2 rules)

eq: directorymanagement 2 rules

Account Manipulation T1098, Additional Cloud Credentials T1098.001, Domain or Tenant Policy Modification T1484, Trust Modification T1484.002, Modify Authentication Process T1556, Hybrid Identity T1556.007

Sample rules:

eq: rolemanagement 2 rules

Account Manipulation T1098, Additional Cloud Roles T1098.003

Sample rules:

azure.platformlogs.properties.log.objectRef.resource 2 values eq: nodes (2 rules)

eq: nodes 2 rules

Exploitation of Remote Services T1210, Container Administration Command T1609

Sample rules:

eq: pods 2 rules

Deploy Container T1610, Container Administration Command T1609

Sample rules:

azure.platformlogs.properties.log.responseStatus.code 2 values in: 200 (2 rules)

in: 200 2 rules

Unsecured Credentials T1552, Container API T1552.007, Steal Application Access Token T1528

Sample rules:

in: 201 2 rules

Unsecured Credentials T1552, Container API T1552.007, Steal Application Access Token T1528

Sample rules:

azure.signinlogs.properties.incoming_token_type 2 values eq: primaryRefreshToken (2 rules)

eq: primaryRefreshToken 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Account Manipulation T1098, Device Registration T1098.005, Steal Application Access Token T1528, Use Alternate Authentication Material T1550

Sample rules:

eq: refreshToken 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Account Manipulation T1098, Device Registration T1098.005, Steal Application Access Token T1528, Use Alternate Authentication Material T1550

Sample rules:

azure_ad::target_resources 2 values contains: offline (2 rules)

contains: offline 2 rules

Steal Application Access Token T1528, Use Alternate Authentication Material T1550

Sample rules:

is_not_null: 2 rules

Forced Authentication T1187, Adversary-in-the-Middle T1557, Name Resolution Poisoning and SMB Relay T1557.001, Use Alternate Authentication Material T1550

Sample rules:

computer_name 2 values is_not_null: (2 rules)

is_not_null: 2 rules

Brute Force T1110, Password Guessing T1110.001, Password Spraying T1110.003

Sample rules:

starts_with: substring(user.name, 0, (-1)) 2 rules

Sample rules:

confidence_score 2 values ge: 60 (2 rules)

ge: 60 2 rules

Sample rules:

ge: 80 2 rules

Sample rules:

cs-host 2 values eq: api.telegram.org (2 rules)

eq: api.telegram.org 2 rules

Sample rules:

regex_match: .{150} 2 rules

Sample rules:

data.details.request.path 2 values eq: /api/v2/guardian/policies (2 rules)

eq: /api/v2/guardian/policies 2 rules

Sample rules:

eq: /api/v2/risk-assessment/config 2 rules

Sample rules:

data_action_s 2 values eq: accept (2 rules)

eq: accept 2 rules

Sample rules:

eq: reject 2 rules

Sample rules:

destination.address 2 values wildcard: 127.* (2 rules)

wildcard: 127.* 2 rules

Sample rules:

wildcard: ::1 2 rules

Sample rules:

entity_type 2 values eq: account (2 rules)

eq: account 2 rules

Sample rules:

eq: host 2 rules

Sample rules:

event.OperationName 2 values in: CreateAllowlistGroup (2 rules)

in: CreateAllowlistGroup 2 rules

Sample rules:

in: UpdateAllowlistGroup 2 rules

Sample rules:

failed_attempts 2 values gt: 10 (2 rules)

gt: 10 2 rules

Brute Force T1110, Password Guessing T1110.001

Sample rules:

gt: 20 2 rules

Password Policy Discovery T1201, Brute Force T1110, Password Spraying T1110.003, Credential Stuffing T1110.004

Sample rules:

gcp::method_name 2 values ends_with: instances.insert (2 rules)

ends_with: instances.insert 2 rules

Valid Accounts T1078, Native API T1106, Cloud Service Discovery T1526, Command and Scripting Interpreter T1059, Permission Groups Discovery T1069, Boot or Logon Autostart Execution T1547

Sample rules:

eq: SetIamPolicy 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Disable or Modify Tools T1562, Disable or Modify Cloud Log T1562.008

Sample rules:

graph.entity.domain.expiration_time.seconds 2 values gt: 0 (2 rules)

gt: 0 2 rules

Sample rules:

macro: access.metadata.event_timestamp.seconds 2 rules

Sample rules:

headers.mailer 2 values eq: microsoft cdo for windows 2000 (2 rules)

eq: microsoft cdo for windows 2000 2 rules

Sample rules:

starts_with: Open-Xchange Mailer 2 rules

Sample rules:

headers.return_path.domain.root_domain 2 values eq: salesforce.com (2 rules)

eq: salesforce.com 2 rules

Sample rules:

ne: bestdeals.today 2 rules

Sample rules:

headers.return_path.email 2 values cross_field_compare: sender.email.email (2 rules)

cross_field_compare: sender.email.email 2 rules

Sample rules:

is_not_null: 2 rules

Sample rules:

kibana.alert.rule.threat.tactic.name 2 values eq: lateral movement (2 rules)

eq: lateral movement 2 rules

Sample rules:

is_not_null: 2 rules

Sample rules:

logger 2 values in: wt.method.methodcontextmonitor.contexts.servletrequest (2 rules)

in: wt.method.methodcontextmonitor.contexts.servletrequest 2 rules

Sample rules:

in: wt.servlet.servletrequestmonitor.request 2 rules

Sample rules:

m365::ObjectId 2 values in: 00000003-0000-0000-c000-000000000000 (2 rules)

in: 00000003-0000-0000-c000-000000000000 2 rules

Phishing T1566, Valid Accounts T1078, Cloud Accounts T1078.004, Steal Application Access Token T1528, Use Alternate Authentication Material T1550, Application Access Token T1550.001

Sample rules:

is_not_null: 2 rules

Office Application Startup T1137, Outlook Rules T1137.005, Hide Artifacts T1564, Email Hiding Rules T1564.008, Account Manipulation T1098, Steal Application Access Token T1528

Sample rules:

okta::debugContext.debugData.dt_hash 2 values is_not_null: (2 rules)

is_not_null: 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Brute Force T1110, Password Spraying T1110.003, Credential Stuffing T1110.004

Sample rules:

ne: - 2 rules

Brute Force T1110, Password Spraying T1110.003, Credential Stuffing T1110.004

Sample rules:

old_value_set 2 values eq: [] (2 rules)

eq: [] 2 rules

Use Alternate Authentication Material T1550, Application Access Token T1550.001

Sample rules:

ne: [] 2 rules

Use Alternate Authentication Material T1550, Application Access Token T1550.001

Sample rules:

parent_process_guid 2 values eq: event0.process.entity_id (2 rules)

eq: event0.process.entity_id 2 rules

Sample rules:

eq: event1.process.entity_id 2 rules

Sample rules:

primaryDisplayName 2 values contains: admin (2 rules)

contains: admin 2 rules

Sample rules:

ne: *admin* 2 rules

Sample rules:

process.Ext.api.summary 2 values contains: amsi.dll (2 rules)

contains: amsi.dll 2 rules

Sample rules:

contains: ntdll.dll 2 rules

Sample rules:

process.Ext.protection 2 values ne: PsProtectedSignerAntimalware-Light (2 rules)

ne: PsProtectedSignerAntimalware-Light 2 rules

Sample rules:

starts_with: PsProtectedSigner 2 rules

Sample rules:

proctitle 2 values in: *service * (2 rules)

in: *service * 2 rules

Scheduled Task/Job T1053, Systemd Timers T1053.006, System Services T1569, Service Execution T1569.002

Sample rules:

in: *systemctl * 2 rules

Scheduled Task/Job T1053, Systemd Timers T1053.006, System Services T1569, Service Execution T1569.002

Sample rules:

properties.message 2 values eq: add app role assignment to service principal (2 rules)

eq: add app role assignment to service principal 2 rules

Steal Application Access Token T1528, Account Manipulation T1098, Additional Cloud Roles T1098.003

Sample rules:

eq: add delegated permission grant 2 rules

Steal Application Access Token T1528

Sample rules:

requestParameters.VersioningConfiguration.Status 2 values in: Disabled (2 rules)

in: Disabled 2 rules

Data Destruction T1485, Disable or Modify Tools T1562

Sample rules:

in: Suspended 2 rules

Data Destruction T1485, Disable or Modify Tools T1562

Sample rules:

resource.type 2 values eq: http_load_balancer (2 rules)

eq: http_load_balancer 2 rules

Sample rules:

starts_with: bigquery 2 rules

Sample rules:

risk_type 2 values eq: duplicate_password (2 rules)

eq: duplicate_password 2 rules

Sample rules:

eq: weak_password_policy 2 rules

Sample rules:

s_domain 2 values cross_field_compare: rec_domain (2 rules)

cross_field_compare: rec_domain 2 rules

Sample rules:

eq: corp_domain 2 rules

Sample rules:

scStatus 2 values in: 401 (2 rules)

in: 401 2 rules

Sample rules:

in: 403 2 rules

Sample rules:

strings.count 2 values func_call: strings.count(body.current_thread.text, "©") == 1 (2 rules)

func_call: strings.count(body.current_thread.text, "©") == 1 2 rules

Sample rules:

func_call: strings.count(subject.base, " ") > 8 2 rules

Sample rules:

target.resource.attribute.labels["visibility"] 2 values eq: people_with_link (2 rules)

eq: people_with_link 2 rules

Unsecured Credentials T1552, User Execution T1204

Sample rules:

eq: public_on_the_web 2 rules

Unsecured Credentials T1552, User Execution T1204

Sample rules:

target.resource.name 2 values eq: IDENTITY (2 rules)

eq: IDENTITY 2 rules

Sample rules:

eq: PFCG 2 rules

Sample rules:

vulnerability_category 2 values eq: ATTACK_SURFACE_VULNERABILITY (2 rules)

eq: ATTACK_SURFACE_VULNERABILITY 2 rules

Sample rules:

ne: ATTACK_SURFACE_VULNERABILITY 2 rules

Sample rules:

type.inbound 1 value eq: true (1158 rules)

eq: true 1158 rules

Sample rules (showing 8 of 1158):

type.outbound 1 value eq: true (162 rules)

eq: true 162 rules

Sample rules (showing 8 of 162):

Active 1 value eq: true (70 rules)

eq: true 70 rules

Application Layer Protocol T1071, Phishing T1566, Valid Accounts T0859, Remote Services T0886, Remote Services T1021, Valid Accounts T1078

Sample rules (showing 8 of 70):

ValidUntil 1 value is_null: (58 rules)

is_null: 58 rules

Application Layer Protocol T1071, Phishing T1566, Command and Scripting Interpreter T1059

Sample rules (showing 8 of 58):

headers.references 1 value length_compare: 0 (46 rules)

length_compare: 0 46 rules

Sample rules (showing 8 of 46):

isOutlier 1 value eq: 1 (33 rules)

eq: 1 33 rules

Brute Force T1110, Password Spraying T1110.003, Credential Stuffing T1110.004, Compromise Accounts T1586, Cloud Accounts T1586.003, Account Manipulation T1098

Sample rules (showing 8 of 33):

headers.auth_summary.spf.pass 1 value eq: true (32 rules)

eq: true 32 rules

Sample rules (showing 8 of 32):

headers.reply_to 1 value length_compare: 0 (32 rules)

length_compare: 0 32 rules

Sample rules (showing 8 of 32):

Result 1 value eq: success (31 rules)

eq: success 31 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Account Manipulation T1098, Use Alternate Authentication Material T1550, Application Access Token T1550.001, Create Account T1136

Sample rules (showing 8 of 31):

NetworkSourceIP 1 value is_not_null: (27 rules)

is_not_null: 27 rules

Application Layer Protocol T1071, Valid Accounts T0859, Remote Services T0886, Remote Services T1021, Valid Accounts T1078, External Remote Services T1133

Sample rules (showing 8 of 27):

Effect 1 value eq: allow (26 rules)

eq: allow 26 rules

Account Manipulation T1098, Additional Cloud Roles T1098.003, Domain or Tenant Policy Modification T1484, Transfer Data to Cloud Account T1537, Data Encrypted for Impact T1486

Sample rules (showing 8 of 26):

EmailSourceIpAddress 1 value is_not_null: (26 rules)

is_not_null: 26 rules

Application Layer Protocol T1071, Valid Accounts T0859, Remote Services T0886, Remote Services T1021, Valid Accounts T1078, External Remote Services T1133

Sample rules (showing 8 of 26):

NetworkDestinationIP 1 value is_not_null: (26 rules)

is_not_null: 26 rules

Application Layer Protocol T1071, Valid Accounts T0859, Remote Services T0886, Remote Services T1021, Valid Accounts T1078, External Remote Services T1133

Sample rules (showing 8 of 26):

NetworkIP 1 value is_not_null: (26 rules)

is_not_null: 26 rules

Application Layer Protocol T1071, Valid Accounts T0859, Remote Services T0886, Remote Services T1021, Valid Accounts T1078, External Remote Services T1133

Sample rules (showing 8 of 26):

process.parent.code_signature.trusted 1 value eq: false (26 rules)

eq: false 26 rules

Command and Scripting Interpreter T1059, Unix Shell T1059.004, AppleScript T1059.002, Hijack Execution Flow T1574, Abuse Elevation Control Mechanism T1548, Credentials from Password Stores T1555

Sample rules (showing 8 of 26):

process.parent.code_signature.exists 1 value eq: false (25 rules)

eq: false 25 rules

Command and Scripting Interpreter T1059, AppleScript T1059.002, Unix Shell T1059.004, Hijack Execution Flow T1574, Abuse Elevation Control Mechanism T1548, Credentials from Password Stores T1555

Sample rules (showing 8 of 25):

recipients.bcc 1 value length_compare: 0 (24 rules)

length_compare: 0 24 rules

Sample rules (showing 8 of 24):

username 1 value contains: serviceaccount (24 rules)

contains: serviceaccount 24 rules

Cloud Accounts T1078.004, Escape to Host T1611, Unsecured Credentials T1552, Account Manipulation T1098, Container API T1552.007, Data from Cloud Storage T1530

Sample rules (showing 8 of 24):

dll.code_signature.exists 1 value eq: false (22 rules)

eq: false 22 rules

Masquerading T1036, Invalid Code Signature T1036.001

Sample rules (showing 8 of 22):

IsActive 1 value eq: true (21 rules)

eq: true 21 rules

Application Layer Protocol T1071, Command and Scripting Interpreter T1059, Exploit Public-Facing Application T1190, Phishing T1566, Dynamic Resolution T1568, Brute Force T1110

Sample rules (showing 8 of 21):

process.interactive 1 value eq: true (19 rules)

eq: true 19 rules

Command and Scripting Interpreter T1059, Unix Shell T1059.004, Permission Groups Discovery T1069, Account Discovery T1087, Container Administration Command T1609, Deploy Container T1610

Sample rules (showing 8 of 19):

OperationType 1 value eq: %%14674 (17 rules)

eq: %%14674 17 rules, 3 vendors

Account Manipulation T1098, Domain or Tenant Policy Modification T1484, File and Directory Permissions Modification T1222, Windows Permissions T1222.001, Group Policy Modification T1484.001, Event Triggered Execution T1546

Sample rules (showing 8 of 17):

data.details.request.channel 1 value eq: https://manage.auth0.com/ (17 rules)

eq: https://manage.auth0.com/ 17 rules

Sample rules (showing 8 of 17):

protoPayload.authorizationInfo 1 value is_not_null: (17 rules)

is_not_null: 17 rules

Abuse Elevation Control Mechanism T1548, Exfiltration Over C2 Channel T1041, Escape to Host T1611, Exploit Public-Facing Application T1190

Sample rules (showing 8 of 17):

DomainName 1 value is_not_null: (15 rules)

is_not_null: 15 rules

Application Layer Protocol T1071, Phishing T1566

Sample rules (showing 8 of 15):

isNew 1 value eq: True (15 rules)

eq: True 15 rules

Sample rules (showing 8 of 15):

kibana.alert.rule.name 1 value is_not_null: (13 rules)

is_not_null: 13 rules

Sample rules (showing 8 of 13):

process.entry_leader.entry_meta.type 1 value eq: container (13 rules)

eq: container 13 rules

Sample rules (showing 8 of 13):

anomalies 1 value gt: 0 (12 rules)

gt: 0 12 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Resource Hijacking T1496, Email Collection T1114, Command and Scripting Interpreter T1059

Sample rules (showing 8 of 12):

key 1 value eq: user-agent (12 rules)

eq: user-agent 12 rules

Use Alternate Authentication Material T1550, Account Manipulation T1098, Application Access Token T1550.001, Credentials from Password Stores T1555, Steal Application Access Token T1528, Exploitation for Privilege Escalation T1068

Sample rules (showing 8 of 12):

log_source 1 value eq: auditevents (12 rules)

eq: auditevents 12 rules

Modify Authentication Process T1556, Account Manipulation T1098, Valid Accounts T1078, Disable or Modify Tools T1562, Create Account T1136, Credentials from Password Stores T1555

Sample rules (showing 8 of 12):

pattern 1 value contains: file:hashes (12 rules)

contains: file:hashes 12 rules

Sample rules (showing 8 of 12):

process.parent.Ext.real.pid 1 value gt: 0 (11 rules)

gt: 0 11 rules

Access Token Manipulation T1134, Parent PID Spoofing T1134.004, Create Process with Token T1134.002

Sample rules (showing 8 of 11):

subject.is_reply 1 value eq: true (11 rules)

eq: true 11 rules

Sample rules (showing 8 of 11):

Activity 1 value contains: modified (10 rules)

contains: modified 10 rules

Domain or Tenant Policy Modification T1484, Group Policy Modification T1484.001, Valid Accounts T1078, Domain Accounts T1078.002, File and Directory Permissions Modification T1222, Windows Permissions T1222.001

Sample rules (showing 8 of 10):

CsUsername 1 value is_not_null: (10 rules)

is_not_null: 10 rules

Sample rules (showing 8 of 10):

RiskScore 1 value ge: 3 (10 rules)

ge: 3 10 rules

Sample rules (showing 8 of 10):

data_data_result_s 1 value eq: failed (10 rules)

eq: failed 10 rules

Sample rules (showing 8 of 10):

data_data_severity_s 1 value eq: High (10 rules)

eq: High 10 rules

Sample rules (showing 8 of 10):

deviceProduct_s 1 value eq: azure (10 rules)

eq: azure 10 rules

Sample rules (showing 8 of 10):

enough_data 1 value eq: 1 (10 rules)

eq: 1 10 rules

Sample rules (showing 8 of 10):

event.errorcode 1 value eq: None (10 rules)

eq: None 10 rules

Sample rules (showing 8 of 10):

event.result 1 value eq: SUCCESS (10 rules)

eq: SUCCESS 10 rules

Sample rules (showing 8 of 10):

process.Ext.api.parameters.app_name 1 value eq: PowerShell (10 rules)

eq: PowerShell 10 rules

Sample rules (showing 8 of 10):

process.group.id 1 value eq: 0 (10 rules)

eq: 0 10 rules

Sample rules (showing 8 of 10):

process.user.id 1 value eq: 0 (10 rules)

eq: 0 10 rules

Sample rules (showing 8 of 10):

TicketEncryptionType 1 value eq: 0x17 (9 rules)

eq: 0x17 9 rules, 4 vendors

Steal or Forge Kerberos Tickets T1558, Kerberoasting T1558.003, Golden Ticket T1558.001, Use Alternate Authentication Material T1550

Sample rules (showing 8 of 9):

ObservableValue 1 value is_not_null: (9 rules)

is_not_null: 9 rules

Application Layer Protocol T1071, Command and Scripting Interpreter T1059, Phishing T1566, Dynamic Resolution T1568, Drive-by Compromise T1189, Compromise Host Software Binary T1554

Sample rules (showing 8 of 9):

fdr_event_type 1 value eq: ProcessRollup2 (9 rules)

eq: ProcessRollup2 9 rules

Sample rules (showing 8 of 9):

process.real_group.id 1 value ne: 0 (9 rules)

ne: 0 9 rules

Sample rules (showing 8 of 9):

process.real_user.id 1 value ne: 0 (9 rules)

ne: 0 9 rules

Sample rules (showing 8 of 9):

security_result.about.labels["Sample"] 1 value ne: true (9 rules)

ne: true 9 rules

Sample rules (showing 8 of 9):

span 1 value eq: 10s (9 rules)

eq: 10s 9 rules

Sample rules (showing 8 of 9):

unique_accounts 1 value gt: 30 (9 rules)

gt: 30 9 rules

Brute Force T1110, Password Spraying T1110.003, Credential Stuffing T1110.004

Sample rules (showing 8 of 9):

azure_ad::authentication_requirement 1 value eq: singlefactorauthentication (8 rules)

eq: singlefactorauthentication 8 rules, 2 vendors

Valid Accounts T1078, Cloud Accounts T1078.004, Modify Authentication Process T1556, Brute Force T1110, Password Guessing T1110.001, Password Spraying T1110.003

Sample rules:

ComplianceStatus 1 value eq: FAILED (8 rules)

eq: FAILED 8 rules

Sample rules:

Reason 1 value eq: new_alert (8 rules)

eq: new_alert 8 rules

Sample rules:

RecordState 1 value eq: ACTIVE (8 rules)

eq: ACTIVE 8 rules

Sample rules:

aws::userIdentity.arn 1 value is_not_null: (8 rules)

is_not_null: 8 rules

Cloud Service Discovery T1526, Cloud Infrastructure Discovery T1580, Serverless Execution T1648, Data from Cloud Storage T1530, Cloud Storage Object Discovery T1619, Resource Hijacking T1496

Sample rules:

objectRef:resource 1 value eq: pods (8 rules)

eq: pods 8 rules

Sample rules:

process.Ext.api.parameters.hook_type 1 value eq: WH_KEYBOARD_LL (8 rules)

eq: WH_KEYBOARD_LL 8 rules

Sample rules:

subject.is_forward 1 value eq: true (8 rules)

eq: true 8 rules

Sample rules:

tool 1 value is_not_null: (8 rules)

is_not_null: 8 rules

Remote Services T1021, SMB/Windows Admin Shares T1021.002, Process Injection T1055, Inter-Process Communication T1559

Sample rules:

All_Risk.risk_object_type 1 value eq: system (7 rules)

eq: system 7 rules

Sample rules:

DstUserName 1 value is_not_null: (7 rules)

is_not_null: 7 rules

Sample rules:

Esql.agent_id_count_distinct 1 value eq: 1 (7 rules)

eq: 1 7 rules

Sample rules:

Version 1 value eq: 2 (7 rules)

eq: 2 7 rules

User Execution T1204, Remote Services T1021, Distributed Component Object Model T1021.003, System Services T1569, Service Execution T1569.002, Windows Management Instrumentation T1047

Sample rules:

_waf_matches_any_group 1 value func_call: event.get('terminatingRuleId', ''), rule_groups (7 rules)

func_call: event.get('terminatingRuleId', ''), rule_groups 7 rules

Sample rules:

azure.platformlogs.properties.log.stage 1 value eq: responsecomplete (7 rules)

eq: responsecomplete 7 rules

Adversary-in-the-Middle T1557, Steal or Forge Authentication Certificates T1649, Steal Application Access Token T1528, Indicator Removal T1070, Permission Groups Discovery T1069, Cloud Groups T1069.003

Sample rules:

azure_ad::user_principal_name 1 value is_not_null: (7 rules)

is_not_null: 7 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Brute Force T1110, Password Guessing T1110.001, Password Spraying T1110.003, Credential Stuffing T1110.004

Sample rules:

beta.ocr 1 value func_call: beta.ocr(file.message_screenshot()).text != (7 rules)

func_call: beta.ocr(file.message_screenshot()).text != 7 rules

Sample rules:

beta.scan_qr 1 value func_call: beta.scan_qr(file.message_screenshot()).found (7 rules)

func_call: beta.scan_qr(file.message_screenshot()).found 7 rules

Sample rules:

execution_status 1 value eq: success (7 rules)

eq: success 7 rules

Sample rules:

filter(attachments, .file_type not in $file_types_images) 1 value length_compare: 0 (7 rules)

length_compare: 0 7 rules

Sample rules:

graph.metadata.threat.threat_feed_name 1 value eq: Tor Exit Nodes (7 rules)

eq: Tor Exit Nodes 7 rules

Proxy T1090, Multi-hop Proxy T1090.003, Account Manipulation T1098

Sample rules:

host.id 1 value is_not_null: (7 rules)

is_not_null: 7 rules

Sample rules:

isutility 1 value eq: true (7 rules)

eq: true 7 rules

Remote Access Tools T1219

Sample rules:

match_count 1 value gt: 0 (7 rules)

gt: 0 7 rules

Abuse Elevation Control Mechanism T1548, Sudo and Sudo Caching T1548.003, Account Manipulation T1098, SSH Authorized Keys T1098.004, Scheduled Task/Job T1053, Cron T1053.003

Sample rules:

process.parent.thread.Ext.call_stack_contains_unbacked 1 value eq: true (7 rules)

eq: true 7 rules

Sample rules:

process.thread.Ext.call_stack_final_user_module.code_signature 1 value is_not_null: (7 rules)

is_not_null: 7 rules

Sample rules:

tld 1 value eq: list_tlds (7 rules)

eq: list_tlds 7 rules

Sample rules:

CategoryValue 1 value eq: administrative (6 rules)

eq: administrative 6 rules, 2 vendors

Modify Cloud Compute Infrastructure T1578, Delete Cloud Instance T1578.003, Steal Application Access Token T1528, Use Alternate Authentication Material T1550

Sample rules:

ResourceProviderValue 1 value eq: microsoft.adhybridhealthservice (6 rules)

eq: microsoft.adhybridhealthservice 6 rules, 2 vendors

Modify Cloud Compute Infrastructure T1578, Delete Cloud Instance T1578.003, Steal Application Access Token T1528, Use Alternate Authentication Material T1550

Sample rules:

properties.result 1 value eq: success (6 rules)

eq: success 6 rules, 3 vendors

Domain or Tenant Policy Modification T1484, Trust Modification T1484.002, Modify Authentication Process T1556, Steal Application Access Token T1528, Account Manipulation T1098, Additional Cloud Roles T1098.003

Sample rules:

1 1 value eq: 1 (6 rules)

eq: 1 6 rules

Masquerading T1036, Command and Scripting Interpreter T1059, OS Credential Dumping T1003, Match Legitimate Resource Name or Location T1036.005, Active Scanning T1595, Windows Command Shell T1059.003

Sample rules:

@timestamp 1 value ge: now-30d/d (6 rules)

ge: now-30d/d 6 rules

Sample rules:

All_Changes.status 1 value eq: success (6 rules)

eq: success 6 rules

Sample rules:

Anomalies 1 value gt: 0 (6 rules)

gt: 0 6 rules

Valid Accounts T1078, Data from Cloud Storage T1530, Native API T0834, Valid Accounts T0859, Execution through API T0871, Steal Application Access Token T1528

Sample rules:

ClientIp 1 value is_not_null: (6 rules)

is_not_null: 6 rules

Valid Accounts T1078, External Remote Services T1133, Exploit Public-Facing Application T1190, Cloud Service Discovery T1526, Cloud Service Dashboard T1538, Exfiltration Over Web Service T1567

Sample rules:

Esql.event_module_distinct_count 1 value ge: 2 (6 rules)

ge: 2 6 rules

Sample rules:

SrcBytes 1 value ne: 0 (6 rules)

ne: 0 6 rules

Sample rules:

Total_TransactionId 1 value ge: 3 (6 rules)

ge: 3 6 rules

Sample rules:

category_type 1 value eq: Account (6 rules)

eq: Account 6 rules

Sample rules:

domain 1 value is_not_null: (6 rules)

is_not_null: 6 rules

Sample rules:

event.Success 1 value is_not_null: (6 rules)

is_not_null: 6 rules

Sample rules:

recipients.to[0].email.email 1 value cross_field_compare: sender.email.email (6 rules)

cross_field_compare: sender.email.email 6 rules

Sample rules:

score 1 value ge: 5 (6 rules)

ge: 5 6 rules

Fallback Channels T1008, Dynamic Resolution T1568, Non-Application Layer Protocol T1095, Encrypted Channel T1573, Gather Victim Network Information T1590, Data Transfer Size Limits T1030

Sample rules:

sha1 1 value is_not_null: (6 rules)

is_not_null: 6 rules

Masquerading T1036, Application Layer Protocol T1071, Rename Legitimate Utilities T1036.003, Hijack Execution Flow T1574, DLL T1574.001, DLL T1574.002

Sample rules:

data.details.response.statusCode 1 value eq: 200 (5 rules)

eq: 200 5 rules, 2 vendors

Sample rules:

user.username 1 value eq: system:anonymous (5 rules)

eq: system:anonymous 5 rules, 3 vendors

Cloud Service Discovery T1526

Sample rules:

EXECUTION_STATUS 1 value eq: SUCCESS (5 rules)

eq: SUCCESS 5 rules

Sample rules:

FileHashValue 1 value is_not_null: (5 rules)

is_not_null: 5 rules

Exploitation for Client Execution T1203

Sample rules:

IsHotwordAnomalyOnStatement 1 value eq: true (5 rules)

eq: true 5 rules

Sample rules:

PassedControls 1 value lt: 70 (5 rules)

lt: 70 5 rules

Sample rules:

PassedControlsPercentage 1 value lt: 70 (5 rules)

lt: 70 5 rules

Sample rules:

SrcFileName 1 value is_not_null: (5 rules)

is_not_null: 5 rules

Sample rules:

ThreatName 1 value is_not_null: (5 rules)

is_not_null: 5 rules

Sample rules:

TotalHits 1 value ge: 10 (5 rules)

ge: 10 5 rules

Sample rules:

admonEventType 1 value eq: update (5 rules)

eq: update 5 rules

Domain or Tenant Policy Modification T1484, Group Policy Modification T1484.001, Disable or Modify Tools T1685, File and Directory Permissions Modification T1222, Windows Permissions T1222.001

Sample rules:

baseline 1 value gt: 0 (5 rules)

gt: 0 5 rules

Resource Hijacking T1496, Command and Scripting Interpreter T1059, Non-Application Layer Protocol T1095, Exploit Public-Facing Application T1190, Exploitation for Client Execution T1203

Sample rules:

file.directory 1 value is_null: (5 rules)

is_null: 5 rules

Obfuscated Files or Information T1027, Command Obfuscation T1027.010, Command and Scripting Interpreter T1059, PowerShell T1059.001, Deobfuscate/Decode Files or Information T1140

Sample rules:

gen_ai.policy.action 1 value eq: blocked (5 rules)

eq: blocked 5 rules

Sample rules:

github.hashed_token 1 value is_not_null: (5 rules)

is_not_null: 5 rules

Sample rules:

github.repository_public 1 value eq: false (5 rules)

eq: false 5 rules

Data from Information Repositories T1213, Code Repositories T1213.003, Serverless Execution T1648, Command and Scripting Interpreter T1059, Valid Accounts T1078, Cloud Accounts T1078.004

Sample rules:

inspected_document 1 value is_not_null: (5 rules)

is_not_null: 5 rules

Sample rules:

kibana.alert.workflow_status 1 value eq: open (5 rules)

eq: open 5 rules

Sample rules:

kubernetes.audit.objectRef.subresource 1 value eq: exec (5 rules)

eq: exec 5 rules

Container Administration Command T1609, Unsecured Credentials T1552, Cloud Instance Metadata API T1552.005, Credentials In Files T1552.001, Container API T1552.007, Ingress Tool Transfer T1105

Sample rules:

ml.nlu_classifier 1 value func_call: ml.nlu_classifier(body.current_thread.text).language == english (5 rules)

func_call: ml.nlu_classifier(body.current_thread.text).language == english 5 rules

Sample rules:

ml.nlu_classifier(body.current_thread.text).intents 1 value length_compare: 0 (5 rules)

length_compare: 0 5 rules

Sample rules:

module_s 1 value eq: IDS (5 rules)

eq: IDS 5 rules

Sample rules:

unique_targets 1 value gt: 30 (5 rules)

gt: 30 5 rules

Network Share Discovery T1135, Valid Accounts T1078, Brute Force T1110, Credential Stuffing T1110.004, OS Credential Dumping T1003, Security Account Manager T1003.002

Sample rules:

upwind_is_known_severity 1 value func_call: event (5 rules)

func_call: event 5 rules

Sample rules:

user.email 1 value is_not_null: (5 rules)

is_not_null: 5 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Adversary-in-the-Middle T1557, Steal Application Access Token T1528, Account Manipulation T1098, Device Registration T1098.005

Sample rules:

userPrincipalName 1 value contains: @ (5 rules)

contains: @ 5 rules

Use Alternate Authentication Material T1550, Application Access Token T1550.001, Account Manipulation T1098

Sample rules:

OldTargetUserName 1 value ends_with: $ (4 rules)

ends_with: $ 4 rules, 3 vendors

Valid Accounts T1078, Domain Accounts T1078.002, Masquerading T1036, Exploitation for Privilege Escalation T1068, Account Manipulation T1098

Sample rules:

All_Traffic.transport 1 value eq: tcp (4 rules)

eq: tcp 4 rules

Sample rules:

AmpFileName 1 value is_not_null: (4 rules)

is_not_null: 4 rules

Sample rules:

CollectorHostName 1 value eq: SAPLogServ (4 rules)

eq: SAPLogServ 4 rules

Sample rules:

Condition 1 value is_null: (4 rules)

is_null: 4 rules

Account Manipulation T1098, Additional Cloud Roles T1098.003, Transfer Data to Cloud Account T1537

Sample rules:

Esql.dest_host 1 value is_not_null: (4 rules)

is_not_null: 4 rules

Sample rules:

Esql.destination_host_count 1 value lt: 3 (4 rules)

lt: 3 4 rules

Sample rules:

Esql.event_category_distinct_count 1 value ge: 2 (4 rules)

ge: 2 4 rules

Sample rules:

Esql.executed_command 1 value is_not_null: (4 rules)

is_not_null: 4 rules

Container Administration Command T1609, Unsecured Credentials T1552, Cloud Instance Metadata API T1552.005, Credentials In Files T1552.001, Container API T1552.007, Ingress Tool Transfer T1105

Sample rules:

Esql.host_key 1 value is_not_null: (4 rules)

is_not_null: 4 rules

Sample rules:

EventTime_t 1 value cross_field_compare: min_t (4 rules)

cross_field_compare: min_t 4 rules

Fallback Channels T1008, Dynamic Resolution T1568, Encrypted Channel T1573, Data Transfer Size Limits T1030, Network Service Discovery T1046, Application Layer Protocol T1071

Sample rules:

FileDirection 1 value eq: download (4 rules)

eq: download 4 rules

Sample rules:

Fqdn 1 value is_not_null: (4 rules)

is_not_null: 4 rules

Sample rules:

MSTI 1 value eq: false (4 rules)

eq: false 4 rules

Sample rules:

MultipleClientErrors 1 value gt: 100 (4 rules)

gt: 100 4 rules

Sample rules:

MultipleServerErrors 1 value gt: 100 (4 rules)

gt: 100 4 rules

Sample rules:

OriginalRequestId 1 value is_not_null: (4 rules)

is_not_null: 4 rules

Brute Force T1110, Password Spraying T1110.003, Credential Stuffing T1110.004, Adversary-in-the-Middle T1557, Data Destruction T1485, External Remote Services T1133

Sample rules:

PermissionGrant 1 value contains: rolemanagement.readwrite.directory (4 rules)

contains: rolemanagement.readwrite.directory 4 rules

Account Manipulation T1098, Additional Cloud Roles T1098.003, Valid Accounts T1078, Cloud Accounts T1078.004

Sample rules:

QueryExecutionStatus 1 value eq: success (4 rules)

eq: success 4 rules

Sample rules:

RecipientEmailAddress 1 value is_not_null: (4 rules)

is_not_null: 4 rules

Sample rules:

SenderFromAddress 1 value is_not_null: (4 rules)

is_not_null: 4 rules

Steal or Forge Kerberos Tickets T1558, Exploitation for Privilege Escalation T1068, AS-REP Roasting T1558.004

Sample rules:

ServiceSid 1 value ends_with: -502 (4 rules)

ends_with: -502 4 rules

Sample rules:

Target.process.name 1 value eq: lsass.exe (4 rules)

eq: lsass.exe 4 rules

Sample rules:

TpmActivated 1 value ne: true (4 rules)

ne: true 4 rules

Remote Services T1021, Remote Desktop Protocol T1021.001, Credentials from Password Stores T1555, Windows Credential Manager T1555.004, Forge Web Credentials T1606

Sample rules:

TpmEnabled 1 value ne: true (4 rules)

ne: true 4 rules

Remote Services T1021, Remote Desktop Protocol T1021.001, Credentials from Password Stores T1555, Windows Credential Manager T1555.004, Forge Web Credentials T1606

Sample rules:

TpmSupported 1 value ne: true (4 rules)

ne: true 4 rules

Remote Services T1021, Remote Desktop Protocol T1021.001, Credentials from Password Stores T1555, Windows Credential Manager T1555.004, Forge Web Credentials T1606

Sample rules:

WorkstationName 1 value eq: * (4 rules)

eq: * 4 rules

Modify Cloud Compute Infrastructure T1578, Delete Cloud Instance T1578.003, Steal Application Access Token T1528, Use Alternate Authentication Material T1550

Sample rules:

_ResourceId 1 value contains: adfederationservice (4 rules)

contains: adfederationservice 4 rules

Sample rules:

actionResult 1 value eq: SUCCEEDED (4 rules)

eq: SUCCEEDED 4 rules

Sample rules:

alertState 1 value eq: ALERTING (4 rules)

eq: ALERTING 4 rules

Sample rules:

azure.activitylogs.identity.claims_initiated_by_user.name 1 value is_not_null: (4 rules)

is_not_null: 4 rules

Data Destruction T1485, Inhibit System Recovery T1490, Service Stop T1489

Sample rules:

azure.signinlogs.properties.token_protection_status_details.sign_in_session_status 1 value eq: unbound (4 rules)

eq: unbound 4 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Use Alternate Authentication Material T1550, Application Access Token T1550.001, Account Manipulation T1098, Device Registration T1098.005

Sample rules:

description 1 value starts_with: Recorded Future - Threat Hunt (4 rules)

starts_with: Recorded Future - Threat Hunt 4 rules

Dynamic Resolution T1568, Phishing T1566, Command and Scripting Interpreter T1059, Drive-by Compromise T1189, Compromise Host Software Binary T1554, Exfiltration Over C2 Channel T1041

Sample rules:

direction 1 value eq: inbound (4 rules)

eq: inbound 4 rules

Sample rules:

displayName_ 1 value eq: role.displayname (4 rules)

eq: role.displayname 4 rules

Valid Accounts T1078, Account Manipulation T1098, Additional Cloud Credentials T1098.001, Account Access Removal T1531, Cloud Accounts T1078.004

Sample rules:

distinct_ip_count 1 value gt: 1 (4 rules)

gt: 1 4 rules

Browser Session Hijacking T1185, Unused/Unsupported Cloud Regions T1535, Compromise Accounts T1586

Sample rules:

event.name 1 value eq: login_failure (4 rules)

eq: login_failure 4 rules

Compromise Accounts T1586, Cloud Accounts T1586.003, Valid Accounts T1078, Cloud Accounts T1078.004, Multi-Factor Authentication Request Generation T1621, Brute Force T1110

Sample rules:

event0.file.path 1 value starts_with: process.working_directory (4 rules)

starts_with: process.working_directory 4 rules

Sample rules:

github.category 1 value eq: protected_branch (4 rules)

eq: protected_branch 4 rules

Automated Exfiltration T1020, Data Destruction T1485, Data Manipulation T1565, Stored Data Manipulation T1565.001, Exfiltration Over Web Service T1567, Exfiltration to Code Repository T1567.001

Sample rules:

graph.entity.file.prevalence.day_count 1 value eq: 10 (4 rules)

eq: 10 4 rules

Sample rules:

is_anomalous 1 value eq: true (4 rules)

eq: true 4 rules

Sample rules:

isprvilegedadrole 1 value eq: true (4 rules)

eq: true 4 rules

Account Manipulation T1098, Additional Cloud Roles T1098.003

Sample rules:

kubernetes.audit.requestURI 1 value contains: command= (4 rules)

contains: command= 4 rules

Container Administration Command T1609, Unsecured Credentials T1552, Cloud Instance Metadata API T1552.005, Credentials In Files T1552.001, Container API T1552.007, Ingress Tool Transfer T1105

Sample rules:

m365::UserId 1 value is_not_null: (4 rules)

is_not_null: 4 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Steal Application Access Token T1528, Phishing T1566, Spearphishing Link T1566.002, Use Alternate Authentication Material T1550

Sample rules:

match1 1 value ge: 0 (4 rules)

ge: 0 4 rules

Email Collection T1114, Email Forwarding Rule T1114.003

Sample rules:

match2 1 value ge: 0 (4 rules)

ge: 0 4 rules

Email Collection T1114, Email Forwarding Rule T1114.003

Sample rules:

process.Ext.api.parameters.hook_module 1 value eq: null (4 rules)

eq: null 4 rules

Sample rules:

process.Ext.api.parameters.usage 1 value eq: KEYBOARD (4 rules)

eq: KEYBOARD 4 rules

Sample rules:

process.Ext.session_info.logon_type 1 value eq: Network (4 rules)

eq: Network 4 rules

Sample rules:

process.code_signature.signing_id 1 value regex_match: [A-Za-z0-9\_\s]{2,}\-[a-z0-9]{40} (4 rules)

regex_match: [A-Za-z0-9\_\s]{2,}\-[a-z0-9]{40} 4 rules

Command and Scripting Interpreter T1059, Unix Shell T1059.004, Credentials from Password Stores T1555, Keychain T1555.001

Sample rules:

process.thread.Ext.call_stack_contains_unbacked 1 value eq: true (4 rules)

eq: true 4 rules

Sample rules:

properties.statusCode 1 value eq: created (4 rules)

eq: created 4 rules

Sample rules:

protoPayload.response.error 1 value is_null: (4 rules)

is_null: 4 rules

Abuse Elevation Control Mechanism T1548

Sample rules:

service.additionalInfo.sample 1 value is_null: (4 rules)

is_null: 4 rules

Sample rules:

short_lived 1 value eq: true (4 rules)

eq: true 4 rules

Rogue Domain Controller T1207, Valid Accounts T1078, Domain Accounts T1078.002, Account Manipulation T1098

Sample rules:

strings.contains 1 value func_call: strings.contains(body.current_thread.text) (4 rules)

func_call: strings.contains(body.current_thread.text) 4 rules

Sample rules:

unique_apps 1 value gt: 3 (4 rules)

gt: 3 4 rules

Create Account T1136, Cloud Account T1136.003

Sample rules:

ClientProcessId 1 value eq: 0 (3 rules)

eq: 0 3 rules, 2 vendors

Create or Modify System Process T1543, Remote Services T1021, Scheduled Task/Job T1053, Scheduled Task T1053.005, Windows Service T1543.003

Sample rules:

egress 1 value eq: false (3 rules)

eq: false 3 rules, 2 vendors

Disable or Modify System Firewall T1686, Cloud Firewall T1686.001, Disable or Modify Tools T1562, Cloud Firewall T1562.007

Sample rules:

okta::client.ipAddress 1 value is_not_null: (3 rules)

is_not_null: 3 rules, 2 vendors

Account Manipulation T1098, Device Registration T1098.005, Phishing T1566, Spearphishing Link T1566.002

Sample rules:

properties.authenticationRequirement 1 value eq: singlefactorauthentication (3 rules)

eq: singlefactorauthentication 3 rules, 2 vendors

Valid Accounts T1078, Cloud Accounts T1078.004, Compromise Accounts T1586, Cloud Accounts T1586.003

Sample rules:

requestParameters.egress 1 value eq: false (3 rules)

eq: false 3 rules, 2 vendors

Disable or Modify System Firewall T1686, Cloud Firewall T1686.001

Sample rules:

AccountObjectId 1 value is_not_null: (3 rules)

is_not_null: 3 rules

Valid Accounts T1078, Data Destruction T1485, Brute Force T1110

Sample rules:

Authentication_Package 1 value eq: ntlm (3 rules)

eq: ntlm 3 rules

Use Alternate Authentication Material T1550, Pass the Hash T1550.002, OS Credential Dumping T1003, Security Account Manager T1003.002, Adversary-in-the-Middle T1557, Name Resolution Poisoning and SMB Relay T1557.001

Sample rules:

Authorization 1 value contains: virtualmachines (3 rules)

contains: virtualmachines 3 rules

Lateral Tool Transfer T1570, Exploitation for Credential Access T1212, Command and Scripting Interpreter T1059, PowerShell T1059.001

Sample rules:

BeaconPercent 1 value gt: 80 (3 rules)

gt: 80 3 rules

Application Layer Protocol T1071, Non-Standard Port T1571

Sample rules:

Count 1 value gt: 5000 (3 rules)

gt: 5000 3 rules

Endpoint Denial of Service T1499

Sample rules:

DbAction 1 value eq: connect (3 rules)

eq: connect 3 rules

Sample rules:

DestinationIp 1 value is_not_null: (3 rules)

is_not_null: 3 rules

Forced Authentication T1187, Adversary-in-the-Middle T1557, Name Resolution Poisoning and SMB Relay T1557.001

Sample rules:

DeviceAction 1 value ne: Block (3 rules)

ne: Block 3 rules

Application Layer Protocol T1071, Valid Accounts T1078

Sample rules:

ERROR_MESSAGE 1 value ne: OVERFLOW_FAILURE_EVENTS_ELIDED (3 rules)

ne: OVERFLOW_FAILURE_EVENTS_ELIDED 3 rules

Sample rules:

EntityIp 1 value is_not_null: (3 rules)

is_not_null: 3 rules

Valid Accounts T1078, Native API T1106, Cloud Service Discovery T1526, Brute Force T1110

Sample rules:

Esql.distinct_count_dst_ip 1 value le: 2 (3 rules)

le: 2 3 rules

Sample rules:

Esql.distinct_count_src_ip 1 value le: 2 (3 rules)

le: 2 3 rules

Sample rules:

Esql.event_action_count_distinct 1 value gt: 5 (3 rules)

gt: 5 3 rules

Sample rules:

Esql.rule_risk_score_distinct_count 1 value ge: 2 (3 rules)

ge: 2 3 rules

Sample rules:

Esql.source_ip_count_distinct 1 value ge: 2 (3 rules)

ge: 2 3 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Steal Application Access Token T1528, Phishing T1566, Spearphishing Link T1566.002, Use Alternate Authentication Material T1550

Sample rules:

FileHash 1 value is_not_null: (3 rules)

is_not_null: 3 rules

Steal Application Access Token T1528, Use Alternate Authentication Material T1550

Sample rules:

GrantConsentType 1 value ne: AllPrincipals (3 rules)

ne: AllPrincipals 3 rules

Sample rules:

HTTP_Status_Code 1 value eq: 200 (3 rules)

eq: 200 3 rules

Sample rules:

Hashes[0] 1 value eq: sha256 (3 rules)

eq: sha256 3 rules

Application Layer Protocol T1071, OS Credential Dumping T1003, Exploitation for Client Execution T1203

Sample rules:

HomeTenantId 1 value cross_field_compare: ResourceTenantId (3 rules)

cross_field_compare: ResourceTenantId 3 rules

Forge Web Credentials T1606, Cloud Administration Command T1651, Trusted Relationship T1199

Sample rules:

HostCount 1 value gt: 0 (3 rules)

gt: 0 3 rules

Sample rules:

HostName 1 value eq: runc init (3 rules)

eq: runc init 3 rules

Sample rules:

ImageId 1 value eq: EXAMPLE-AMI-ID (3 rules)

eq: EXAMPLE-AMI-ID 3 rules

Sample rules:

InitiatingProcessSHA1 1 value is_not_null: (3 rules)

is_not_null: 3 rules

Native API T1106, Command and Scripting Interpreter T1059, PowerShell T1059.001, Process Injection T1055, Portable Executable Injection T1055.002, OS Credential Dumping T1003

Sample rules:

InitiatingProcessSHA256 1 value eq: sha256hashes (3 rules)

eq: sha256hashes 3 rules

Application Layer Protocol T1071, OS Credential Dumping T1003, Event Triggered Execution T1546

Sample rules:

IsErrorAnomalyOnStatement 1 value eq: true (3 rules)

eq: true 3 rules

Sample rules:

KmsKeyId 1 value is_null: (3 rules)

is_null: 3 rules

Sample rules:

Muted 1 value eq: false (3 rules)

eq: false 3 rules

Sample rules:

NodeLabel 1 value eq: device (3 rules)

eq: device 3 rules

Remote Services T1021, Remote Desktop Protocol T1021.001, Credentials from Password Stores T1555, Windows Credential Manager T1555.004, Forge Web Credentials T1606

Sample rules:

NumOfCountries 1 value ge: 2 (3 rules)

ge: 2 3 rules

Transfer Data to Cloud Account T1537, Data Encrypted for Impact T1486

Sample rules:

Principal 1 value eq: * (3 rules)

eq: * 3 rules

Sample rules:

SourceIPAddress 1 value is_not_null: (3 rules)

is_not_null: 3 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Brute Force T1110

Sample rules:

SubType 1 value eq: lookupquery (3 rules)

eq: lookupquery 3 rules

Sample rules:

Target.process.Ext.token.integrity_level_name 1 value ne: low (3 rules)

ne: low 3 rules

Sample rules:

TargetName 1 value contains: microsoft_windows_shell_zipfolder:filename (3 rules)

contains: microsoft_windows_shell_zipfolder:filename 3 rules

Obfuscated Files or Information T1027, Masquerading T1036, Ingress Tool Transfer T1105, Phishing T1566, Spearphishing Attachment T1566.001

Sample rules:

TargetResources_0_modifiedProperties 1 value is_not_null: (3 rules)

is_not_null: 3 rules

Sample rules:

ThreatLevel_Score 1 value ge: 80 (3 rules)

ge: 80 3 rules

Sample rules:

Threshold 1 value ge: 1 (3 rules)

ge: 1 3 rules

Sample rules:

TimeDelta 1 value ge: 0 (3 rules)

ge: 0 3 rules

Valid Accounts T1078, Account Manipulation T1098

Sample rules:

TrafficType 1 value eq: internet (3 rules)

eq: internet 3 rules

Sample rules:

UrlDomain 1 value is_not_null: (3 rules)

is_not_null: 3 rules

Serverless Execution T1648

Sample rules:

XCsApp 1 value is_not_null: (3 rules)

is_not_null: 3 rules

Sample rules:

action.name 1 value eq: admin_login (3 rules)

eq: admin_login 3 rules

Sample rules:

admin_email 1 value is_not_null: (3 rules)

is_not_null: 3 rules

Valid Accounts T1078, Credentials from Password Stores T1555, Account Manipulation T1098, Modify Authentication Process T1556, Data from Information Repositories T1213

Sample rules:

agent.id 1 value is_not_null: (3 rules)

is_not_null: 3 rules

Sample rules:

aws::userIdentity.invokedBy 1 value is_null: (3 rules)

is_null: 3 rules

Sample rules:

azure.activitylogs.identity.authorization.evidence.principal_id 1 value is_not_null: (3 rules)

is_not_null: 3 rules

Cloud Administration Command T1651

Sample rules:

azure.graphactivitylogs.properties.c_idtyp 1 value eq: user (3 rules)

eq: user 3 rules

Sample rules:

azure.graphactivitylogs.properties.client_auth_method 1 value eq: 0 (3 rules)

eq: 0 3 rules

Sample rules:

cities_count 1 value gt: 1 (3 rules)

gt: 1 3 rules

Sample rules:

client.ip 1 value is_not_null: (3 rules)

is_not_null: 3 rules

Sample rules:

cmd 1 value is_not_null: (3 rules)

is_not_null: 3 rules

Command and Scripting Interpreter T1059, PowerShell T1059.001, Ingress Tool Transfer T1105

Sample rules:

coalesce 1 value func_call: coalesce(headers.auth_summary.dmarc.pass) (3 rules)

func_call: coalesce(headers.auth_summary.dmarc.pass) 3 rules

Sample rules:

csUserAgent 1 value is_not_null: (3 rules)

is_not_null: 3 rules

Application Layer Protocol T1071, Drive-by Compromise T1189, Exploitation for Client Execution T1203

Sample rules:

dest_domain 1 value eq: internal_test_email.com (3 rules)

eq: internal_test_email.com 3 rules

Phishing T1566, Spearphishing Attachment T1566.001

Sample rules:

dll.Ext.load_index 1 value ge: 2 (3 rules)

ge: 2 3 rules

Sample rules:

event.origin 1 value eq: ADMIN_CONSOLE (3 rules)

eq: ADMIN_CONSOLE 3 rules

Sample rules:

filter(attachments, .file_extension == 'eml' or .content_type == 'message/rfc822') 1 value length_compare: 1 (3 rules)

length_compare: 1 3 rules

Sample rules:

filter(flatten([recipients.to, recipients.cc, recipients.bcc]), .email.domain.root_domain in $org_domains) 1 value length_compare: 1 (3 rules)

length_compare: 1 3 rules

Sample rules:

filter(ml.nlu_classifier(body.current_thread.text).entities, .name == 'urgency') 1 value length_compare: 2 (3 rules)

length_compare: 2 3 rules

Sample rules:

gen_ai.compliance.violation_detected 1 value eq: true (3 rules)

eq: true 3 rules

Sample rules:

github.actor_ip 1 value is_not_null: (3 rules)

is_not_null: 3 rules

Sample rules:

github.repo 1 value is_not_null: (3 rules)

is_not_null: 3 rules

Sample rules:

graph.entity.domain.prevalence.day_count 1 value eq: 10 (3 rules)

eq: 10 3 rules

Sample rules:

graph.relations.entity_type 1 value eq: IP_ADDRESS (3 rules)

eq: IP_ADDRESS 3 rules

Sample rules:

host.ip 1 value is_not_null: (3 rules)

is_not_null: 3 rules

Sample rules:

host_count_d 1 value gt: 0 (3 rules)

gt: 0 3 rules

Sample rules:

imNWS_mintime 1 value cross_field_compare: ExpirationDateTime (3 rules)

cross_field_compare: ExpirationDateTime 3 rules

Sample rules:

islibrary 1 value eq: true (3 rules)

eq: true 3 rules

Use Alternate Authentication Material T1550, Application Access Token T1550.001

Sample rules:

keyUsage 1 value eq: verify (3 rules)

eq: verify 3 rules

Sample rules:

kubernetes.audit.level 1 value eq: requestresponse (3 rules)

eq: requestresponse 3 rules

Account Manipulation T1098, Additional Container Cluster Roles T1098.006

Sample rules:

kubernetes.audit.objectRef.namespace 1 value eq: kube-system (3 rules)

eq: kube-system 3 rules

Data Manipulation T1565, Stored Data Manipulation T1565.001, Account Manipulation T1098, Additional Container Cluster Roles T1098.006, Valid Accounts T1078, Default Accounts T1078.001

Sample rules:

length 1 value func_call:

length(filter(body.links, .display_text is null and .display_url.url == sender.email.domain.root_domain or .href_url.domain.domain == 'aka.ms' or network.whois(.display_url.domain).days_old < 30)) == length(body.links)

(3 rules)

func_call:

length(filter(body.links, .display_text is null and .display_url.url == sender.email.domain.root_domain or .href_url.domain.domain == 'aka.ms' or network.whois(.display_url.domain).days_old < 30)) == length(body.links)

3 rules

Sample rules:

match3 1 value ge: 0 (3 rules)

ge: 0 3 rules

Email Collection T1114, Email Forwarding Rule T1114.003

Sample rules:

ml.logo_detect(file.message_screenshot()).brands 1 value length_compare: 1 (3 rules)

length_compare: 1 3 rules

Sample rules:

ml.nlu_classifier(body.current_thread.text).topics 1 value length_compare: 1 (3 rules)

length_compare: 1 3 rules

Sample rules:

network.type 1 value eq: ipv4 (3 rules)

eq: ipv4 3 rules

Command and Scripting Interpreter T1059, Visual Basic T1059.005, JavaScript T1059.007, Ingress Tool Transfer T1105

Sample rules:

outcome:result 1 value eq: success (3 rules)

eq: success 3 rules

Sample rules:

parameters.message_info.is_spam 1 value eq: true (3 rules)

eq: true 3 rules

Malicious File T1204.002, Spearphishing Attachment T1566.001, Malicious Link T1204.001, Spearphishing Link T1566.002, Phishing T1566, Phishing for Information T1598

Sample rules:

principal.ip_geo_artifact.location.country_or_region 1 value is_not_null: (3 rules)

is_not_null: 3 rules

Disable or Modify Tools T1562

Sample rules:

process.Ext.ancestry 1 value is_not_null: (3 rules)

is_not_null: 3 rules

Sample rules:

process.Ext.api.parameters.flags 1 value contains: INPUTSINK (3 rules)

contains: INPUTSINK 3 rules

Sample rules:

prompt_text 1 value is_not_null: (3 rules)

is_not_null: 3 rules

Sample rules:

properties.metricResponseType 1 value eq: Success (3 rules)

eq: Success 3 rules

Sample rules:

referrer 1 value is_null: (3 rules)

is_null: 3 rules

Sample rules:

rule.name 1 value is_not_null: (3 rules)

is_not_null: 3 rules

Sample rules:

sender.email.domain.valid 1 value eq: false (3 rules)

eq: false 3 rules

Sample rules:

server.ip 1 value is_not_null: (3 rules)

is_not_null: 3 rules

Sample rules:

source.geo.country_name 1 value is_not_null: (3 rules)

is_not_null: 3 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Steal Application Access Token T1528, Adversary-in-the-Middle T1557

Sample rules:

source.geo.region_name 1 value is_not_null: (3 rules)

is_not_null: 3 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Steal Application Access Token T1528, Adversary-in-the-Middle T1557

Sample rules:

source_type 1 value eq: account_setting (3 rules)

eq: account_setting 3 rules

Sample rules:

status.value 1 value eq: succeeded (3 rules)

eq: succeeded 3 rules

Create Account T1136, Cloud Account T1136.003, Valid Accounts T1078, Cloud Accounts T1078.004

Sample rules:

success 1 value eq: true (3 rules)

eq: true 3 rules

Sample rules:

target.resource.attribute.labels["TABNAME"] 1 value eq: AGR_USERS (3 rules)

eq: AGR_USERS 3 rules

Sample rules:

target.resource.attribute.labels["ser_binding_deltas_action"] 1 value eq: ADD (3 rules)

eq: ADD 3 rules

Sample rules:

triaged 1 value ne: True (3 rules)

ne: True 3 rules

Sample rules:

unique_users 1 value gt: 5 (3 rules)

gt: 5 3 rules

Valid Accounts T1078, Account Manipulation T1098

Sample rules:

user.groups{} 1 value eq: system:unauthenticated (3 rules)

eq: system:unauthenticated 3 rules

Sample rules:

user_arn 1 value is_not_null: (3 rules)

is_not_null: 3 rules

Sample rules:

user_count_d 1 value gt: 0 (3 rules)

gt: 0 3 rules

Sample rules:

user_type 1 value eq: iamuser (3 rules)

eq: iamuser 3 rules

Data Destruction T1485, Lifecycle-Triggered Deletion T1485.001, Disable or Modify Tools T1685, Disable or Modify Cloud Log T1685.002, User Execution T1204

Sample rules:

ut_shannon 1 value gt: 3 (3 rules)

gt: 3 3 rules

Scheduled Task/Job T1053, Scheduled Task T1053.005, Create or Modify System Process T1543, Windows Service T1543.003

Sample rules:

Flags 1 value eq: 8388608 (2 rules)

eq: 8388608 2 rules, 2 vendors

User Execution T1204, Malicious File T1204.002, Subvert Trust Controls T1553, Mark-of-the-Web Bypass T1553.005

Sample rules:

HasFullTrust 1 value eq: true (2 rules)

eq: true 2 rules, 2 vendors

User Execution T1204, Malicious File T1204.002, Subvert Trust Controls T1553, Mark-of-the-Web Bypass T1553.005

Sample rules:

SubCategory 1 value in: user account management (2 rules)

in: user account management 2 rules, 2 vendors

Indicator Removal T1070, Clear Windows Event Logs T1070.001, Disable or Modify Tools T1562, Disable or Modify Windows Event Log T1562.002, Disable or Modify Tools T1562.006, User Execution T1204

Sample rules:

aclProtocol 1 value eq: -1 (2 rules)

eq: -1 2 rules, 2 vendors

Disable or Modify System Firewall T1686, Cloud Firewall T1686.001, Disable or Modify Tools T1562, Cloud Firewall T1562.007

Sample rules:

aws::sourceIPAddress 1 value is_not_null: (2 rules)

is_not_null: 2 rules, 2 vendors

Valid Accounts T1078, Cloud Accounts T1078.004, Steal Application Access Token T1528, Use Alternate Authentication Material T1550, Application Access Token T1550.001, Phishing T1566

Sample rules:

blocked 1 value eq: false (2 rules)

eq: false 2 rules, 2 vendors

Sample rules:

comment 1 value is_not_null: (2 rules)

is_not_null: 2 rules, 2 vendors

Sample rules:

data.details.response.body.password_reset_policy 1 value eq: off (2 rules)

eq: off 2 rules, 2 vendors

Sample rules:

data.details.response.body.passwordless_policy 1 value eq: off (2 rules)

eq: off 2 rules, 2 vendors

Sample rules:

data.details.response.body.policy 1 value eq: off (2 rules)

eq: off 2 rules, 2 vendors

Sample rules:

m365::Directionality 1 value eq: inbound (2 rules)

eq: inbound 2 rules, 2 vendors

Phishing T1566, Spearphishing Attachment T1566.001, Spearphishing Link T1566.002

Sample rules:

nametype 1 value eq: create (2 rules)

eq: create 2 rules, 2 vendors

Create or Modify System Process T1543, Systemd Service T1543.002, Abuse Elevation Control Mechanism T1548, Sudo and Sudo Caching T1548.003

Sample rules:

old 1 value is_not_null: (2 rules)

is_not_null: 2 rules, 2 vendors

Sample rules:

outcome.reason 1 value eq: fastpass declined phishing attempt (2 rules)

eq: fastpass declined phishing attempt 2 rules, 2 vendors

Phishing T1566, Valid Accounts T1078, Default Accounts T1078.001, Modify Authentication Process T1556

Sample rules:

param2 1 value eq: stopped (2 rules)

eq: stopped 2 rules, 2 vendors

Disable or Modify Tools T1685, Inhibit System Recovery T1490

Sample rules:

parent_process_id 1 value eq: 0 (2 rules)

eq: 0 2 rules, 2 vendors

Create or Modify System Process T1543, Windows Service T1543.003

Sample rules:

properties.authenticationProtocol 1 value eq: devicecode (2 rules)

eq: devicecode 2 rules, 2 vendors

Phishing T1566, Spearphishing Link T1566.002, Steal Application Access Token T1528, Valid Accounts T1078, Cloud Accounts T1078.004, Use Alternate Authentication Material T1550

Sample rules:

query 1 value eq: api.telegram.org (2 rules)

eq: api.telegram.org 2 rules, 2 vendors

Application Layer Protocol T1071, DNS T1071.004, Web Service T1102, Bidirectional Communication T1102.002

Sample rules:

requestObject.spec.tls 1 value is_null: (2 rules)

is_null: 2 rules, 2 vendors

Network Sniffing T1040, Private Keys T1552.004

Sample rules:

requestParameters.ruleAction 1 value eq: allow (2 rules)

eq: allow 2 rules, 2 vendors

Disable or Modify System Firewall T1686, Cloud Firewall T1686.001

Sample rules:

ruleAction 1 value eq: allow (2 rules)

eq: allow 2 rules, 2 vendors

Disable or Modify System Firewall T1686, Cloud Firewall T1686.001, Disable or Modify Tools T1562, Cloud Firewall T1562.007

Sample rules:

AIPCall 1 value contains: name (2 rules)

contains: name 2 rules

Command and Scripting Interpreter T1059, Permission Groups Discovery T1069, Valid Accounts T1078, Boot or Logon Autostart Execution T1547, Abuse Elevation Control Mechanism T1548, Unsecured Credentials T1552

Sample rules:

AccountDisplayName 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Valid Accounts T1078, Service Stop T1489

Sample rules:

ActionUncommonlyPerformedByUser 1 value eq: True (2 rules)

eq: True 2 rules

Exploitation for Credential Access T1212, Lateral Tool Transfer T1570

Sample rules:

AddedGlobalAdminTime 1 value cross_field_compare: RemovedGlobalAdminTime (2 rules)

cross_field_compare: RemovedGlobalAdminTime 2 rules

Account Access Removal T1531

Sample rules:

AddedUrls 1 value gt: 0 (2 rules)

gt: 0 2 rules

Sample rules:

AlertSeverity 1 value eq: High (2 rules)

eq: High 2 rules

Compromise Host Software Binary T1554

Sample rules:

AlertTimeSrcIpDenyRateCount 1 value cross_field_compare: LearningThreshold (2 rules)

cross_field_compare: LearningThreshold 2 rules

Sample rules:

All_Changes.object_category 1 value eq: user (2 rules)

eq: user 2 rules

Modify Authentication Process T1556, Multi-Factor Authentication T1556.006, Brute Force T1110

Sample rules:

All_Changes.result 1 value contains: lock (2 rules)

contains: lock 2 rules

Sample rules:

All_Changes.result_id 1 value eq: 4720 (2 rules)

eq: 4720 2 rules

Create Account T1136, Local Account T1136.001, Valid Accounts T1078, Local Accounts T1078.003

Sample rules:

All_Email.file_name 1 value eq: * (2 rules)

eq: * 2 rules

Sample rules:

AppDisplayName 1 value eq: Azure Portal (2 rules)

eq: Azure Portal 2 rules

Brute Force T1110, Password Spraying T1110.003, Credential Stuffing T1110.004, Adversary-in-the-Middle T1557, External Remote Services T1133, Modify Authentication Process T1556

Sample rules:

AuthenticationMechanism 1 value starts_with: PAT (2 rules)

starts_with: PAT 2 rules

Sample rules:

AutoScalingDescriptions 1 value is_null: (2 rules)

is_null: 2 rules

Sample rules:

BillingModeSummary 1 value is_null: (2 rules)

is_null: 2 rules

Sample rules:

BuildProcessTime 1 value cross_field_compare: FileEditTime (2 rules)

cross_field_compare: FileEditTime 2 rules

Sample rules:

CIp 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

ClientAppId 1 value eq: * (2 rules)

eq: * 2 rules

Email Collection T1114, Remote Email Collection T1114.002

Sample rules:

CommunicationDirection 1 value is_null: (2 rules)

is_null: 2 rules

Sample rules:

ComplianceStandard 1 value eq: NIST-SP-800-171-R2 (2 rules)

eq: NIST-SP-800-171-R2 2 rules

Sample rules:

ContextInfo 1 value contains: system.net.webclient (2 rules)

contains: system.net.webclient 2 rules

Command and Scripting Interpreter T1059, PowerShell T1059.001

Sample rules:

CsBytes 1 value gt: 0 (2 rules)

gt: 0 2 rules

Sample rules:

CurrentAccountNum 1 value cross_field_compare: OldAccountNum (2 rules)

cross_field_compare: OldAccountNum 2 rules

Sample rules:

CurrentMaxCount 1 value cross_field_compare: PrevMaxCount (2 rules)

cross_field_compare: PrevMaxCount 2 rules

Sample rules:

DAVISRiskLevel 1 value eq: CRITICAL (2 rules)

eq: CRITICAL 2 rules

Sample rules:

DNS.message_type 1 value eq: query (2 rules)

eq: query 2 rules

Data Destruction T1485

Sample rules:

DataverseActivity_TimeGenerated 1 value cross_field_compare: ExpirationDateTime (2 rules)

cross_field_compare: ExpirationDateTime 2 rules

Valid Accounts T0859, Remote Services T0886, Remote Services T1021, Valid Accounts T1078, External Remote Services T1133, Trusted Relationship T1199

Sample rules:

DeletedUsers 1 value gt: 10 (2 rules)

gt: 10 2 rules

Sample rules:

DestinationDnsDomain 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

DestinationMailAddress 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

DetectionCount 1 value ge: 1 (2 rules)

ge: 1 2 rules

Sample rules:

Deviation 1 value gt: 25 (2 rules)

gt: 25 2 rules

Data Transfer Size Limits T1030

Sample rules:

DeviceCustomString3 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

DistinctUserCount 1 value gt: 1 (2 rules)

gt: 1 2 rules

Sample rules:

DnsResponseName 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Cloud Infrastructure Discovery T1580, Cloud Service Discovery T1526

Sample rules:

DstGeoCountry 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

DstUserUpn 1 value eq: 1 (2 rules)

eq: 1 2 rules

Sample rules:

DvcId 1 value is_not_null: (2 rules)

is_not_null: 2 rules

OS Credential Dumping T1003, System Services T1569

Sample rules:

ElevatedToken 1 value eq: Logon (2 rules)

eq: Logon 2 rules

Brute Force T1110, Valid Accounts T1078

Sample rules:

EmailFrom 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

EmailUrlInfo_TimeGenerated 1 value cross_field_compare: ExpirationDateTime (2 rules)

cross_field_compare: ExpirationDateTime 2 rules

Phishing T1566, Application Layer Protocol T1071

Sample rules:

EnabledPrivilegeList 1 value eq: SeDebugPrivilege (2 rules)

eq: SeDebugPrivilege 2 rules

Sample rules:

Encrypted 1 value is_null: (2 rules)

is_null: 2 rules

Sample rules:

EntityEmail 1 value regex_match: ^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+$ (2 rules)

regex_match: ^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+$ 2 rules

Sample rules:

Entitytype 1 value eq: account (2 rules)

eq: account 2 rules

Sample rules:

ErrorNumber 1 value eq: 50126 (2 rules)

eq: 50126 2 rules

Brute Force T1110, Password Spraying T1110.003, Credential Stuffing T1110.004, Compromise Accounts T1586, Cloud Accounts T1586.003

Sample rules:

Esql.brute_force_type 1 value ne: other (2 rules)

ne: other 2 rules

Brute Force T1110, Password Guessing T1110.001, Password Spraying T1110.003, Credential Stuffing T1110.004

Sample rules:

Esql.client_ip 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

Esql.cloud_region_count_distinct 1 value ge: 10 (2 rules)

ge: 10 2 rules

Sample rules:

Esql.count_distinct_host_id 1 value eq: 1 (2 rules)

eq: 1 2 rules

Remote Access Tools T1219, Remote Desktop Software T1219.002

Sample rules:

Esql.date_diff 1 value le: 10 (2 rules)

le: 10 2 rules

Sample rules:

Esql.distance_km 1 value ge: 500 (2 rules)

ge: 500 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Steal Application Access Token T1528, Adversary-in-the-Middle T1557

Sample rules:

Esql.event_code_distinct_count 1 value ge: 2 (2 rules)

ge: 2 2 rules

Sample rules:

Esql.kibana_alert_rule_name_distinct_count 1 value ge: 3 (2 rules)

ge: 3 2 rules

Sample rules:

Esql.kubernetes_audit_objectRef_resource_count_distinct 1 value gt: 3 (2 rules)

gt: 3 2 rules

Sample rules:

Esql.kubernetes_audit_requestURI_count_distinct 1 value gt: 5 (2 rules)

gt: 5 2 rules

Sample rules:

Esql.last_time_seen 1 value eq: esql.first_time_seen (2 rules)

eq: esql.first_time_seen 2 rules

Sample rules:

Esql.logon_count 1 value eq: 1 (2 rules)

eq: 1 2 rules

Sample rules:

Esql.max_logon 1 value ge: 1000 (2 rules)

ge: 1000 2 rules

Sample rules:

Esql.min_logon 1 value ge: 1 (2 rules)

ge: 1 2 rules

Sample rules:

Esql.rule_name_distinct_count 1 value ge: 2 (2 rules)

ge: 2 2 rules

Sample rules:

Esql.server_ip 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

Esql.source_ip 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

Esql.travel_kmh 1 value ge: 800 (2 rules)

ge: 800 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Steal Application Access Token T1528, Adversary-in-the-Middle T1557

Sample rules:

Esql.unique_host_count 1 value ge: 2 (2 rules)

ge: 2 2 rules

Sample rules:

Esql.unique_rules_count 1 value ge: 2 (2 rules)

ge: 2 2 rules

Sample rules:

Esql.unique_source_ips 1 value ge: 5 (2 rules)

ge: 5 2 rules

Brute Force T1110, Password Guessing T1110.001, Password Spraying T1110.003

Sample rules:

Event 1 value eq: account.settings_updated (2 rules)

eq: account.settings_updated 2 rules

Sample rules:

EventProduct 1 value eq: Filewall for Microsoft 365 (2 rules)

eq: Filewall for Microsoft 365 2 rules

Sample rules:

EventResultDetails_s 1 value eq: NXDOMAIN (2 rules)

eq: NXDOMAIN 2 rules

Fallback Channels T1008, Dynamic Resolution T1568

Sample rules:

Event_TimeGenerated 1 value cross_field_compare: ValidUntil (2 rules)

cross_field_compare: ValidUntil 2 rules

Sample rules:

FailedLogins 1 value gt: 10 (2 rules)

gt: 10 2 rules

Sample rules:

FailureCount 1 value ge: 10 (2 rules)

ge: 10 2 rules

Application Layer Protocol T1071, OS Credential Dumping T1003

Sample rules:

Finding 1 value eq: LargeDefaultGroupsPSRemote (2 rules)

eq: LargeDefaultGroupsPSRemote 2 rules

Sample rules:

FlowStatus_s 1 value eq: A (2 rules)

eq: A 2 rules

Sample rules:

Hashes[1] 1 value contains: sha256hashes (2 rules)

contains: sha256hashes 2 rules

Sample rules:

HttpUserAgent 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

ImageFolderPath 1 value cross_field_compare: ImageLoadedFolderPath (2 rules)

cross_field_compare: ImageLoadedFolderPath 2 rules

Hijack Execution Flow T1574, DLL T1574.001, Boot or Logon Autostart Execution T1547

Sample rules:

Imphash 1 value ne: 28a18f58924d2f4dd2bffbbc85a12952 (2 rules)

ne: 28a18f58924d2f4dd2bffbbc85a12952 2 rules

Sample rules:

Investigation Status 1 value eq: escalated (2 rules)

eq: escalated 2 rules

Sample rules:

IsCertificateValid 1 value ne: 1 (2 rules)

ne: 1 2 rules

Masquerading T1036, Invalid Code Signature T1036.001, Match Legitimate Resource Name or Location T1036.005, Scheduled Task/Job T1053, Scheduled Task T1053.005

Sample rules:

IsCorporate 1 value eq: true (2 rules)

eq: true 2 rules

Valid Accounts T1078, Credentials from Password Stores T1555

Sample rules:

IsHighValueEvent 1 value eq: true (2 rules)

eq: true 2 rules

Sample rules:

IsVolumeAnomalyOnVal 1 value eq: true (2 rules)

eq: true 2 rules

Sample rules:

Key 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

LearningTimeBuckets 1 value gt: 5 (2 rules)

gt: 5 2 rules

Sample rules:

LearningTimeProtocol 1 value cross_field_compare: AlertTimeProtocol (2 rules)

cross_field_compare: AlertTimeProtocol 2 rules

Sample rules:

Level 1 value eq: 2 (2 rules)

eq: 2 2 rules

Sample rules:

LinksClicked 1 value gt: 0 (2 rules)

gt: 0 2 rules

Sample rules:

Log_Type 1 value eq: firewall (2 rules)

eq: firewall 2 rules

Sample rules:

LoginIsSuccess 1 value eq: no (2 rules)

eq: no 2 rules

Sample rules:

LoginResult 1 value ne: failure (2 rules)

ne: failure 2 rules

Sample rules:

LoginStatus 1 value ne: LOGIN_NO_ERROR (2 rules)

ne: LOGIN_NO_ERROR 2 rules

Sample rules:

MFAUsed 1 value ne: yes (2 rules)

ne: yes 2 rules

Account Manipulation T1098, Credentials from Password Stores T1555

Sample rules:

Malware 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

MatchedPolicies 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

MitreTtp 1 value contains: knox.2 (2 rules)

contains: knox.2 2 rules

Sample rules:

MostFrequentTimeDeltaCount 1 value gt: 25 (2 rules)

gt: 25 2 rules

Sample rules:

NetworkPackets 1 value gt: 0 (2 rules)

gt: 0 2 rules

Sample rules:

NewDomainValue 1 value contains: federated (2 rules)

contains: federated 2 rules

Sample rules:

NewTemplateContent 1 value contains: ct_flag_enrollee_supplies_subject (2 rules)

contains: ct_flag_enrollee_supplies_subject 2 rules

Sample rules:

NoofAdminsRemoved 1 value gt: 1 (2 rules)

gt: 1 2 rules

Account Access Removal T1531

Sample rules:

PA_Url 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

PermissionGrant_TimeGenerated 1 value cross_field_compare: RoleAssignment_TimeGenerated (2 rules)

cross_field_compare: RoleAssignment_TimeGenerated 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Account Manipulation T1098, Additional Cloud Roles T1098.003

Sample rules:

PermissionType 1 value eq: ADMIN_WRITE (2 rules)

eq: ADMIN_WRITE 2 rules

Disable or Modify Tools T1562, Disable or Modify Tools T1562.001, Data Destruction T1485, Inhibit System Recovery T1490

Sample rules:

PolicyViolatedControlFeature 1 value eq: json (2 rules)

eq: json 2 rules

Sample rules:

PreAuthType 1 value eq: 0 (2 rules)

eq: 0 2 rules

Steal or Forge Kerberos Tickets T1558, AS-REP Roasting T1558.004

Sample rules:

PremodifiedInboundSettings 1 value cross_field_compare: ModifiedInboundSettings (2 rules)

cross_field_compare: ModifiedInboundSettings 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Account Discovery T1087, Cloud Account T1087.004, Create Account T1136, Cloud Account T1136.003

Sample rules:

PremodifiedOutboundSettings 1 value cross_field_compare: ModifiedOutboundSettings (2 rules)

cross_field_compare: ModifiedOutboundSettings 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Account Discovery T1087, Cloud Account T1087.004, Create Account T1136, Cloud Account T1136.003

Sample rules:

Principal_aws 1 value eq: * (2 rules)

eq: * 2 rules

Data Transfer Size Limits T1030

Sample rules:

PrivilegeLevel 1 value eq: 15 (2 rules)

eq: 15 2 rules

Sample rules:

ProofpointPOD_TimeGenerated 1 value cross_field_compare: ExpirationDateTime (2 rules)

cross_field_compare: ExpirationDateTime 2 rules

Sample rules:

Rank 1 value lt: 10 (2 rules)

lt: 10 2 rules

Sample rules:

RatingDifferance 1 value lt: 0 (2 rules)

lt: 0 2 rules

Sample rules:

RawData 1 value contains: download failed and temporary file (2 rules)

contains: download failed and temporary file 2 rules

Sample rules:

RecordType 1 value eq: sharepointfileoperation (2 rules)

eq: sharepointfileoperation 2 rules

Sample rules:

RemoteDeviceName 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Forced Authentication T1187, Adversary-in-the-Middle T1557, Name Resolution Poisoning and SMB Relay T1557.001

Sample rules:

RemoteDnsCanonicalNames 1 value contains: domains (2 rules)

contains: domains 2 rules

Application Layer Protocol T1071, Event Triggered Execution T1546

Sample rules:

ResourceId 1 value contains: adfederationservice (2 rules)

contains: adfederationservice 2 rules

Modify Cloud Compute Infrastructure T1578, Delete Cloud Instance T1578.003

Sample rules:

ResourceProvider 1 value eq: MICROSOFT.SQL (2 rules)

eq: MICROSOFT.SQL 2 rules

Sample rules:

Risk 1 value ge: 80 (2 rules)

ge: 80 2 rules

Sample rules:

RiskLevelAggregated 1 value eq: high (2 rules)

eq: high 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Domain Accounts T1078.002, Access Token Manipulation T1134, Multi-Factor Authentication Interception T1111, Adversary-in-the-Middle T1557

Sample rules:

RiskLevelDuringSignIn 1 value eq: high (2 rules)

eq: high 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Domain Accounts T1078.002, Access Token Manipulation T1134, Multi-Factor Authentication Interception T1111, Adversary-in-the-Middle T1557

Sample rules:

RiskState 1 value eq: atRisk (2 rules)

eq: atRisk 2 rules

Application Layer Protocol T1071, User Execution T1204

Sample rules:

RoleAssignment 1 value contains: admin (2 rules)

contains: admin 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Account Manipulation T1098, Additional Cloud Roles T1098.003

Sample rules:

SHA_Disposition 1 value eq: malware (2 rules)

eq: malware 2 rules

Sample rules:

SandboxScore_s 1 value ge: 50 (2 rules)

ge: 50 2 rules

Sample rules:

ScBytes 1 value gt: 0 (2 rules)

gt: 0 2 rules

Sample rules:

SecurityRiskName 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

ServiceAccount 1 value eq: LocalSystem (2 rules)

eq: LocalSystem 2 rules

Create or Modify System Process T1543, Windows Service T1543.003

Sample rules:

ServicePrincipalNames 1 value contains: gc/ (2 rules)

contains: gc/ 2 rules

Rogue Domain Controller T1207, Account Manipulation T1098

Sample rules:

ServiceType 1 value eq: kernel mode driver (2 rules)

eq: kernel mode driver 2 rules

Rootkit T1014, Exploitation for Privilege Escalation T1068, Create or Modify System Process T1543, Windows Service T1543.003

Sample rules:

SignalNumber 1 value eq: 9 (2 rules)

eq: 9 2 rules

Service Stop T1489, Disable or Modify Tools T1562, Disable or Modify Tools T1562.001

Sample rules:

Signer 1 value is_null: (2 rules)

is_null: 2 rules

System Binary Proxy Execution T1218, Control Panel T1218.002, Process Injection T1055, Portable Executable Injection T1055.002, Native API T1106

Sample rules:

Site 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

SourceSeverity 1 value eq: High (2 rules)

eq: High 2 rules

Phishing T1566, User Execution T1204

Sample rules:

SourceUserName 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

SrcIp 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

SrcUsername 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

SubStatus 1 value eq: 0xc0000064 (2 rules)

eq: 0xc0000064 2 rules

Sample rules:

SuccessCount 1 value ge: 1 (2 rules)

ge: 1 2 rules

Exfiltration Over Web Service T1567, Impair Defenses T1629, Exfiltration Over Alternative Protocol T1639

Sample rules:

Tactics 1 value contains: exfiltration (2 rules)

contains: exfiltration 2 rules

Sample rules:

Tags 1 value eq: mdr - customer escalation (2 rules)

eq: mdr - customer escalation 2 rules

Sample rules:

Target 1 value eq: vipusers (2 rules)

eq: vipusers 2 rules

Access Token Manipulation T1134, Make and Impersonate Token T1134.003, Create Process with Token T1134.002

Sample rules:

TargetServerName 1 value eq: localhost (2 rules)

eq: localhost 2 rules

Sample rules:

Target_User_Name 1 value ne: *$ (2 rules)

ne: *$ 2 rules

Steal or Forge Kerberos Tickets T1558

Sample rules:

TaskContent 1 value contains: rundll32 (2 rules)

contains: rundll32 2 rules

Scheduled Task/Job T1053, Scheduled Task T1053.005

Sample rules:

TemplateContent 1 value contains: ct_flag_enrollee_supplies_subject (2 rules)

contains: ct_flag_enrollee_supplies_subject 2 rules

Sample rules:

ThreadType 1 value eq: chat (2 rules)

eq: chat 2 rules

Phishing T1566, Spearphishing Link T1566.002

Sample rules:

TimeDeleted 1 value cross_field_compare: TimeAdded (2 rules)

cross_field_compare: TimeAdded 2 rules

Phishing T1566, Create Account T1136

Sample rules:

TimeDeltainSeconds 1 value gt: 25 (2 rules)

gt: 25 2 rules

Sample rules:

TotalErrorCount 1 value gt: 100 (2 rules)

gt: 100 2 rules

Sample rules:

TotalInboundScore 1 value ge: 15 (2 rules)

ge: 15 2 rules

Sample rules:

TotalSentBytesinMB 1 value gt: 10 (2 rules)

gt: 10 2 rules

Sample rules:

TransmittedServices 1 value contains: @ (2 rules)

contains: @ 2 rules

Sample rules:

UEBARiskScore 1 value gt: 3 (2 rules)

gt: 3 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Brute Force T1110

Sample rules:

UEBASourceIPLocation 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Exploitation for Credential Access T1212, Lateral Tool Transfer T1570

Sample rules:

Unresolved Priority 1 value eq: true (2 rules)

eq: true 2 rules

Sample rules:

UpdateAvailable 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

UrlCount 1 value gt: 0 (2 rules)

gt: 0 2 rules

Sample rules:

UserAccount 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Valid Accounts T1078, Service Stop T1489

Sample rules:

UserEmail 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

UserOriented 1 value eq: yes (2 rules)

eq: yes 2 rules

Sample rules:

VMOperation 1 value eq: insert (2 rules)

eq: insert 2 rules

Valid Accounts T1078, Native API T1106, Cloud Service Discovery T1526, Command and Scripting Interpreter T1059, Permission Groups Discovery T1069, Boot or Logon Autostart Execution T1547

Sample rules:

VirusName 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

WAFAction 1 value eq: allow (2 rules)

eq: allow 2 rules

Sample rules:

WAFRuleID 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

WAFRuleMessage 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

XCsAppTags 1 value contains: unsanctioned (2 rules)

contains: unsanctioned 2 rules

Sample rules:

XRsFileSize 1 value gt: 0 (2 rules)

gt: 0 2 rules

Sample rules:

about.labels["is_suspicious"] 1 value eq: true (2 rules)

eq: true 2 rules

Exfiltration Over Web Service T1567

Sample rules:

actor:type 1 value eq: user (2 rules)

eq: user 2 rules

Sample rules:

actor_user_id 1 value cross_field_compare: user_id (2 rules)

cross_field_compare: user_id 2 rules

Sample rules:

additional.fields["param1_1"] 1 value macro: re.capture() (2 rules)

macro: re.capture() 2 rules

Sample rules:

admin_consent 1 value eq: false (2 rules)

eq: false 2 rules

Steal Application Access Token T1528

Sample rules:

api.response.error 1 value eq: accessdenied (2 rules)

eq: accessdenied 2 rules

Brute Force T1110, Cloud Infrastructure Discovery T1580

Sample rules:

app 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Account Manipulation T1098, Additional Cloud Roles T1098.003

Sample rules:

auditType 1 value contains: policy (2 rules)

contains: policy 2 rules

Sample rules:

auditd.data.a2 1 value eq: 7 (2 rules)

eq: 7 2 rules

Sample rules:

aws.bedrock_agentcore.operation 1 value eq: invokeagentruntime (2 rules)

eq: invokeagentruntime 2 rules

Sample rules:

aws.cloudtrail.flattened.request_parameters.x-amz-server-side-encryption-customer-algorithm 1 value eq: aes256 (2 rules)

eq: aes256 2 rules

Data Encrypted for Impact T1486, Valid Accounts T1078, Cloud Accounts T1078.004

Sample rules:

aws::sessionCredentialFromConsole 1 value is_null: (2 rules)

is_null: 2 rules

Cloud Service Discovery T1526, Data from Cloud Storage T1530, Cloud Infrastructure Discovery T1580, Cloud Storage Object Discovery T1619

Sample rules:

azure.aadgraphactivitylogs.properties.actor_type 1 value eq: user (2 rules)

eq: user 2 rules

Sample rules:

azure.activitylogs.identity.authorization.evidence.principal_type 1 value eq: user (2 rules)

eq: user 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Credentials from Password Stores T1555, Cloud Secrets Management Stores T1555.006, Account Manipulation T1098, Modify Cloud Compute Infrastructure T1578

Sample rules:

azure.activitylogs.properties.authentication_protocol 1 value eq: devicecode (2 rules)

eq: devicecode 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Use Alternate Authentication Material T1550, Application Access Token T1550.001, Phishing T1566, Spearphishing Link T1566.002

Sample rules:

azure.activitylogs.properties.status_code 1 value eq: accepted (2 rules)

eq: accepted 2 rules

Data Destruction T1485, Inhibit System Recovery T1490

Sample rules:

azure.auditlogs.properties.additional_details.key 1 value eq: authenticationmethod (2 rules)

eq: authenticationmethod 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Multi-Factor Authentication Request Generation T1621, Modify Authentication Process T1556, Multi-Factor Authentication T1556.006

Sample rules:

azure.auditlogs.properties.target_resources.0.modified_properties.4.new_value 1 value contains: desktop- (2 rules)

contains: desktop- 2 rules

Account Manipulation T1098, Device Registration T1098.005

Sample rules:

azure.graphactivitylogs.properties.app_id 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

azure.open_ai.operation_name 1 value eq: chatcompletions_create (2 rules)

eq: chatcompletions_create 2 rules

Sample rules:

azure.platformlogs.properties.log.objectRef.subresource 1 value eq: proxy (2 rules)

eq: proxy 2 rules

Exploitation of Remote Services T1210, Container Administration Command T1609

Sample rules:

azure.resource.name 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Cloud Administration Command T1651, Boot or Logon Initialization Scripts T1037

Sample rules:

azure.signinlogs.identity 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Steal Application Access Token T1528, Use Alternate Authentication Material T1550, Application Access Token T1550.001, Phishing T1566

Sample rules:

azure.signinlogs.properties.authentication_details.authentication_method 1 value eq: password (2 rules)

eq: password 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Modify Authentication Process T1556, Conditional Access Policies T1556.009, Brute Force T1110, Password Spraying T1110.003

Sample rules:

azure.signinlogs.properties.device_detail.is_managed 1 value ne: true (2 rules)

ne: true 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Account Manipulation T1098, Device Registration T1098.005, Steal Application Access Token T1528, Use Alternate Authentication Material T1550

Sample rules:

azure.signinlogs.properties.is_interactive 1 value eq: true (2 rules)

eq: true 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Use Alternate Authentication Material T1550, Application Access Token T1550.001, Phishing T1566, Spearphishing Link T1566.002

Sample rules:

azure.signinlogs.properties.original_transfer_method 1 value eq: devicecodeflow (2 rules)

eq: devicecodeflow 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Phishing T1566, Spearphishing Link T1566.002, Steal Application Access Token T1528, Use Alternate Authentication Material T1550

Sample rules:

azure.signinlogs.properties.token_issuer_type 1 value eq: azuread (2 rules)

eq: azuread 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Use Alternate Authentication Material T1550, Application Access Token T1550.001, Impersonation T1656, Command and Scripting Interpreter T1059

Sample rules:

azure.signinlogs.result_signature 1 value eq: SUCCESS (2 rules)

eq: SUCCESS 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Account Manipulation T1098, Device Registration T1098.005, Steal Application Access Token T1528, Use Alternate Authentication Material T1550

Sample rules:

azure_ad::app_display_name 1 value eq: microsoft authentication broker (2 rules)

eq: microsoft authentication broker 2 rules

Phishing T1566, Spearphishing Link T1566.002, Valid Accounts T1078, Cloud Accounts T1078.004, Steal Web Session Cookie T1539, Account Manipulation T1098

Sample rules:

azure_ad::resource_display_name 1 value ne: Device Registration Service (2 rules)

ne: Device Registration Service 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Account Manipulation T1098, Device Registration T1098.005, Steal Application Access Token T1528, Use Alternate Authentication Material T1550

Sample rules:

azure_ad::target_user_upn 1 value eq: admin_users (2 rules)

eq: admin_users 2 rules

Brute Force T1110, Multi-Factor Authentication Request Generation T1621

Sample rules:

blocklist_label 1 value eq: 1 (2 rules)

eq: 1 2 rules

Sample rules:

body.html.display_text 1 value length_compare: 500 (2 rules)

length_compare: 500 2 rules

Sample rules:

body.previous_threads[].recipients.to 1 value length_compare: 1 (2 rules)

length_compare: 1 2 rules

Sample rules:

cIP 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

c_process_name 1 value lt: 25 (2 rules)

lt: 25 2 rules

System Binary Proxy Execution T1218, Server Software Component T1505, IIS Components T1505.004, Web Shell T1505.003

Sample rules:

c_process_path_ext 1 value lt: 3 (2 rules)

lt: 3 2 rules

Command and Scripting Interpreter T1059, Windows Command Shell T1059.003, User Execution T1204, Malicious File T1204.002

Sample rules:

class_type 1 value eq: lx (2 rules)

eq: lx 2 rules

Brute Force T1110, Valid Accounts T1078

Sample rules:

classification 1 value eq: malware (2 rules)

eq: malware 2 rules

Sample rules:

client:app_name 1 value ne: 1password scim bridge (2 rules)

ne: 1password scim bridge 2 rules

Sample rules:

client:device 1 value eq: computer (2 rules)

eq: computer 2 rules

Sample rules:

client:ipAddress 1 value wildcard: *.*.*.* (2 rules)

wildcard: *.*.*.* 2 rules

Sample rules:

client:ip_address 1 value wildcard: *.*.*.* (2 rules)

wildcard: *.*.*.* 2 rules

Sample rules:

coalesce(body.plain.raw, body.html.display_text) 1 value length_compare: 6000 (2 rules)

length_compare: 6000 2 rules

Sample rules:

columns.command 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

container.security_context.privileged 1 value eq: true (2 rules)

eq: true 2 rules

Sample rules:

counts 1 value ge: 5 (2 rules)

ge: 5 2 rules

Sample rules:

cs-uri 1 value contains: /oauth/idp/.well-known/openid-configuration (2 rules)

contains: /oauth/idp/.well-known/openid-configuration 2 rules

Sample rules:

csUriQuery 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

csUserName 1 value ne: - (2 rules)

ne: - 2 rules

Sample rules:

customProps_RuleId_s 1 value eq: TRIS0032 (2 rules)

eq: TRIS0032 2 rules

Sample rules:

d_ua 1 value gt: 10 (2 rules)

gt: 10 2 rules

Sample rules:

data.details.request.body.enabled 1 value eq: false (2 rules)

eq: false 2 rules

Sample rules:

dcount_DeviceId 1 value le: 5 (2 rules)

le: 5 2 rules

Sample rules:

dcount_sld 1 value gt: 100 (2 rules)

gt: 100 2 rules

Fallback Channels T1008, Dynamic Resolution T1568

Sample rules:

debugContext.debugData.factor 1 value eq: okta_verify_push (2 rules)

eq: okta_verify_push 2 rules

Sample rules:

desc 1 value ne: false (2 rules)

ne: false 2 rules

Masquerading T1036, System Binary Proxy Execution T1218, Rundll32 T1218.011, Rename Legitimate Utilities T1036.003, Match Legitimate Resource Name or Location T1036.005

Sample rules:

dest 1 value eq: * (2 rules)

eq: * 2 rules

Sample rules:

diff 1 value ne: [] (2 rules)

ne: [] 2 rules

Use Alternate Authentication Material T1550, Hijack Execution Flow T1574, DLL T1574.001, DLL T1574.002, Path Interception by PATH Environment Variable T1574.007, Path Interception by Search Order Hijacking T1574.008

Sample rules:

distinct(body.current_thread.links, .href_url.domain.root_domain) 1 value length_compare: 1 (2 rules)

length_compare: 1 2 rules

Sample rules:

dns_query 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

domain_abuse 1 value eq: true (2 rules)

eq: true 2 rules

Sample rules:

download_count 1 value gt: 10 (2 rules)

gt: 10 2 rules

Sample rules:

dropped_file_path_split_count 1 value eq: 2 (2 rules)

eq: 2 2 rules

Permission Groups Discovery T1069, Local Groups T1069.001, Replication Through Removable Media T1091

Sample rules:

err_cnt 1 value gt: 100 (2 rules)

gt: 100 2 rules

Sample rules:

event.event_platform 1 value eq: Win (2 rules)

eq: Win 2 rules

Sample rules:

event.event_simpleName 1 value eq: ProcessRollup2 (2 rules)

eq: ProcessRollup2 2 rules

Sample rules:

event0.file.name 1 value starts_with: process.name (2 rules)

starts_with: process.name 2 rules

Sample rules:

eventTypeName 1 value eq: INVITED_TO_ORG (2 rules)

eq: INVITED_TO_ORG 2 rules

Sample rules:

exe 1 value in: /usr/bin/sudo (2 rules)

in: /usr/bin/sudo 2 rules

System Network Configuration Discovery T1016, System Owner/User Discovery T1033, System Network Connections Discovery T1049, Command and Scripting Interpreter T1059, Unix Shell T1059.004, Permission Groups Discovery T1069

Sample rules:

f 1 value ge: 10 (2 rules)

ge: 10 2 rules

Sample rules:

failed_dc 1 value cross_field_compare: success_dc (2 rules)

cross_field_compare: success_dc 2 rules

Obfuscated Files or Information T1027, Command and Scripting Interpreter T1059, PowerShell T1059.001

Sample rules:

failures 1 value ge: 5 (2 rules)

ge: 5 2 rules

Sample rules:

field 1 value eq: base64_cmd (2 rules)

eq: base64_cmd 2 rules

Sample rules:

file.origin_referrer_url 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Command and Scripting Interpreter T1059, PowerShell T1059.001, Windows Command Shell T1059.003, Visual Basic T1059.005, JavaScript T1059.007, User Execution T1204

Sample rules:

file.origin_url 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Command and Scripting Interpreter T1059, PowerShell T1059.001, Windows Command Shell T1059.003, Visual Basic T1059.005, JavaScript T1059.007, User Execution T1204

Sample rules:

filter(attachments, .file_type in $file_types_images) 1 value length_compare: 0 (2 rules)

length_compare: 0 2 rules

Sample rules:

filter(body.links, .href_url.domain.valid) 1 value length_compare: 25 (2 rules)

length_compare: 25 2 rules

Sample rules:

filter(body.links, .href_url.scheme != 'mailto') 1 value length_compare: 0 (2 rules)

length_compare: 0 2 rules

Sample rules:

filter(recipients.to, .email.domain.domain not in $org_domains and .email.email not in $recipient_emails and .email.domain.valid or strings.icontains(.display_name, 'undisclosed'))

1 value length_compare: 10 (2 rules)

length_compare: 10 2 rules

Sample rules:

firstTimeSeenRegion 1 value is_null: (2 rules)

is_null: 2 rules

Sample rules:

firstTimeSeenUser 1 value is_null: (2 rules)

is_null: 2 rules

Sample rules:

flowDirection 1 value eq: egress (2 rules)

eq: egress 2 rules

Sample rules:

from 1 value eq: null (2 rules)

eq: null 2 rules

Sample rules:

github.permission 1 value eq: admin (2 rules)

eq: admin 2 rules

Account Manipulation T1098, Additional Cloud Roles T1098.003, Create Account T1136, Cloud Account T1136.003

Sample rules:

github.user_agent 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

graph.entity.domain.creation_time.seconds 1 value gt: 0 (2 rules)

gt: 0 2 rules

Sample rules:

graph.metadata.threat.category 1 value eq: SOFTWARE_MALICIOUS (2 rules)

eq: SOFTWARE_MALICIOUS 2 rules

Domain or Tenant Policy Modification T1484, Disable or Modify Tools T1562, Disable or Modify Tools T1562.001

Sample rules:

graph.metadata.threat.severity 1 value eq: CRITICAL (2 rules)

eq: CRITICAL 2 rules

Sample rules:

graph.relations.entity.group.group_display_name 1 value eq: Domain Admins (2 rules)

eq: Domain Admins 2 rules

Remote Services T1021, SMB/Windows Admin Shares T1021.002, Brute Force T1110, Password Guessing T1110.001

Sample rules:

gws::admin_application_name 1 value eq: google workspace marketplace (2 rules)

eq: google workspace marketplace 2 rules

Sample rules:

gws::admin_new_value 1 value eq: false (2 rules)

eq: false 2 rules

Modify Authentication Process T1556, Account Access Removal T1531, Multi-Factor Authentication T1556.006

Sample rules:

gws::device_account_state 1 value eq: registered (2 rules)

eq: registered 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Account Manipulation T1098, Device Registration T1098.005, Adversary-in-the-Middle T1557

Sample rules:

gws::event_type 1 value eq: user_settings (2 rules)

eq: user_settings 2 rules

Account Manipulation T1098, Valid Accounts T1078, Cloud Accounts T1078.004, Additional Cloud Roles T1098.003

Sample rules:

gws::token_client_id 1 value ends_with: apps.googleusercontent.com (2 rules)

ends_with: apps.googleusercontent.com 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Use Alternate Authentication Material T1550, Application Access Token T1550.001, Account Manipulation T1098, Additional Cloud Credentials T1098.001

Sample rules:

headers.return_path.local_part 1 value contains: +srs= (2 rules)

contains: +srs= 2 rules

Sample rules:

http.request.body.content 1 value contains: prototype (2 rules)

contains: prototype 2 rules

Sample rules:

http.request.referrer 1 value ends_with: SignOut.aspx (2 rules)

ends_with: SignOut.aspx 2 rules

Sample rules:

http.status 1 value eq: 200 (2 rules)

eq: 200 2 rules

Sample rules:

ident_s 1 value eq: TRAFFIC (2 rules)

eq: TRAFFIC 2 rules

Sample rules:

index_name 1 value eq: driller (2 rules)

eq: driller 2 rules

Sample rules:

index_number 1 value ge: 0 (2 rules)

ge: 0 2 rules

Sample rules:

indicator 1 value cross_field_compare: PreviousIndicator (2 rules)

cross_field_compare: PreviousIndicator 2 rules

Sample rules:

infected 1 value ge: 2 (2 rules)

ge: 2 2 rules

Sample rules:

instanceId 1 value eq: 24070 (2 rules)

eq: 24070 2 rules

Sample rules:

isPrivate 1 value ne: true (2 rules)

ne: true 2 rules

Account Manipulation T1098, Additional Email Delegate Permissions T1098.002, Email Collection T1114, Remote Email Collection T1114.002

Sample rules:

isReadRole 1 value eq: true (2 rules)

eq: true 2 rules

Sample rules:

is_anomaly_b 1 value eq: true (2 rules)

eq: true 2 rules

Sample rules:

is_driver 1 value eq: true (2 rules)

eq: true 2 rules

Create or Modify System Process T1543, Windows Service T1543.003

Sample rules:

is_prioritized 1 value eq: true (2 rules)

eq: true 2 rules

Sample rules:

kubernetes.audit.impersonatedUser.username 1 value starts_with: system:node: (2 rules)

starts_with: system:node: 2 rules

Permission Groups Discovery T1069, Cloud Groups T1069.003, Container and Resource Discovery T1613

Sample rules:

local_orig 1 value eq: true (2 rules)

eq: true 2 rules

Sample rules:

log_level 1 value eq: debug (2 rules)

eq: debug 2 rules

Sample rules:

logsource.product 1 value eq: windows (2 rules)

eq: windows 2 rules

Remote Access Tools T1219, Remote Desktop Software T1219.002

Sample rules:

m365::ExtendedProperties.RequestType 1 value eq: cmsi:cmsi (2 rules)

eq: cmsi:cmsi 2 rules

Sample rules:

mailbox.email.domain.sld 1 value length_compare: 4 (2 rules)

length_compare: 4 2 rules

Sample rules:

max_GetData 1 value eq: 1 (2 rules)

eq: 1 2 rules

Sample rules:

mfa_prompts 1 value ge: 10 (2 rules)

ge: 10 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Compromise Accounts T1586, Cloud Accounts T1586.003, Multi-Factor Authentication Request Generation T1621

Sample rules:

ml_is_dga.malicious_prediction 1 value eq: 1 (2 rules)

eq: 1 2 rules

Sample rules:

network_traffic.redis.query 1 value contains: config set dir (2 rules)

contains: config set dir 2 rules

Sample rules:

nextDestinationPort 1 value cross_field_compare: DestinationPort (2 rules)

cross_field_compare: DestinationPort 2 rules

Sample rules:

nodename 1 value eq: dns (2 rules)

eq: dns 2 rules

Sample rules:

numOfDelFilePath 1 value ge: 200 (2 rules)

ge: 200 2 rules

Indicator Removal T1070, File Deletion T1070.004, Data Destruction T1485

Sample rules:

num_data_samples 1 value cross_field_compare: minimum_data_samples (2 rules)

cross_field_compare: minimum_data_samples 2 rules

Sample rules:

num_message_attachments 1 value gt: 0 (2 rules)

gt: 0 2 rules

Sample rules:

o365.audit.DeviceProperties.Value 1 value eq: false (2 rules)

eq: false 2 rules

Sample rules:

object_uuid 1 value eq: watchlist (2 rules)

eq: watchlist 2 rules

Use Alternate Authentication Material T1550, Web Session Cookie T1550.004

Sample rules:

okta::authenticationContext.externalSessionId 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

okta::debugContext.debugData.factor 1 value eq: OKTA_VERIFY_PUSH (2 rules)

eq: OKTA_VERIFY_PUSH 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Multi-Factor Authentication Request Generation T1621

Sample rules:

okta::securityContext.isProxy 1 value eq: true (2 rules)

eq: true 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Brute Force T1110, Password Spraying T1110.003, Credential Stuffing T1110.004, External Remote Services T1133

Sample rules:

p_enrichment.tor_exit_nodes 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

p_event_time 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

p_occurs_between 1 value macro: '2022-01-14' , '2022-03-22' (2 rules)

macro: '2022-01-14' , '2022-03-22' 2 rules

Sample rules:

parameters.APPLICATION_NAME 1 value eq: gmail (2 rules)

eq: gmail 2 rules

Sample rules:

parameters.NEW_VALUE 1 value eq: true (2 rules)

eq: true 2 rules

Phishing T1566, Brute Force T1110

Sample rules:

parent_commandline 1 value is_null: (2 rules)

is_null: 2 rules

Sample rules:

passwordProtected 1 value eq: false (2 rules)

eq: false 2 rules

Sample rules:

peer_system_ip 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

peer_type 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

principal.resource.type 1 value eq: AssumedRole (2 rules)

eq: AssumedRole 2 rules

Data Encrypted for Impact T1486

Sample rules:

problemchild.prediction 1 value eq: 1 (2 rules)

eq: 1 2 rules

Sample rules:

process.Ext.api.metadata.background_callcount 1 value ge: 400 (2 rules)

ge: 400 2 rules

Sample rules:

process.Ext.api.metadata.ms_since_last_keyevent 1 value ge: 100 (2 rules)

ge: 100 2 rules

Sample rules:

process.Ext.api.parameters.protection_old 1 value eq: RW- (2 rules)

eq: RW- 2 rules

Sample rules:

process.Ext.api.parameters.search_filter 1 value wildcard: (&(objectCategory=person)(objectClass=user)(directReports=?)(!(manager=?))) (2 rules)

wildcard: (&(objectCategory=person)(objectClass=user)(directReports=?)(!(manager=?))) 2 rules

Sample rules:

process.Ext.desktop_name 1 value starts_with: WinSta0\ (2 rules)

starts_with: WinSta0\ 2 rules

Sample rules:

process.Ext.token.security_attributes 1 value eq: smartlocker://smartscreenoriginclaim (2 rules)

eq: smartlocker://smartscreenoriginclaim 2 rules

Sample rules:

process.cpu.utilization 1 value gt: 0 (2 rules)

gt: 0 2 rules

Sample rules:

process.thread.Ext.hardware_breakpoint_set 1 value eq: true (2 rules)

eq: true 2 rules

Sample rules:

process.thread.capabilities.effective 1 value eq: cap_sys_ptrace (2 rules)

eq: cap_sys_ptrace 2 rules

Sample rules:

process.thread.capabilities.permitted 1 value eq: cap_sys_ptrace (2 rules)

eq: cap_sys_ptrace 2 rules

Sample rules:

process.uptime 1 value ge: 300 (2 rules)

ge: 300 2 rules

Sample rules:

process_arguments 1 value contains: mshtml (2 rules)

contains: mshtml 2 rules

Sample rules:

profile.by_sender_domain 1 value func_call: profile.by_sender_domain().prevalence == new (2 rules)

func_call: profile.by_sender_domain().prevalence == new 2 rules

Sample rules:

properties.initiatedBy.user.id 1 value eq: * (2 rules)

eq: * 2 rules

Create Account T1136, Cloud Account T1136.003

Sample rules:

properties.userPrincipalName 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Brute Force T1110, Password Guessing T1110.001, Password Spraying T1110.003, Credential Stuffing T1110.004, Valid Accounts T1078, Cloud Accounts T1078.004

Sample rules:

protoPayload.authenticationInfo.principalEmail 1 value contains: gs-project-accounts.iam.gserviceaccount.com (2 rules)

contains: gs-project-accounts.iam.gserviceaccount.com 2 rules

Sample rules:

protoPayload.metadata.jobChange.job.jobConfig.type 1 value eq: QUERY (2 rules)

eq: QUERY 2 rules

Sample rules:

protoPayload.serviceData 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Data from Cloud Storage T1530

Sample rules:

protoPayload.serviceData.policyDelta.bindingDeltas 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Data from Cloud Storage T1530

Sample rules:

query_param 1 value eq: c (2 rules)

eq: c 2 rules

Sample rules:

query_type 1 value eq: grant (2 rules)

eq: grant 2 rules

Sample rules:

ratio 1 value lt: 0.5 (2 rules)

lt: 0.5 2 rules

Multi-Factor Authentication Request Generation T1621, Cloud Service Dashboard T1538, Use Alternate Authentication Material T1550, Web Session Cookie T1550.004

Sample rules:

readOnly 1 value is_null: (2 rules)

is_null: 2 rules

Modify Cloud Compute Infrastructure T1578

Sample rules:

record_type 1 value eq: azureactivedirectorystslogon (2 rules)

eq: azureactivedirectorystslogon 2 rules

Brute Force T1110, Password Guessing T1110.001

Sample rules:

requestParameters.VersioningConfiguration.MfaDelete 1 value eq: Disabled (2 rules)

eq: Disabled 2 rules

Data Destruction T1485, Disable or Modify Tools T1562

Sample rules:

requestParameters.passwordResetRequired 1 value is_null: (2 rules)

is_null: 2 rules

Account Manipulation T1098, Redundant Access T1108, Use Alternate Authentication Material T1550

Sample rules:

requestParameters.policyArn 1 value ends_with: AdministratorAccess (2 rules)

ends_with: AdministratorAccess 2 rules

Sample rules:

requestParameters.roleArn 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

request_body_len 1 value ne: 0 (2 rules)

ne: 0 2 rules

Sample rules:

response_body_len 1 value ne: 0 (2 rules)

ne: 0 2 rules

Sample rules:

riskScore 1 value ge: 40 (2 rules)

ge: 40 2 rules

Sample rules:

risk_score 1 value ge: 30 (2 rules)

ge: 30 2 rules

Command and Scripting Interpreter T1059, Windows Command Shell T1059.003, PowerShell T1059.001

Sample rules:

sanitizationResult 1 value contains: blocked (2 rules)

contains: blocked 2 rules

Sample rules:

securityContext.isProxy 1 value eq: true (2 rules)

eq: true 2 rules

Multi-Factor Authentication Request Generation T1621, Brute Force T1110

Sample rules:

security_result.description 1 value eq: Reason: Failed authentication (2 rules)

eq: Reason: Failed authentication 2 rules

Valid Accounts T1078, Brute Force T1110

Sample rules:

security_result.detection_fields["factor"] 1 value eq: OKTA_VERIFY_PUSH (2 rules)

eq: OKTA_VERIFY_PUSH 2 rules

Sample rules:

security_result.summary 1 value eq: User login to Okta (2 rules)

eq: User login to Okta 2 rules

Account Manipulation T1098, Additional Cloud Roles T1098.003

Sample rules:

sender.email.domain.domain 1 value eq: google.com (2 rules)

eq: google.com 2 rules

Sample rules:

servicePrincipal 1 value cross_field_compare: targetServicePrincipal (2 rules)

cross_field_compare: targetServicePrincipal 2 rules

Sample rules:

source.geo.location 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Valid Accounts T1078, Cloud Accounts T1078.004, Steal Application Access Token T1528, Adversary-in-the-Middle T1557

Sample rules:

source.user.name 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

source.user.roles 1 value eq: administrator (2 rules)

eq: administrator 2 rules

Sample rules:

sourceIPs 1 value is_not_null: (2 rules)

is_not_null: 2 rules

Sample rules:

stateOld 1 value eq: enabled (2 rules)

eq: enabled 2 rules

Disable or Modify Tools T1562, Cloud Firewall T1562.007

Sample rules:

statement 1 value contains: state = off (2 rules)

contains: state = off 2 rules

Disable or Modify Tools T1562, Disable or Modify Windows Event Log T1562.002

Sample rules:

strings.ilevenshtein 1 value func_call: strings.ilevenshtein(strings.replace_confusables(sender.display_name), "sendgrid") <= 1 (2 rules)

func_call: strings.ilevenshtein(strings.replace_confusables(sender.display_name), "sendgrid") <= 1 2 rules

Sample rules:

strings.replace_confusables(sender.display_name) 1 value contains: sendgrid (2 rules)

contains: sendgrid 2 rules

Sample rules:

strings.replace_confusables(sender.email.local_part) 1 value contains: sendgrid (2 rules)

contains: sendgrid 2 rules

Sample rules:

subnet 1 value is_null: (2 rules)

is_null: 2 rules

Sample rules:

successfulAccountSigninCount 1 value lt: 100 (2 rules)

lt: 100 2 rules

Valid Accounts T1078, Account Manipulation T1098, Email Collection T1114

Sample rules:

susp_ch 1 value gt: 3 (2 rules)

gt: 3 2 rules

Sample rules:

suspect_terms_count 1 value ge: 2 (2 rules)

ge: 2 2 rules

Unsecured Credentials T1552, Email Collection T1114, Remote Email Collection T1114.002, Data from Information Repositories T1213, Sharepoint T1213.002

Sample rules:

target.resource.attribute.labels["CHNGIND"] 1 value eq: I (2 rules)

eq: I 2 rules

Sample rules:

Exfiltration Over Web Service T1567

Sample rules:

tbl_count 1 value gt: 10 (2 rules)

gt: 10 2 rules

Sample rules:

threatname 1 value ne: none (2 rules)

ne: none 2 rules

Sample rules:

totalDestIPCount 1 value ge: 250 (2 rules)

ge: 250 2 rules

Sample rules:

ua_count 1 value gt: 5 (2 rules)

gt: 5 2 rules

Sample rules:

uniqueIPs 1 value gt: 20 (2 rules)

gt: 20 2 rules

Brute Force T1110, Password Spraying T1110.003, Credential Stuffing T1110.004, Compromise Accounts T1586, Cloud Accounts T1586.003

Sample rules:

uniqueIpUserCombinations 1 value gt: 20 (2 rules)

gt: 20 2 rules

Brute Force T1110, Password Spraying T1110.003, Credential Stuffing T1110.004, Compromise Accounts T1586, Cloud Accounts T1586.003

Sample rules:

uniqueUsers 1 value gt: 20 (2 rules)

gt: 20 2 rules

Brute Force T1110, Password Spraying T1110.003, Credential Stuffing T1110.004, Compromise Accounts T1586, Cloud Accounts T1586.003

Sample rules:

unique_app_ids 1 value gt: 2 (2 rules)

gt: 2 2 rules

Sample rules:

unique_ips 1 value gt: 1 (2 rules)

gt: 1 2 rules

Browser Session Hijacking T1185, Brute Force T1110, Password Guessing T1110.001, Password Spraying T1110.003

Sample rules:

unique_signature_count 1 value ge: 2 (2 rules)

ge: 2 2 rules

Sample rules:

unique_user_agents 1 value gt: 5 (2 rules)

gt: 5 2 rules

Sample rules:

url.original 1 value contains: = (2 rules)

contains: = 2 rules

Sample rules:

userIdentity.sessionContext.sessionIssuer.userName 1 value starts_with: AWSReservedSSO_ (2 rules)

starts_with: AWSReservedSSO_ 2 rules