"query":"SELECT * FROM events WHERE UserAgent LIKE '%python%' OR UserAgent LIKE '%ruler%' OR UserAgent LIKE '%curl%' OR UserAgent LIKE '%Wget%' OR UserAgent LIKE '%python-requests%' OR UserAgent LIKE '%AADInternals%' OR UserAgent LIKE '%azurehound%' OR UserAgent LIKE '%axios%' OR UserAgent LIKE '%BAV2ROPC%' "
"query":"SELECT * FROM events WHERE UserAgent LIKE '%python%' OR UserAgent LIKE '%ruler%' OR UserAgent LIKE '%curl%' OR UserAgent LIKE '%Wget%' OR UserAgent LIKE '%python-requests%' OR UserAgent LIKE '%AADInternals%' OR UserAgent LIKE '%azurehound%' OR UserAgent LIKE '%axios%' OR UserAgent LIKE '%BAV2ROPC%'",
//检测UserAgent字段中包含可疑字符串的事件，这些字符串可能是自动化脚本或工具的标识
},
},
{
{
"name":"User adding or removing Inbox Rule",
"name":"User adding or removing Inbox Rule",
"severity":"Medium",
"severity":"Medium",
"query":"SELECT * FROM events WHERE Operation LIKE '%InboxRule%' OR Operation LIKE 'Set-Mailbox' OR Operation LIKE '%DeliverToMailboxAndForward%' OR Operation LIKE '%ForwardingAddress%' OR Operation LIKE '%ForwardingAddress%' "
"query":"SELECT * FROM events WHERE Operation LIKE '%InboxRule%' OR Operation LIKE 'Set-Mailbox' OR Operation LIKE '%DeliverToMailboxAndForward%' OR Operation LIKE '%ForwardingAddress%' OR Operation LIKE '%ForwardingAddress%'",
//检测与用户邮箱规则设置相关的操作，包括添加、删除邮箱规则等
},
},
{
{
"name":"After Hours Activity",
"name":"After Hours Activity",
"severity":"Medium",
"severity":"Medium",
"query":"SELECT * FROM events WHERE (CASE WHEN CAST(substr(CreationTime, 12, 2) AS INTEGER) < 0 THEN 24 + (CAST(substr(CreationTime, 12, 2) AS INTEGER)) ELSE CAST(substr(CreationTime, 12, 2) AS INTEGER) END >= 20 OR CASE WHEN CAST(substr(CreationTime, 12, 2) AS INTEGER) < 0 THEN 24 + (CAST(substr(CreationTime, 12, 2) AS INTEGER)) ELSE CAST(substr(CreationTime, 12, 2) AS INTEGER) END < 6) AND NOT (Operation LIKE 'File%' OR Operation LIKE 'List%' OR Operation LIKE 'Page%' OR Operation LIKE '%UserLogin%');"
"query":"SELECT * FROM events WHERE (CASE WHEN CAST(substr(CreationTime, 12, 2) AS INTEGER) < 0 THEN 24 + (CAST(substr(CreationTime, 12, 2) AS INTEGER)) ELSE CAST(substr(CreationTime, 12, 2) AS INTEGER) END >= 20 OR CASE WHEN CAST(substr(CreationTime, 12, 2) AS INTEGER) < 0 THEN 24 + (CAST(substr(CreationTime, 12, 2) AS INTEGER)) ELSE CAST(substr(CreationTime, 12, 2) AS INTEGER) END < 6) AND NOT (Operation LIKE 'File%' OR Operation LIKE 'List%' OR Operation LIKE 'Page%' OR Operation LIKE '%UserLogin%');",
"query":"SELECT * FROM events WHERE Operation LIKE '%FileUploaded%' "
"query":"SELECT * FROM events WHERE Operation LIKE '%FileUploaded%'",
//检测可能的文件外泄活动，即包含文件上传操作的事件
},
},
{
{
"name":"Admin searching in emails of other users",
"name":"Admin searching in emails of other users",
"severity":"Low",
"severity":"Low",
"query":"SELECT * FROM events WHERE Operation LIKE '%SearchStarted%' OR Operation LIKE '%SearchExportDownloaded%' OR Operation LIKE '%ViewedSearchExported%' "
"query":"SELECT * FROM events WHERE Operation LIKE '%SearchStarted%' OR Operation LIKE '%SearchExportDownloaded%' OR Operation LIKE '%ViewedSearchExported%'",
//检测管理员搜索或导出其他用户邮箱内容的操作
},
},
{
{
"name":"Strong Authentication Disabled",
"name":"Strong Authentication Disabled",
"severity":"medium",
"severity":"medium",
"query":"SELECT * FROM events WHERE Operation LIKE '%disable strong authentication%'"
"query":"SELECT * FROM events WHERE Operation LIKE '%disable strong authentication%'",
//检测禁用强身份验证的操作
},
},
{
{
"name":"User added to admin group",
"name":"User added to admin group",
"severity":"High",
"severity":"High",
"query":"SELECT * FROM events WHERE ( Operation LIKE '%add member to group%' AND ModifiedProperties Like '%admin%') OR ( Operation LIKE '%AddedToGroup%' AND TargetUserOrGroupName Like '%admin%') "
"query":"SELECT * FROM events WHERE ( Operation LIKE '%add member to group%' AND ModifiedProperties Like '%admin%') OR ( Operation LIKE '%AddedToGroup%' AND TargetUserOrGroupName Like '%admin%')",
//检测用户被添加到管理员组的操作
},
},
{
{
"name":"New Policy created",
"name":"New Policy created",
"severity":"Medium",
"severity":"Medium",
"query":"SELECT * FROM events WHERE ( Operation LIKE '%add policy%' ) "
"query":"SELECT * FROM events WHERE ( Operation LIKE '%add policy%' )",
//检测创建新策略的操作
},
},
{
{
"name":"Security Alert triggered",
"name":"Security Alert triggered",
"severity":"Medium",
"severity":"Medium",
"query":"SELECT * FROM events WHERE ( Operation LIKE '%AlertTriggered%' AND NOT Severity Like '%Low%') "
"query":"SELECT * FROM events WHERE ( Operation LIKE '%AlertTriggered%' AND NOT Severity Like '%Low%')",
//检测触发的安全警报，排除低严重性的警报
},
},
{
{
"name":"Transport rules ( mail flow rules ) modified",
"name":"Transport rules ( mail flow rules ) modified",
"severity":"High",
"severity":"High",
"query":"SELECT * FROM events WHERE ( Operation LIKE '%TransportRule%') "
"query":"SELECT * FROM events WHERE ( Operation LIKE '%TransportRule%' )",
//检测修改传输规则（邮件流规则）的操作
},
},
{
{
"name":"An application was registered in Azure AD",
"name":"An application was registered in Azure AD",
"severity":"Medium",
"severity":"Medium",
"query":"SELECT * FROM events WHERE ( Operation LIKE '%Add service principal.%') "
"query":"SELECT * FROM events WHERE ( Operation LIKE '%Add service principal.%')",
//检测在AzureAD中注册新应用（服务主体）的操作
},
},
{
{
"name":"Add app role assignment grant to user",
"name":"Add app role assignment grant to user",
"severity":"Medium",
"severity":"Medium",
"query":"SELECT * FROM events WHERE ( Operation LIKE '%Add app role assignment grant to user.%') "
"query":"SELECT * FROM events WHERE ( Operation LIKE '%Add app role assignment grant to user.%')",
//检测向用户授予应用角色分配的操作
},
},
{
{
"name":"eDiscovery Abuse",
"name":"eDiscovery Abuse",
"severity":"High",
"severity":"High",
"query":"SELECT * FROM events WHERE ( Operation LIKE '%New-ComplianceSearch%') "
"query":"SELECT * FROM events WHERE ( Operation LIKE '%New-ComplianceSearch%')",
//检测新建合规搜索（eDiscovery）的操作
},
},
{
{
"name":"Operations affecting OAuth Applications",
"name":"Operations affecting OAuth Applications",
"severity":"Medium",
"severity":"Medium",
"query":"SELECT * FROM events WHERE ( Operation = 'Add application.' OR Operation = 'Update application' OR Operation = 'Add service principal.' OR Operation = 'Update application Certificates and secrets management' OR Operation = 'Update applicationUpdate service principal.' OR Operation = 'Add app role assignment grant to user.' OR Operation = 'Add delegated permission grant.' OR Operation = 'Add owner to application.' OR Operation = 'Add owner to service principal.') "
"query":"SELECT * FROM events WHERE ( Operation = 'Add application.' OR Operation = 'Update application' OR Operation = 'Add service principal.' OR Operation = 'Update application Certificates and secrets management' OR Operation = 'Update applicationUpdate service principal.' OR Operation = 'Add app role assignment grant to user.' OR Operation = 'Add delegated permission grant.' OR Operation = 'Add owner to application.' OR Operation = 'Add owner to service principal.')",
//检测影响OAuth应用的操作，包括添加、更新应用、证书和密钥管理、添加角色分配、权限授予等
},
},
{
{
"name":"Suspicious Operations affecting Mailbox",
"name":"Suspicious Operations affecting Mailbox",
"severity":"Medium",
"severity":"Medium",
"query":"SELECT * FROM events WHERE ( Operation = 'Set-MailboxJunkEmailConfiguration' OR Operation = 'SoftDelete' OR Operation = 'SendAs' OR Operation = 'HardDelete' OR Operation = 'MoveToDeletedItems' ) "
"query":"SELECT * FROM events WHERE ( Operation = 'Set-MailboxJunkEmailConfiguration' OR Operation = 'SoftDelete' OR Operation = 'SendAs' OR Operation = 'HardDelete' OR Operation = 'MoveToDeletedItems' )",
"query":"SELECT * FROM events WHERE ( Operation = 'AddedToSecureLink' OR Operation = 'SearchQueryPerformed' OR Operation = 'SecureLinkCreated' OR Operation = 'SecureLinkUpdated' OR Operation = 'SharingInvitationCreated' ) "
"query":"SELECT * FROM events WHERE ( Operation = 'AddedToSecureLink' OR Operation = 'SearchQueryPerformed' OR Operation = 'SecureLinkCreated' OR Operation = 'SecureLinkUpdated' OR Operation = 'SharingInvitationCreated' )",
"SELECT * FROM Events WHERE (EventID IN ('17', '18') AND ((PipeName LIKE '%\\\\MSSE-%' ESCAPE '\\' AND PipeName LIKE '%-server%' ESCAPE '\\') OR PipeName LIKE '\\\\postex\\_%' ESCAPE '\\' OR PipeName LIKE '\\\\status\\_%' ESCAPE '\\' OR PipeName LIKE '\\\\msagent\\_%' ESCAPE '\\' OR PipeName LIKE '\\\\mojo\\_%' ESCAPE '\\' OR PipeName LIKE '\\\\interprocess\\_%' ESCAPE '\\' OR PipeName LIKE '\\\\samr\\_%' ESCAPE '\\' OR PipeName LIKE '\\\\netlogon\\_%' ESCAPE '\\' OR PipeName LIKE '\\\\srvsvc\\_%' ESCAPE '\\' OR PipeName LIKE '\\\\lsarpc\\_%' ESCAPE '\\' OR PipeName LIKE '\\\\wkssvc\\_%' ESCAPE '\\'))"
"SELECT * FROM Events WHERE (EventID IN ('17', '18') AND ((PipeName LIKE '%\\\\MSSE-%' ESCAPE '\\' AND PipeName LIKE '%-server%' ESCAPE '\\') OR PipeName LIKE '\\\\postex\\_%' ESCAPE '\\' OR PipeName LIKE '\\\\status\\_%' ESCAPE '\\' OR PipeName LIKE '\\\\msagent\\_%' ESCAPE '\\' OR PipeName LIKE '\\\\mojo\\_%' ESCAPE '\\' OR PipeName LIKE '\\\\interprocess\\_%' ESCAPE '\\' OR PipeName LIKE '\\\\samr\\_%' ESCAPE '\\' OR PipeName LIKE '\\\\netlogon\\_%' ESCAPE '\\' OR PipeName LIKE '\\\\srvsvc\\_%' ESCAPE '\\' OR PipeName LIKE '\\\\lsarpc\\_%' ESCAPE '\\' OR PipeName LIKE '\\\\wkssvc\\_%' ESCAPE '\\'))"
],
],
"filename":"pipe_created_mal_cobaltstrike.yml"
"filename":"pipe_created_mal_cobaltstrike.yml"
@ -327,6 +328,7 @@
],
],
"level":"critical",
"level":"critical",
"rule":[
"rule":[
//检测特定命名管道，这些管道常被用于凭据转储工具
"SELECT * FROM Events WHERE (EventID IN ('17', '18') AND (PipeName LIKE '%\\\\lsadump%' ESCAPE '\\' OR PipeName LIKE '%\\\\cachedump%' ESCAPE '\\' OR PipeName LIKE '%\\\\wceservicepipe%' ESCAPE '\\'))"
"SELECT * FROM Events WHERE (EventID IN ('17', '18') AND (PipeName LIKE '%\\\\lsadump%' ESCAPE '\\' OR PipeName LIKE '%\\\\cachedump%' ESCAPE '\\' OR PipeName LIKE '%\\\\wceservicepipe%' ESCAPE '\\'))"
