ThreatBeaconXThreatBeaconXSubscribe
SIEM & EDR Content

Detection & Hunting Logics

Detection rules and threat hunting queries for Sigma, YARA, KQL, Splunk SPL, and more.

splunkWindows

PowerShell Activity Detection Using Windows Security Logs

index=windows (event_id=4688 OR event_id=4104)|
Microsoft Sentinel

Detect Multiple Inbound Emails from Brave Alias Senders

EmailEvents
T1566.002 – Phishing: Spearphishing Link
Qradar

Inbound RDP Connection - Firewall

SELECT DATEFORMAT(devicetime,'yyyy-MM-dd hh:mm') AS "TimeStamp",LOGSOURCENAME(logsourceid) AS "LogSource Name",QIDNAME(qid) As "Event Name" ,"Logon Process" AS "Logon Process","Process Name",sourceip AS "Source IP",sourceport AS "Source Port",destinationip AS "Destination IP",destinationport AS "Destination Port",username AS "Username","Account Name" AS "Account Name", "Logon Type" AS "Logon Type" ,qideventid AS "Event ID" FROM events
Qradar

Potential DNS Tunneling

SELECT LOGSOURCENAME(logsourceid),sourceip, destinationip, "<dns_url_query_field_name>","DNS Error Code",STRLEN("<dns_query_field_name>") FROM events
Splunk

Hunt for Newly Created Admin Accounts

index=windows (EventCode=4720 OR EventCode=4732)
Microsoft Sentinel

Detecting Lumma Stealer Commands

DeviceFileEvents
Microsoft Sentinel

Anomalous Windows Hello For Business Sign In Without Device ID

let Lookback = 1d;