Security Forums

Hi @jstoner I am new to YARA L, I am trying to convert few KQL query into YARA L, but I can’t able to achive same as KQL logic. please help on this rules.Response rows stateful anomaly on database | Microsoft Sentinel Analytic Rules Drop attempts stateful anomaly on database | Microsoft Sentinel Analytic Rules

 Day 4: Hunting Gamaredon-Related Document Activity This Google Threat Intelligence search query is designed to find files that match a specific set of characteristics, generally indicative of a particular type of malware or activity. (type:document) and (behavior_processes:*.ru* and behavior_processes:*DavSetCookie* and behavior_processes:*http*) and (behavior_network:*.ru* or embedded_domain:*.ru* or embedded_url:*.ru*)  

 Day 1: Google Threat Intelligence search a day keeps the phishing away… This Google Threat Intelligence search query is designed to find potentially malicious or misleading domains that are similar to netflix.com but are not the official domain itself. entity:domain fuzzy_domain:netflix.com and not domain:netflix.com creation_date:90d+  Query Breakdown: The query uses specific search modifiers (

Howdy,I am facing some challenges with acquiring OnPrem AD Contextual data.Get-ADUser works fine, but the Get-ADComputer part errors out Using this:https://docs.cloud.google.com/chronicle/docs/ingestion/default-parsers/windows-ad # Set the location where the log file will be written$OUTPUT_FILENAME “C:\Data\SecOps\Logs\AD-AssetContext.json"If (Test-Path -Path $OUTPUT_FILENAME) { Remove-Item -path $OUTPUT_FILENAME -ErrorAction SilentlyContinue}# USER_CONTEXT: Gets all Active Directory users and their properties.Get-ADUser -Filter * -properties samAccountName | % { Get-ADUser $_.SamAccountName -propertie

 This query is designed to identify and block the Command and Control (C2) domains used by the Gamaredon (also known as Primitive Bear or UAC-0010) threat actor, a highly persistent group with reported ties to Russia, often targeting entities in Ukraine. entity:url tld:ru path:"/DESKTOP-*" (have:communicating_file or have:refer

 This sophisticated search is designed to unmask active file delivery domains used by threat actors in targeted espionage campaigns against sensitive UK sectors like the Ministry of Defence (MOD), National Health Service (NHS), and His Majesty's Revenue and Customs (HMRC). entity:url (hostname:"*-govuk*" or hostname:"*mod-uk*"

I have a use case where I’m trying to determine average amount of activity logs per day for specific users. My query gives me a compilation when using both avg() and count() functions in the outcome section.  My current query is // 1. Calculate the day of the month for grouping$day_of_month = timestamp.get_date(udm.metadata.event_timestamp.seconds) // 2. Calculate the day of the week (1=Sunday, 7=Saturday)$day_of_week_num = timestamp.get_day_of_week(udm.metadata.event_timestamp.seconds) // 3. Filter for working days (Monday through Friday)$day_of_week_num >= 2 and $day_of_week_num <= 6 // Log source filters udm.metadata.log_type = "AZURE_AD" or udm.metadata.log_type = "UMBRELLA_DNS" or udm.metadata.log_type = "SLACK_AUDIT" or udm.metadata.log_type = "SALESFORCE" or udm.metadata.log_type = "WORKSPACE_ACTIVITY" or udm.metadata.log_type = "CS_EDR" or udm.metadata.log_type = "AWS_CLOUDTRAIL"

Hi fellow Google Cloud Security and Vertex AI Developers, I've recently filed a Feature Request (FR) to address what I believe is the next critical gap in cloud security: zero-day defense against Autonomous Data Poisoning attacks that target our core AI models. Traditional defenses are too slow and passive for the coming AI-vs-AI threat landscape. I propose the creation of the Gemini-Core system—a self-evolving, generative security agent that is structured into three stages: G-Rook & G-Champ: For real-time, predictive anomaly detection and quarantine. G-Mega (Generative Defense): The ability for the agent to autonomously write and deploy new, tailored code patches against zero-day exploits. G-Prime (The Absolute Truth Engine): The ultimate solution to poisoning. A verifiable, self-healing mechanism that performs a "Genesis Rewrite" to restore model integrity. This system is designed to provide th

VHR20251126 - November 26, 2025The Mandiant Intelligence Validation Research Team (VRT) has published VHR20251126 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes89 Actions added 66 Files added 20 Actions retired 13 Actions updatedRelease Highlights New Actions demonstrating Campaign 25-059, used by UNC6322 to deploy SHADOWLADDER.IDAT payloads in multiple compromises of US and French organizations. New Actions demonstrating Campaign 25-058, a financially motivated actor UNC6276 campaign compromising ESXi infrastructure and Windows domain environments for ransomware deployment by exploiting CVE-2024-370

Hello,  I am using the latest version of the Default GCP Cloud Audit parser of 2025-11-05.But unfortunately, when I go through the Audit Logs, I get to see values in the UDM which are absolutely not there in the raw json. event fields:  I don’t expect this behavior to happen. Why does the parser add more values to the principal object when my other colleague is not mentioned once in the raw json.Of course I have tried to find other way around this, but other objects like which IAM roles are being added or removed are also getting mixed up within the principal object. So when I want to create a window with IAM policy changes, then it g

I am writing to appeal the phishing suspension on my Firebase Hosting site: https://drama-logbook.web.app/ Project ID: drama-logbook Project number: [removed by moderator] Abuse Event Insert ID: [removed by moderator] 896651 (timestamp: 2025-11-22T16:19:32Z)This is a personal, non-commercial drama/theatre logbook web app that I built myself. It has been running normally for over two weeks (deployed around early November 2025) and was actively used by me and a few friends until yesterday afternoon (Hong Kong time, Nov 22). Suddenly last night it started showing “Site Not Found” with a RESOURCE_SUSPENSION triggered for alleged phishing.I believe this is a false positive for the following reasons:The site contains no login forms, no password fields, no credit-card or financial information collection, and no redirects to external phishing sites. The only

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20251126 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher.If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes89 Actions added 66 Files added 20 Actions retired 13 Actions updatedRelease HighlightsNew Actions demonstrating Campaign 25-059, used by 

Hi Guys,We tried to create a detection rule using the following document for Detect silent hosts by hostname.https://docs.cloud.google.com/chronicle/docs/ingestion/silent-host-monitoring  We have customized the query and make the following query.rule Silent_Host_Detection { meta: description = "Detects hosts that have stopped sending logs for 5 minutes or more" severity = "Medium" category = "Host Monitoring" events: // Track events from the specific host in the last 60 minutes (scanning window) $event.metadata.event_timestamp.seconds > timestamp.current_seconds() - 3600 $silent_hostname = $event.principal.hostname $silent_hostname = "secops-local-testing-02" match:

 This search is designed to identify files that use a specific, hardcoded User-Agent string during their dynamic analysis, which is the tell-tale signature of a Cobalt Strike beacon attempting covert Command and Control (C2) communication. entity:file behavior:"Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 5.2)

 This targeted search is designed to hunt for files that are high-conviction malware but still rely on a valid, non-revoked digital signature. This often points directly to newly stolen code-signing certificates or fresh, high-trust payloads. tag:signed not tag:revoked-cert not tag:invalid-signature p:5+

 This search identifies files whose malware configuration contains SMTP or IMAP fields, which typically indicates the malware uses an email-based mechanism for communication or data exfiltration. malware_config:"smtp" or malware_config:"imap" Quer

 This targeted search is designed to provide an efficient, daily list of files that are newly uploaded, validated with multiple antivirus detections and high-quality sandbox reports, yet currently lack Sigma rule matches. This allows detection engineers to prioritize coverage gaps in their security monitoring infrastructure. p:5+ (sandbox_name:

What am I missing? For this specific syslog messages<182>Nov 14 12:06:46 myhostname.sma logserver: [14/Nov/2025:12:06:46.110690 +0530] myhostname 000000 kt 00000000 Info Audit Src='[::ffff:1.1.1.1]:62372' Auth='-' User='( [removed by moderator] )@(SonicWall Connect)' SocksVersion='0x101' Command='Tunnel' Dest='10.1.1.11:0' Error='0' SrcBytes='543969' DstBytes='822412' Duration='5085' VirtualHost='-' PlatformPrefix='W' EquipmentId='ACE4_2E00_2AFE_1FBD_2EE4_AC00_0000_0001.' SessionKey='myhostname:6916ad69:00000000'I keep getting the “No UDM events or entities were generated for the current parser configuration. ? Yet idm.read_only_udm filled?” I know the IP address in above, is incorrect forat, but I have taken care of that in parser extension. When I look in the statedump, I got many UDMs? "@output": [ { "idm": { "read_only_udm": { "metadata": { "event_t

I set this up in September. And it seemed to be working,  but now when I look, it seems to have stopped working?  Also no logs for over 30 days?

I am trying to overwrite as well as add some entity data for enrichement. I am trying the following parser extension to the Azure AD Organizational Context filter { json { source => "message" array_function => "split_columns" on_error => "not_json" } mutate { replace => { "username" => "%{userPrincipalName}" } on_error => "no_upn" } if ![no_upn] { mutate { replace => {# "aadcontext_event.idm.read_only_udm.principal.user.userid" => "%{username}" "$entity.user.userid" => "%{username}" } } } mutate { replace => {"employeetype" => "%{extension_29d326fe90944c75bdc8889fcfa9a2ea_extensionAttribute10}"} on_error => "no_extenstionattribute10" } if ![no_extenstionattribute10] { mutate

 This search query is designed to hunt for newly created or emerging malware that specifically targets information (stealers) by leveraging Program Database (PDB) file metadata which is often overlooked but can contain revealing developer-left strings. entity:file metadata:".pdb" metadata:"stealer" p:5+ fs:30d+

 This Google Threat Intelligence search query is designed to identify newly created, algorithmically generated domains (DGA) with multiple positive detections, which were registered through a registrar frequently abused by threat actors. entity:domain p:5+ tag:dga registrar:"NICENIC INTERNATIONAL GROUP CO., LIMITED" creation_da

 This VirusTotal Intelligence search query is designed to identify IP addresses acting as potential Command and Control (C2) servers. It specifically targets infrastructure that is serving or being contacted by a small number of malicious files and uses newly issued self-signed SSL certificates—a strong signal of newly deployed or low-profile C2 infrastructure. 

 This Google Threat Intelligence search query is designed to find files that execute specific obfuscated PowerShell commands to download malicious payloads. This query relies on sandboxed behavioral analysis to detect the command at runtime, bypassing static obfuscation that can often evade simple scanners. behavior:"'; &('

 This Google Threat Intelligence search query is designed to identify currently active Dropbox URLs that directly download files and are already confirmed to be suspicious by multiple antivirus engines. entity:url url:dropboxusercontent response_code:200 have:downloaded_file p:3+ fs:7d+ Quer