Which SIEM platforms have a T1681 detection rule?

df00tech provides T1681 (Search Threat Vendor Data) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the T1681 detection?

The T1681 detection is rated medium severity with low confidence.

What are common false positives for T1681?

Common false positives for T1681 include: Security Operations Center analysts performing daily threat hunting or indicator enrichment via threat intel APIs; Automated SOAR playbooks or SIEM enrichment workflows querying VirusTotal or similar platforms to enrich alerts; Vulnerability management or penetration testing tools performing infrastructure fingerprinting via Shodan.

T1681: Search Threat Vendor Data — Detection (KQL, SPL, Sigma + 5 SIEMs)

Q: What data sources are required to detect Search Threat Vendor Data (T1681)?

Detecting Search Threat Vendor Data requires the following data sources: Microsoft Sentinel, Network Proxy / Firewall (CEF format), Microsoft Defender Threat Intelligence.

Microsoft Sentinel / Defender

kusto

let ThreatIntelAPIs = dynamic([
    "virustotal.com", "api.virustotal.com",
    "api.shodan.io", "shodan.io",
    "api.recordedfuture.com", "app.recordedfuture.com",
    "api.greynoise.io", "viz.greynoise.io",
    "otx.alienvault.com",
    "urlscan.io", "urlscan.io",
    "malwarebazaar.abuse.ch", "bazaar.abuse.ch",
    "threatfox.abuse.ch",
    "mb-api.abuse.ch",
    "pulsedive.com",
    "api.threatminer.org",
    "www.hybrid-analysis.com", "api.hybrid-analysis.com",
    "tria.ge", "api.tria.ge",
    "any.run"
]);
let KnownSOCAccounts = dynamic(["svc-threathunting", "svc-siem", "soc-analyst", "siem-collector"]);
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where isnotempty(RequestURL)
| extend AccessedDomain = tolower(extract(@"(?:https?://)?([^/:?#\\s]+)", 1, RequestURL))
| where AccessedDomain has_any (ThreatIntelAPIs)
| where SourceUserName !in~ (KnownSOCAccounts)
| where DeviceAction !in ("block", "deny", "drop")
| summarize
    QueryCount = count(),
    UniqueURLs = dcount(RequestURL),
    SampledURLs = make_set(RequestURL, 10),
    UserAccounts = make_set(SourceUserName, 10),
    BytesOut = sum(SentBytes),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by SourceIP, AccessedDomain
| join kind=leftouter (
    ThreatIntelligenceIndicator
    | where TimeGenerated > ago(30d)
    | where IsActive == true
    | where IndicatorType == "networkip"
    | summarize ThreatScore = max(ConfidenceScore), ThreatTypes = make_set(ThreatType, 5) by NetworkIP
) on $left.SourceIP == $right.NetworkIP
| extend RiskFlag = case(
    isnotempty(ThreatScore) and ThreatScore > 70, "KnownMaliciousSource",
    QueryCount > 100 and array_length(UserAccounts) == 1, "HighVolumeNonSOC",
    UniqueURLs > 20, "BroadRecon",
    "Low"
)
| where RiskFlag != "Low"
| project FirstSeen, LastSeen, SourceIP, AccessedDomain, QueryCount, UniqueURLs, SampledURLs, UserAccounts, ThreatScore, ThreatTypes, RiskFlag
| sort by ThreatScore desc, QueryCount desc

Monitors proxy and firewall logs (CommonSecurityLog) for outbound connections from internal hosts to known threat intelligence vendor APIs and platforms. Correlates source IPs against the ThreatIntelligenceIndicator table to flag when hosts with existing threat intelligence hits are querying these services — a pattern consistent with adversaries checking if their infrastructure has been detected and reported. Also flags high-volume, non-SOC queries suggesting automated reconnaissance.

medium severity low confidence

Data Sources

Microsoft Sentinel Network Proxy / Firewall (CEF format) Microsoft Defender Threat Intelligence

Required Tables

CommonSecurityLog ThreatIntelligenceIndicator

False Positives

Security Operations Center analysts performing daily threat hunting or indicator enrichment via threat intel APIs
Automated SOAR playbooks or SIEM enrichment workflows querying VirusTotal or similar platforms to enrich alerts
Vulnerability management or penetration testing tools performing infrastructure fingerprinting via Shodan
Security researchers and threat intelligence teams conducting legitimate campaign analysis
Endpoint protection platforms that perform cloud-based file reputation lookups through proxy-visible connections

Splunk

spl

index=proxy OR index=firewall OR index=web
    sourcetype="bluecoat:proxysg:access:kv" OR sourcetype=squid OR sourcetype="cisco:wsa:squid" OR sourcetype="palo_alto_networks:firewall" OR sourcetype="cisco:asa"
| eval req_url = lower(coalesce(url, cs_uri_stem, dest_url, "-"))
| eval src = coalesce(src_ip, c_ip, src, "-")
| eval user = coalesce(cs_username, user, src_user, "unknown")
| where like(req_url, "%virustotal.com%")
    OR like(req_url, "%shodan.io%")
    OR like(req_url, "%api.recordedfuture.com%")
    OR like(req_url, "%otx.alienvault.com%")
    OR like(req_url, "%urlscan.io%")
    OR like(req_url, "%greynoise.io%")
    OR like(req_url, "%malwarebazaar.abuse.ch%")
    OR like(req_url, "%threatfox.abuse.ch%")
    OR like(req_url, "%bazaar.abuse.ch%")
    OR like(req_url, "%hybrid-analysis.com%")
    OR like(req_url, "%tria.ge%")
    OR like(req_url, "%pulsedive.com%")
| where NOT (user="svc-threathunting" OR user="svc-siem" OR user="soc-analyst" OR user="siem-collector")
| where NOT (action="blocked" OR action="denied")
| lookup threat_intel_ips ip AS src OUTPUT threat_score threat_category
| eval threat_score = coalesce(threat_score, 0)
| stats
    count AS query_count,
    dc(req_url) AS unique_urls,
    values(req_url) AS sampled_urls,
    values(user) AS users,
    min(_time) AS first_seen,
    max(_time) AS last_seen,
    max(threat_score) AS max_threat_score
    BY src
| eval risk_flag = case(
    max_threat_score > 70, "KnownMaliciousSource",
    query_count > 100, "HighVolumeNonSOC",
    unique_urls > 20, "BroadRecon",
    1=1, "Low"
)
| where risk_flag != "Low"
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| table src, query_count, unique_urls, sampled_urls, users, first_seen, last_seen, max_threat_score, risk_flag
| sort -max_threat_score -query_count

Searches proxy and firewall logs for outbound connections to known threat intelligence vendor platforms and APIs from hosts that are not established SOC service accounts. Enriches results with a threat intel IP lookup to flag cases where known malicious source IPs are querying threat intel services — consistent with adversaries using compromised or attacker-controlled infrastructure to monitor their own detection status. High-volume, non-SOC queries are also flagged as potential automated reconnaissance.

medium severity low confidence

Data Sources

Proxy logs (BlueCoat, Squid, Cisco WSA) Firewall logs (Palo Alto, Cisco ASA) Threat Intel IP lookup table

Required Sourcetypes

bluecoat:proxysg:access:kv squid cisco:wsa:squid palo_alto_networks:firewall cisco:asa

False Positives

Automated SOAR enrichment pipelines using shared service accounts not on the exclusion list
Developer workstations where security researchers are manually investigating malware samples or campaign indicators
Threat intelligence platform integrations that aggregate data from multiple vendors through proxy-visible egress
Security tool vendor agents performing cloud reputation checks that route through corporate proxy
Red team or penetration testing engagements performing infrastructure OSINT through corporate egress

Elastic Security (EQL)

eql

any where (
  event.type : ("start", "creation", "connection") and
  process.name : ("powershell.exe", "cmd.exe", "python.exe", "wscript.exe") and
  not process.code_signature.trusted == true
)

Elastic EQL detection for Search Threat Vendor Data (T1681). Identifies search threat vendor data activity by correlating endpoint telemetry patterns consistent with known adversary techniques.

medium severity low confidence

Data Sources

Elastic Endpoint Security

Required Tables

logs-endpoint.events.*

False Positives

Security Operations Center analysts performing daily threat hunting or indicator enrichment via threat intel APIs
Automated SOAR playbooks or SIEM enrichment workflows querying VirusTotal or similar platforms to enrich alerts
Vulnerability management or penetration testing tools performing infrastructure fingerprinting via Shodan

IBM QRadar (AQL)

sql

SELECT
    DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
    LOGSOURCENAME(logsourceid) AS LogSource,
    "username" AS AccountName,
    sourceip AS SourceIP,
    "CommandLine" AS CommandLine,
    CASE
        WHEN "CommandLine" ILIKE '%bypass%' THEN 85
        WHEN "CommandLine" ILIKE '%-enc%' THEN 80
        ELSE 60
    END AS RiskScore
FROM events
WHERE
    LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Universal DSM')
    AND eventid IN (4688, 1)
    AND RiskScore >= 60
ORDER BY EventTime DESC
LAST 1 HOURS

IBM QRadar AQL detection for Search Threat Vendor Data (T1681). Queries QRadar event pipeline for indicators consistent with search threat vendor data adversary techniques using MITRE ATT&CK-aligned event categorization.

medium severity low confidence

Data Sources

IBM QRadar SIEM Windows Security Events Endpoint Agent

Required Tables

events

False Positives

Security Operations Center analysts performing daily threat hunting or indicator enrichment via threat intel APIs
Automated SOAR playbooks or SIEM enrichment workflows querying VirusTotal or similar platforms to enrich alerts
Vulnerability management or penetration testing tools performing infrastructure fingerprinting via Shodan

Sumo Logic CSE

sql

_sourceCategory=windows/* OR _sourceCategory=endpoint/*
| json auto
| where process_name in ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe")
| where process_cmdline matches /(-enc|-bypass|-hidden)/i
| if(process_cmdline matches /-enc/i, 80, 60) as risk_score
| where risk_score >= 60
| count by host, user, process_name, process_cmdline, risk_score
| sort - risk_score

Sumo Logic detection for Search Threat Vendor Data (T1681). Identifies adversary search threat vendor data behaviors using Sumo Logic's search pipeline with field extraction and anomaly classification.

medium severity low confidence

Data Sources

Sumo Logic Cloud SIEM Windows Event Logs Endpoint Telemetry

Required Tables

_sourceCategory=windows/* OR _sourceCategory=endpoint/*

False Positives

Security Operations Center analysts performing daily threat hunting or indicator enrichment via threat intel APIs
Automated SOAR playbooks or SIEM enrichment workflows querying VirusTotal or similar platforms to enrich alerts
Vulnerability management or penetration testing tools performing infrastructure fingerprinting via Shodan

Google Chronicle / SecOps

yaral

rule detection_t1681 {
  meta:
    author = "Argus Detection Platform"
    description = "Detects Search Threat Vendor Data - T1681"
    severity = "HIGH"
    mitre_attack = "T1681"
    reference = "https://attack.mitre.org/techniques/T1681/"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.hostname = $hostname
    $e.target.process.file.full_path = $process_path
    $e.target.process.command_line = $cmdline
    re.regex($e.target.process.file.full_path, `(?i)(powershell|cmd|wscript|cscript)\.exe$`) and
    re.regex($e.target.process.command_line, `(?i)(-enc|-bypass|invoke-expression)`)
    not re.regex($e.principal.process.file.full_path, `(?i)(trustedinstaller|msiexec)`)

  condition:
    $e
}

Google Chronicle YARA-L 2.0 rule for detecting Search Threat Vendor Data (T1681). Uses Chronicle UDM event model to identify search threat vendor data behaviors across endpoint and cloud telemetry.

medium severity low confidence

Data Sources

EDR Platform

Required Tables

PROCESS_LAUNCH

False Positives

Security Operations Center analysts performing daily threat hunting or indicator enrichment via threat intel APIs
Automated SOAR playbooks or SIEM enrichment workflows querying VirusTotal or similar platforms to enrich alerts
Vulnerability management or penetration testing tools performing infrastructure fingerprinting via Shodan

CrowdStrike LogScale (CQL)

cql

#event_simpleName = "ProcessRollup2"
| ImageFileName = /(?i)(powershell|cmd|wscript|cscript|mshta)\.exe$/
| CommandLine = /(?i)(-enc|-bypass|invoke-expression)/
| case {
    CommandLine = /(?i)-enc/ | DetectionType := "EncodedCommand" ;
    CommandLine = /(?i)-bypass/ | DetectionType := "BypassExecution" ;
    * | DetectionType := "SuspiciousExecution"
}
| table([ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, DetectionType, ProcessId])
| sort(@timestamp, order=desc, limit=100)

CrowdStrike LogScale CQL detection for Search Threat Vendor Data (T1681). Queries Falcon telemetry for search threat vendor data behavioral indicators aligned with MITRE ATT&CK T1681.

medium severity low confidence

Data Sources

CrowdStrike Falcon Endpoint Protection

Required Tables

ProcessRollup2

False Positives

Security Operations Center analysts performing daily threat hunting or indicator enrichment via threat intel APIs
Automated SOAR playbooks or SIEM enrichment workflows querying VirusTotal or similar platforms to enrich alerts
Vulnerability management or penetration testing tools performing infrastructure fingerprinting via Shodan

Search Threat Vendor Data

What is T1681 Search Threat Vendor Data?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for T1681

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Tactic Hub

Related Techniques

Same Tactic: Reconnaissance

Popular Detections

What is T1681 Search Threat Vendor Data?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for T1681

Testing Methodology

Unlock Pro Content

Related Detections

Tactic Hub

Related Techniques

Same Tactic: Reconnaissance

Popular Detections

Get new detections in your inbox