Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,000 detections
Filters
Last updated
All Time
Detection languages
1,438
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,443
11,831
5,872
5,155
4,866
3,000
Platforms
1,197
672
622
513
218
Products / Services
879
726
311
255
229
MITRE Techniques
1,659
1,107
903
465
462
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
This query monitors for users running Log Analytics queries that contain filters for specific, defined VIP user accounts or the VIPUser watchlist template.
Use this detection to alert for users specifically searching for activity of sensitive users.
Use this detection to alert for users specifically searching for activity of sensitive users.
This query visualises the total amount of admin false positive submissions by the state of the submission.
'This hunting query identifies GitHub activites where permissions are updated that may be a sign of compromise.'
This query visualises emails submitted by admins as false negatives, summarizing the data by top 10 sender domains of those emails
This query displays the configuration auditing for 'Safe Attachments for SharePoint, OneDrive, and Microsoft Teams' and 'Safe Documents' in Microsoft Defender for Office 365.
'This query will alert on any sign-ins from devices infected with malware in correlation with workspace deletion activity.
Attackers may attempt to delete workspaces containing compute instances after successful compromise to cause service unavailability to regular business operation.'
Attackers may attempt to delete workspaces containing compute instances after successful compromise to cause service unavailability to regular business operation.'
This query looks for Entra ID role adds identified by Microsoft Defender for Cloud Apps. It will require an corresponding app connector in Microsoft Defender for Cloud Apps.
This query helps reviewing admin reported email submissions
This query visualises emails submitted by admins as false positives, summarizing the data by top 10 sender domains of those emails
This query visualises emails submitted as false negatives by admins where emails where already detected by MDO but there was an admin policy override
'This hunting query looks for users who have run queries that have not previously been seen running queries.'
This query visualises the original detection technology of emails submitted as spam false positive by admins
This query visualises the top admins performing false negative submissions
Find accounts that have been added/removed from groups in AD.
This query visualises the daily amount of admin false positive submission by submission type.
This query helps hunting for Tenant allow/block list (TABL) changes in Defender for Office 365
This query helps report daily on total number of emails, total number of emails detected aby Defender for Office 365
This query uses the public MDE GitHub repo as a source to estimate the time that an agent build remains supported
based on the time it was uploaded. Please note that the timestamps used in this query are meant to estimate the
support period and will likely not represent the actual expiration of the package which will be based on the build.
If you would like an estimate of support, uncomment the extend statement to get an idea of what is \ is not
supported and an idea of how long support will remain for current agents.
This query currently only supports GA builds, not preview builds.
based on the time it was uploaded. Please note that the timestamps used in this query are meant to estimate the
support period and will likely not represent the actual expiration of the package which will be based on the build.
If you would like an estimate of support, uncomment the extend statement to get an idea of what is \ is not
supported and an idea of how long support will remain for current agents.
This query currently only supports GA builds, not preview builds.
'This hunting query identifies a user that add/invite a member to the organization for the first time. This technique can be leveraged by attackers to add stealth account access to the organization.'
The following query detects possible CVE-2021-42278 exploitation by finding changes of device names in the network using Microsoft Defender for Identity
This query visualises all emails submitted as false positive by admins summarizing by the original filter verdict threat type
Page 121 of 143