Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
228 detections
Filters
Last updated
All Time
Detection languages
192
13
9
6
5
Contributors
70
39
34
22
15
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
191
50
12
11
10
Products / Services
196
33
25
24
7
MITRE Techniques
141
127
107
70
56
CVEs
2
IDS Classtypes
6
2
1
IDS Protocols
9
This query visualises total emails with Malware detections over time summarizing the data daily by various Malware detection technologies/controls.
This query helps in checking for spoofing attempts on the domain with Authentication failures
This query helps reviewing admin reported email submissions
This query helps hunt for emails with malicious attachments based on SH256 hash from external IOC source
This query helps reviewing Malware, Phishing, Spam emails caught per day
This query helps reviewing top 100 malicious senders
This query helps hunting for top outbound recipient domains which are sending inbound emails with threats
Use this query to locate emails with subject indicators of a reply or forward, and the attachment is a .doc, or a .zip containing a .doc. Review results for suspicious emails.
IcedId can lead to ransomware
IcedId can lead to ransomware
This query visualises total inbound emails with Malware detections summarizing the data by the top recipient email address (RecipientEmailAddress)
LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavior and escalated its operations in 2021. Today, beyond using resources for its traditional bot and mining activities, LemonDuck steals credentials, removes security controls, spreads via emails, moves laterally, and ultimately drops more tools for human-operated activity.
This query helps reviewing count of total ZAP events
This query helps report daily on total number of emails, total number of emails detected aby Defender for Office 365
Check if file hashes published in the recent abuse.ch feed are found in your mail flow scanned by Office 365 ATP.
This query helps reviewing zero day threats via URL and file detonations
This query visualises total emails with Malware detections summarizing the data by various Malware detection technologies/controls.
How much phish and malware emails vs good emails received the user in the given timeframe.
This query visualises bad traffic (% of emails with threats) compared to total inbound emails over time summarising the data daily.
This query provides insights on users who clicked on a suspicious URL
This query visualises the daily amount of admin false negative submission by submission type.
This query helps reviewing external top malicious email sender with malware or phishing emails in an organization in last 30 days
This query helps reviewing email malware detection cases
Page 10 of 11