Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
228 detections
Filters
Last updated
All Time
Detection languages
192
13
9
6
5
Contributors
70
39
34
22
15
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
191
50
12
11
10
Products / Services
196
33
25
24
7
MITRE Techniques
141
127
107
70
56
CVEs
2
IDS Classtypes
6
2
1
IDS Protocols
9
This Query is oriented to identify Malicious URL sent via Microsoft Teams and detect possible hits based on online Malware sites reported by the TI Feed URL Haus.
Detects inbound emails with a Virtual Hard Disk (VHDX) file attachment. This technique has been used by APT-C-60 to deliver the SpyGlace backdoor, often disguised as a job application.
This KQL is focus on gather statistics related to hackers activities over our tenants, such as the number of emails sent tagged as threats. Below, I’ve provided KQL queries to help identify the risky ASNs mentioned at the beggining.
You can adjust the filtering criteria by modifying the line: “| where SuspiciousPercentage > 95 and Total_different_IPs > 10” based on your specific requirements.
You can adjust the filtering criteria by modifying the line: “| where SuspiciousPercentage > 95 and Total_different_IPs > 10” based on your specific requirements.
This rule detects and correlates Microsoft Defender's Zero-hour Auto Purge (ZAP) actions on emails. It joins original email delivery events with subsequent ZAP actions (Malware ZAP or Phish ZAP) to calculate the dwell time between an email's delivery and its removal. This helps in understanding how long a malicious or phishing email was present in a user's inbox before being remediated, which is crucial for incident response and assessing potential user interaction with the threat.
Detects incoming emails that contain suspicious attachment types (e.g., RAR, ZIP) or links to file-sharing services, combined with subject lines commonly used in phishing campaigns. This pattern is indicative of initial access attempts via spear-phishing.
This rule identifies logon attempts on any device within 30 minutes of a user receiving an email categorized as malware, phishing, or spam. It correlates email event data with identity logon events to detect potential compromise scenarios where a user might interact with a malicious email and subsequently log on, possibly indicating a successful initial access or credential compromise.
This rule detects when an email with a detected threat (e.g., malware, phishing) has an attachment that is subsequently observed on an endpoint device. This indicates that a malicious attachment from an email was downloaded and executed or saved on a device.
This search will find all inbound emails with attachments with filenames ending .lnk, indicative of a Windows Shortcut file.
This has been observed in the Serpentin#Cloud campaign
This has been observed in the Serpentin#Cloud campaign
This query helps calculate overall efficacy of MDO based on threats blocked pre-delivery, post-delivery cleanups, or were uncaught.
KQL Query
This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious .SVG file has been delivered into an Inbox.
This query visualises emails with Spam detections (Normal confidence) summarizing the data by Delivery Location.
This query visualises total emails with Spam detections over time by various Spam Detection technologies/controls.
KQL Query from file: Hunting New Variant of Snake Keylogger
KQL Query from file: One-Click ANY RUN Storm-1747 KQL Scan
KQL Query from file: Exposure Management + Defender for Office 365
KQL Query from file: LockBit Black Ransomware
This query visualises total emails with Spam detections summarizing the data by various Spam detection technologies/controls.
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan 05052025
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan
KQL Query from file: MDO Email Threat Classification By ISP
Page 7 of 11