Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,735 detections
Filters
Last updated
All Time
Detection languages
1,216
144
98
80
59
Contributors
496
324
298
171
55
Categories
20,440
11,814
5,871
5,145
4,864
1,735
Platforms
1,163
328
260
244
163
Products / Services
1,244
200
166
146
138
MITRE Techniques
983
923
765
247
245
CVEs
2
1
IDS Classtypes
68
33
19
10
8
IDS Protocols
90
24
15
15
This query visualises total inbound emails with Phish detections summarizing the data by the top recipient email address (RecipientEmailAddress)
This query visualises the amount of emails subject to a user type policy with action of block, summarizing the data daily
StrRAT is a Java-based remote access tool which steals browser credentials, logs keystrokes and take remote control of infected systems. It also has a module to download additional payload onto to the infected machine based on C2 server command. Additionally, this threat also has a ransomware encryption/decryption module which appends .crimson extension.
This query helps in checking for spoofing attempts on the domain with Authentication failures
This query helps reviewing admin reported email submissions
In this query, we are looking for Url clicks on emails which get actioned by Zerohour auto purge
This query helps reviewing Malware, Phishing, Spam emails caught per day
This query helps reviewing top 100 malicious senders
This query helps hunting for top outbound recipient domains which are sending inbound emails with threats
The query helps detect emails associated with the open redirector URL campaign using Defender for Office 365 data.
This query visualises the top admins performing false negative submissions
In this detection approach, we correlate email from non-prevalent senders in the organization with impersonation intents
This query visualises total emails with Phish detections over time summarizing the data daily by Delivery Location.
This query visualises total emails with Phish detections summarizing the data by various Phish detection technologies/controls
LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavior and escalated its operations in 2021. Today, beyond using resources for its traditional bot and mining activities, LemonDuck steals credentials, removes security controls, spreads via emails, moves laterally, and ultimately drops more tools for human-operated activity.
Qakbot operators have been abusing the Craigslist messaging system to send malicious emails. These emails contain non-clickable links to malicious domains impersonating Craigslist, which the user is instructed to manually type into the address bar to access.
Use this query to locate emails and malicious downloads related to the IcedId activity that can lead to ransomware
This query visualises the daily amount of admin false positive submission by submission type.
This query helps reviewing mail that is likely a reply but there is no history of the people chatting and the domain is new
This query helps reviewing count of total ZAP events
This query helps report daily on total number of emails, total number of emails detected aby Defender for Office 365
Page 80 of 83