Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,735 detections
Filters
Last updated
All Time
Detection languages
1,216
144
98
80
59
Contributors
496
324
298
171
55
Categories
20,440
11,814
5,871
5,145
4,864
1,735
Platforms
1,163
328
260
244
163
Products / Services
1,244
200
166
146
138
MITRE Techniques
983
923
765
247
245
CVEs
2
1
IDS Classtypes
68
33
19
10
8
IDS Protocols
90
24
15
15
This query helps reviewing zero day threats via URL and file detonations
In this detection,we hunt for emails with randomly named attachment names from the same sender to multiple recipients
How much phish and malware emails vs good emails received the user in the given timeframe.
Identify prior activity from this campaign using IOCs shared by Microsoft's Threat Intelligence Center, or MSTIC.
Read more: https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/
Read more: https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/
This query visualises the total amount of admin false negative submissions by the state of the submission.
This query visualises the original detection technology of emails submitted as phish false positive by admins
In this query, we hunt for inbound emails delivered having URLs from QR codes
This query visualises bad traffic (% of emails with threats) compared to total inbound emails over time summarising the data daily.
This query provides insights on users who clicked on a suspicious URL
In this query, we are looking URL click actions by URL in the last 7 days
This query visualises the daily amount of admin false negative submission by submission type.
This query provides insights on the detections done by SafeLinks protection in Defender for Office 365
This query helps reviewing count of spoof and impersonation detections done per sender IP
This query helps reviewing authentication failure count by authentication type. Update the authentication type below as DMARC, DKIM, SPM, CompAuth
This query helps hunting for good emails from senders with bad patterns
In this detection, we check the sender prevalence over the last 14 days and use the same to detect malicious activity via email containing QR code
In this query, we summarize volume of inbound emails with QR code URLs in last 30 days
This query helps reviewing external top malicious email sender with malware or phishing emails in an organization in last 30 days
This query helps reviewing email malware detection cases
This query provides insights on the detections done by Safe Attachment detections
This query visualises the total amount of admin false negative or false positive submissions by the verdict of the submission grading.
Page 81 of 83