Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
837 detections
Filters
Last updated
All Time
Detection languages
672
42
37
25
22
Contributors
227
154
141
123
42
Categories
20,440
11,814
5,871
5,145
4,864
837
Platforms
747
156
83
82
41
Products / Services
773
85
73
71
50
MITRE Techniques
375
287
237
187
184
CVEs
5
1
1
1
1
IDS Classtypes
3
3
2
IDS Protocols
5
3
This query visualises total inbound emails with Phish detections summarizing the data by the top recipient email address (RecipientEmailAddress)
This query visualises the amount of emails subject to a user type policy with action of block, summarizing the data daily
This query visualises emails submitted as false negatives by admins where emails where already detected by MDO but there was an admin policy override
This query helps hunting for top outbound recipient domains which are sending inbound emails with threats
This query helps report on who Previewed/Downloaded email messages using the Email entity page in Defender for Office 365
Use this query to locate emails with subject indicators of a reply or forward, and the attachment is a .doc, or a .zip containing a .doc. Review results for suspicious emails.
IcedId can lead to ransomware
IcedId can lead to ransomware
This query visualises the original detection technology of emails submitted as spam false positive by admins
This query helps in checking the sender-recipient contact establishment status
In this detection approach, we correlate email from non-prevalent senders in the organization with impersonation intents
This query visualises total inbound emails with Malware detections summarizing the data by the top email sender P2 domain (SenderFromDomain)
This query visualises total inbound emails with Malware detections summarizing the data by the top recipient email address (RecipientEmailAddress)
This query visualises total emails with Phish detections over time summarizing the data daily by Delivery Location.
LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavior and escalated its operations in 2021. Today, beyond using resources for its traditional bot and mining activities, LemonDuck steals credentials, removes security controls, spreads via emails, moves laterally, and ultimately drops more tools for human-operated activity.
Identify prior activity from this campaign using IOCs shared by Microsoft's Threat Intelligence Center, or MSTIC.
Read more: https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/
Read more: https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/
This query helps reviewing mail that is likely a reply but there is no history of the people chatting and the domain is new
This query visualises all emails submitted as false positive by admins summarizing by the original filter verdict threat type
In this detection,we hunt for emails with randomly named attachment names from the same sender to multiple recipients
How much phish and malware emails vs good emails received the user in the given timeframe.
Identify prior activity from this campaign using IOCs shared by Microsoft's Threat Intelligence Center, or MSTIC.
Read more: https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/
Read more: https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/
Total Submissions by Submission State
In this query, we hunt for inbound emails delivered having URLs from QR codes
Page 38 of 40