Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
837 detections
Filters
Last updated
All Time
Detection languages
672
42
37
25
22
Contributors
227
154
141
123
42
Categories
20,440
11,814
5,871
5,145
4,864
837
Platforms
747
156
83
82
41
Products / Services
773
85
73
71
50
MITRE Techniques
375
287
237
187
184
CVEs
5
1
1
1
1
IDS Classtypes
3
3
2
IDS Protocols
5
3
This query visualises bad traffic (% of emails with threats) compared to total inbound emails over time summarising the data daily.
This query helps in reviewing group Quarantine released messages by detection type. Useful to see what is leading to the largest number of messages being released.
This query visualises the amount of emails subject to an admin policy with action of block, summarizing the data daily
This query helps reviewing inbound / outbound / intra-org emails by domain per day
This query helps report on email access by administrators
Total Submissions by Submission Type
This query helps hunting for good emails from senders with bad patterns
In this detection, we check the sender prevalence over the last 14 days and use the same to detect malicious activity via email containing QR code
In this query, we summarize volume of inbound emails with QR code URLs in last 30 days
This query helps reviewing external top malicious email sender with malware or phishing emails in an organization in last 30 days
This query helps in reviewing malicious emails allowed due to admin overrides
This query visualises the amount of emails subject to a user type policy with action of allow, summarizing the data by type of override and threats type found
Use this query to find emails with message IDs that resemble IDs used in known attack emails and contain a link a document in Google Docs. These behaviors have
been observed leading to ransomware attacks.
been observed leading to ransomware attacks.
This query helps reviewing top 100 senders in your organization in last 30 days
In this detection, we track emails with personalized subjects.
In this detection,we use Email reported by user as malware or phish MDO alert as a starting point to identify the scope of a campaign.
This query helps reviewing top targeted users with malware or phishing emails in an organization in last 30 days
This query helps hunting for emails from a sender with at least one email in quarantine
This query helps reviewing the list of top 10% of most attacked users
Advanced Hunting has default timezone as UTC time. Filters in Advanced Hunting also work in UTC by default whereas query results are shown in local time if user has selected local time zone in security center settings.
This query helps getting GeoIP information of emails SenderIPv4 addresses.
Page 39 of 40