Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12 detections
Filters
Last updated
All Time
Detection languages
11
1
Contributors
8
3
1
Categories
5
4
4
4
3
Platforms
6
6
4
3
1
Products / Services
8
4
2
2
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
KQL Query
KQL Query from file: Malicious FIDO2 Registration Threat Detection
KQL Query from file: Entra Cross-Tenant Activity Monitoring
KQL Query from file: Hunting Malicious Copilot Agent
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan 05052025
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan 24022025
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan 19052025
This query visualises top outbound recipient domains by outbound email volume and shows total number of inbound emails with Threats from the same domains (as inbound senders)
'This content is employed to correlate with Microsoft Defender XDR phishing-related alerts. It focuses on instances where a user successfully connects to a phishing URL from a non-Microsoft network device and subsequently makes successful sign-in attempts from the phishing IP address.'
'This hunting query identifies Zoom room systems with high CPU alerts that may be a sign of device compromise.'
This rule detects the creation or launch of processes or files that match known Indicators of Compromise (IOCs) from a MISP instance and exhibit low prevalence (3 or fewer occurrences) over a 10-day rolling period. This combination suggests potentially malicious activity that is not widespread, indicating a targeted attack or early-stage malware.
