Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
4
Contributors
3
1
Categories
2
2
2
1
1
Platforms
3
2
1
Products / Services
3
1
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan 10032025
Looks for multiple users that had their admin role removed by a single user within a certain period.
'Looks for multiple users that had their admin role removed by a single user within a certain period.
The default threshold is 5 removals, this can be edited in the query.'
The default threshold is 5 removals, this can be edited in the query.'
This query visualises total emails with Malware detections over time summarizing the data daily by Delivery Location.