Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
5
Contributors
4
1
Categories
2
2
1
1
1
Platforms
3
2
1
Products / Services
2
2
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
KQL Query from file: Detecting Commvault Exploitation in Azure
This query was originally published on Twitter, by @MsftSecIntel.
The query helps detect emails associated with a campaign that has used open redirector URLs. The campaign's URLs begin with the distinct pattern, hxxps://t. Attackers use URL redirection to manipulate users into visiting a malicious website or to evade detection.
Reference - https://twitter.com/MsftSecIntel
The query helps detect emails associated with a campaign that has used open redirector URLs. The campaign's URLs begin with the distinct pattern, hxxps://t. Attackers use URL redirection to manipulate users into visiting a malicious website or to evade detection.
Reference - https://twitter.com/MsftSecIntel
This query correlates Microsoft Defender for Office 365 signals and Microsoft Entra ID identity data to find the relevant endpoint event BrowerLaunchedToOpen in Microsoft Defender ATP.
This event reflects relevant clicks on the malicious URL in the spear-phishing email recognized by Microsoft Defender for Office 365.
This event reflects relevant clicks on the malicious URL in the spear-phishing email recognized by Microsoft Defender for Office 365.
Total Controlled Folder Access events.
Total Controlled Folder Access events.