Detections

Explore public detection logic contributed by the community across SIEM and rule languages.

1,593 detections

This query visualises emails with Phish detections (High confidence) summarizing the data by Delivery Location.
Azure Sentinel@AzureSentinel
avatar
AzureSentinel
1 year ago
1092
This query visualises total emails with Phish detections over time summarizing the data daily by Delivery Location.
Azure Sentinel@AzureSentinel
avatar
AzureSentinel
1 year ago
1087
KQL Query from file: Detecting External Microsoft Teams Spray
avatar
Steven Lim@KQLWizard
avatar
SlimKQL
1 year ago
181165
KQL Query
avatar
Steven Lim@KQLWizard
avatar
SlimKQL
1 year ago
110162
KQL Query from file: Sentinel All-In-One IP ThreatHunt
avatar
Steven Lim@KQLWizard
avatar
SlimKQL
1 year ago
132159
KQL Query from file: ClickFix social engineering attack detection
avatar
Steven Lim@KQLWizard
avatar
SlimKQL
1 year ago
311159
This query visualises emails with Phish detections (Normal confidence) summarizing the data by Delivery Location.
Azure Sentinel@AzureSentinel
avatar
AzureSentinel
1 year ago
0082
This query visualises total inbound emails with Spam detections.
Azure Sentinel@AzureSentinel
avatar
AzureSentinel
1 year ago
3081
This query visualises top 15 users targeted with Spam with summarized spam detections.
Azure Sentinel@AzureSentinel
avatar
AzureSentinel
1 year ago
3072
KQL Query from file: The Hunt for QR Phisher
avatar
Steven Lim@KQLWizard
avatar
SlimKQL
1 year ago
110134
This query visualises total inbound emails with Spam detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain).
Azure Sentinel@AzureSentinel
avatar
AzureSentinel
1 year ago
3070
This query visualises emails with Spam detections (Normal confidence) summarizing the data by Delivery Location.
Azure Sentinel@AzureSentinel
avatar
AzureSentinel
1 year ago
0069
KQL Query
avatar
Steven Lim@KQLWizard
avatar
SlimKQL
1 year ago
120129
This query visualises total emails with Spam detections over time by various Spam Detection technologies/controls.
Azure Sentinel@AzureSentinel
avatar
AzureSentinel
1 year ago
0059
KQL Query from file: The Hunt for Blob Phishing Mail Domain
avatar
Steven Lim@KQLWizard
avatar
SlimKQL
1 year ago
40100
KQL Query from file: Hunting malicious oauth grant by phished user
avatar
Steven Lim@KQLWizard
avatar
SlimKQL
1 year ago
7099
This query visualises emails with Spam detections (High confidence) summarizing the data by Delivery Location.
Azure Sentinel@AzureSentinel
avatar
AzureSentinel
1 year ago
0055
KQL Query from file: Social Engineering Attack Detection
avatar
Steven Lim@KQLWizard
avatar
SlimKQL
1 year ago
10099
KQL Query from file: Hunting Rockstar 2FA
avatar
Steven Lim@KQLWizard
avatar
SlimKQL
1 year ago
8097
KQL Query from file: Threat hunting voice phishing for Teams
avatar
Steven Lim@KQLWizard
avatar
SlimKQL
1 year ago
3093
This query visualises total emails with Spam detections over time summarizing the data daily
Azure Sentinel@AzureSentinel
avatar
AzureSentinel
1 year ago
0050
Page 60 of 76