Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,593 detections
Filters
Last updated
All Time
Detection languages
1,146
134
65
63
53
Contributors
368
274
239
197
70
Categories
980
373
271
227
139
Platforms
866
505
164
158
149
Products / Services
944
297
133
113
108
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,593
CVEs
2
1
1
1
1
IDS Classtypes
18
5
4
1
1
IDS Protocols
15
8
4
3
This query visualises the amount of phish emails that are quarantined, summarized daily by the detection method
This query visualises the daily amount of emails that had a post delivery action from zero-hour auto purge, summarizing by phish,spam or malware detection action
Detects potential malicious JavaScript obfuscated using the JSFireTruck technique, specifically looking for the combination of core JSFireTruck characters and checks for document.referrer, often used to target traffic from search engines.
This query visualises the amount of emails that had a post delivery action, summarizing the data daily by the final location as a result of the action
This query visualises the total amount of phish emails that are quarantined, summarized by the detection method
This query helps hunting for possible device code Phishing attempts
This query visualises the daily amount of emails that had an admin post delivery action, summarizing the data by action type
'The purpose of this content is to identify successful phishing links accessed by users. Once a user clicks on a phishing link, we observe successful network activity originating from non-Microsoft network devices. These devices may include Palo Alto Networks, Fortinet, Check Point, and Zscaler devices.'
This query visualises the daily amount of emails that had a post delivery action from zero-hour auto purge.
This query visualises emails released from quarantine and summarizing the result by the original filter verdict
In this detection,we hunt for any sign-in attempt from a non-managed, non-compliant, untrusted device.
This query visualises the amount of spam emails that are quarantined, summarized daily by the detection method
This query looks for Teams messages from an external user with a suspicious display name.
This query looks for possible Teams phishing activity.
This query helps reviewing count of phish detections done by spoof detection methods
'This content is employed to correlate with Microsoft Defender XDR phishing-related alerts. It focuses on instances where a user successfully connects to a phishing URL from a non-Microsoft network device and subsequently makes successful sign-in attempts from the phishing IP address.'
Detects a suspicious child process of a Microsoft HTML Help (HH.exe)
Detects a suspicious execution of a Microsoft HTML Help (HH.exe)
This query helps hunting for BEC - File sharing tactics - Dropbox
This query helps to hunt for possible email bombing attacks in Microsoft Defender for Office 365.
This query visualises total emails with Malware detections over time summarizing the data daily by Malware detection technologies/controls used for detecting unknown-unique malware.
Page 66 of 76