Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,593 detections
Filters
Last updated
All Time
Detection languages
1,146
134
65
63
53
Contributors
368
274
239
197
70
Categories
980
373
271
227
139
Platforms
866
505
164
158
149
Products / Services
944
297
133
113
108
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,593
CVEs
2
1
1
1
1
IDS Classtypes
18
5
4
1
1
IDS Protocols
15
8
4
3
Detects the creation of WebDAV temporary files with potentially suspicious extensions
'This query identifies Microsoft-signed Binaries and Scripts that are not system initiated. This technique is commonly used in phishing attacks'
In this query, we hunt for inbound emails having URLs from QR codes and suspicious keywords in subject
This query helps in reviewing top policies for admin overrides (Allow/Block)
This query will hunt for files matching the current abuse.ch recent threat feed based on Sha256. Currently the query is set up to analyze the last day worth of events, but this is configurable using the MaxAge variable.
Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.
This query visualises the total amount of emails subject to an admin policy with action of allow, independent of action taken, summarizing the data by type of override
Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.
Listing Email Remediation Actions performed via Explorer in Defender for Office 365
Graph of MDO detections trended over time
In this detection, we track emails with suspicious keywords in subjects.
'Identifies a match across various data feeds for domains related to an actor tracked by Microsoft as Star Blizzard.'
In this query, we hunt for inbound emails having URLs from QR codes and send by non-prevalent senders
This query helps in reviewing malicious emails allowed due to admin overrides
This query visualises total emails with Phish detections over time summarizing the data daily by Phish detection technologies/controls used for detecting unknown-unique phish
Detects a suspicious execution of a Microsoft HTML Help (HH.exe)
This query helps reviewing URL click count by ClickAction
In this query, we are looking for Url clicks on emails which are generated the alert-A potentially malicious URL click was detected
This query helps hunting for email conversation take over attempts
This query finds the 10 latest logons performed by email recipients within 30 minutes after they received known malicious emails. You can use this query to check whether the accounts of the email recipients have been compromised.
This query helps hunting for Automated email notifications and suspicious sign-in activity
Page 67 of 76