Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,592 detections
Filters
Last updated
All Time
Detection languages
1,145
134
65
63
53
Contributors
368
274
239
197
70
Categories
980
373
271
227
139
Platforms
866
504
164
158
149
Products / Services
944
297
133
113
108
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,592
CVEs
2
1
1
1
1
IDS Classtypes
18
5
4
1
1
IDS Protocols
15
8
4
3
This detection approach correlates a user accessing an email with image/document attachments and a risky sign-in attempt from non-trusted devices.
This query helps hunt for emails with malicious URLs based on external IOC source
This query was originally published on Twitter, by @MsftSecIntel.
The query helps detect emails associated with a campaign that has used open redirector URLs. The campaign's URLs begin with the distinct pattern, hxxps://t. Attackers use URL redirection to manipulate users into visiting a malicious website or to evade detection.
Reference - https://twitter.com/MsftSecIntel
The query helps detect emails associated with a campaign that has used open redirector URLs. The campaign's URLs begin with the distinct pattern, hxxps://t. Attackers use URL redirection to manipulate users into visiting a malicious website or to evade detection.
Reference - https://twitter.com/MsftSecIntel
This query helps hunting for Emails containing links to IP addresses
This query visualises total emails with Malware detections summarizing the data by ThreatNames of the malware detected.
This query visualises total emails with Phish detections over time summarizing the data daily by various Phish Detection technologies/controls
This query helps reviewing incoming email messages where the Display Name of the sender contains own or other partner company/brand name
This query shows information about high confidence phish email that has been released from the Quarantine.
Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.
This query helps reviewing emails accessed by end users using cloud app events data
Detects a suspicious child process of a Microsoft HTML Help (HH.exe)
This query provides insights into AIR investigation actions in Microsoft Defender for Office 365.
This query visualises total emails with Malware detections over time summarizing the data daily by Delivery Location.
This query helps to find threats using display name impersonation for users not already protected with User Impersonation
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_judgement_panda_gtr19.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
This query checks devices for the presence of files that have been sent by a known malicious sender. To use this query, replace the email address with the address of the known malicious sender.
This query visualises total emails with Malware detections over time summarizing the data daily.
Hunting for credential phishing using the "Referral" infrastructure using Defender for Office 365 data
'Alerts in links that have been shared across multiple Zoom chat channels by the same user in a short space if time.
Adjust the threshold figure to change the number of channels a message needs to be posted in before an alert is raised.'
Adjust the threshold figure to change the number of channels a message needs to be posted in before an alert is raised.'
This query helps reviewing sender IPs sending malicious email of type Malware or Phish
Provides a summary of total number of detections
Page 68 of 76