Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,593 detections
Filters
Last updated
All Time
Detection languages
1,146
134
65
63
53
Contributors
368
274
239
197
70
Categories
980
373
271
227
139
Platforms
866
505
164
158
149
Products / Services
944
297
133
113
108
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,593
CVEs
2
1
1
1
1
IDS Classtypes
18
5
4
1
1
IDS Protocols
15
8
4
3
Snip3 is a family of related remote access trojans. Although the malware in this family contain numerous small variations, they all exhibit similar behaviors and techniques.
The following query looks for keywords observed in emails involved in a Snip3-associated campaign in April and May of 2021. The emails often have an aviation theme, and the campaign primarily targets organizations involved in travel or aviation. Note that keywords may change overtime. These emails were used to send malicious legitimate hosting provider links that redirected to VBS documents hosting loaders. The loaders initiate RevengeRAT or AsyncRAT downloads that eventually establish persistence on targets and exfiltrate data.
The following query looks for keywords observed in emails involved in a Snip3-associated campaign in April and May of 2021. The emails often have an aviation theme, and the campaign primarily targets organizations involved in travel or aviation. Note that keywords may change overtime. These emails were used to send malicious legitimate hosting provider links that redirected to VBS documents hosting loaders. The loaders initiate RevengeRAT or AsyncRAT downloads that eventually establish persistence on targets and exfiltrate data.
'This query identifies matches based on domain IOCs related to Star Blizzard against Microsoft Defender for Endpoint device network connections'
This query visualises emails submitted by admins as false negatives, summarizing the data by top 10 sender domains of those emails
This query helps reviewing malicious email detections by detection methods
This query helps reviewing count of users attacked more than x times average.
This query visualises total emails with Malware detections over time summarizing the data daily by various Malware detection technologies/controls.
This query visualises total inbound emails with Phish detections summarizing the data by the top recipient email address (RecipientEmailAddress)
This query visualises the amount of emails subject to a user type policy with action of block, summarizing the data daily
BazaCall is a campaign that manipulate users into calling a customer support center, where they are instructed to download an Excel file to unsubscribe from a phony service. When the user opens the Excel file, they are prompted to enable a malicious macro that infects their device with BazaLoader.
This query hunts for an attacker-created copy of certutil.exe, a legitimate process, which the macro uses to download BazaLoader.
This query hunts for an attacker-created copy of certutil.exe, a legitimate process, which the macro uses to download BazaLoader.
StrRAT is a Java-based remote access tool which steals browser credentials, logs keystrokes and take remote control of infected systems. It also has a module to download additional payload onto to the infected machine based on C2 server command. Additionally, this threat also has a ransomware encryption/decryption module which appends .crimson extension.
This query helps in checking for spoofing attempts on the domain with Authentication failures
This query helps reviewing admin reported email submissions
This query visualises emails submitted by admins as false positives, summarizing the data by top 10 sender domains of those emails
This query helps hunt for emails with malicious attachments based on SH256 hash from external IOC source
Jupyter, otherwise known as SolarMarker, is a malware family and cluster of components known for its info-stealing and backdoor capabilities that mainly proliferates through search engine optimization manipulation and malicious advertising in order to successfully encourage users to download malicious templates and documents. This malware has been popular since 2020 and currently is still active as of 2021.
In this query, we are looking for Url clicks on emails which get actioned by Zerohour auto purge
This query visualises emails submitted as false negatives by admins where emails where already detected by MDO but there was an admin policy override
This query helps reviewing Malware, Phishing, Spam emails caught per day
This query helps reviewing top 100 malicious senders
This query helps hunting for top outbound recipient domains which are sending inbound emails with threats
The query helps detect emails associated with the open redirector URL campaign using Defender for Office 365 data.
Page 70 of 76