Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,592 detections
Filters
Last updated
All Time
Detection languages
1,145
134
65
63
53
Contributors
368
274
239
197
70
Categories
980
373
271
227
139
Platforms
866
504
164
158
149
Products / Services
944
297
133
113
108
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,592
CVEs
2
1
1
1
1
IDS Classtypes
18
5
4
1
1
IDS Protocols
15
8
4
3
Total Submissions by Submission Type
This query helps hunting for good emails from senders with bad patterns
In this detection, we check the sender prevalence over the last 14 days and use the same to detect malicious activity via email containing QR code
In this query, we summarize volume of inbound emails with QR code URLs in last 30 days
This query helps reviewing external top malicious email sender with malware or phishing emails in an organization in last 30 days
This query helps reviewing email malware detection cases
This query provides insights on the detections done by Safe Attachment detections
This query visualises the total amount of admin false negative or false positive submissions by the verdict of the submission grading.
This query helps reviewing user reported email submissions
This query visualises the total amount of admin false positive submission by submission type.
This query helps reviewing status of submissions
This query visualises the top admins performing false positive submissions
This query visualises the amount of emails subject to a user type policy with action of allow, summarizing the data by type of override and threats type found
Use this query to find emails with message IDs that resemble IDs used in known attack emails and contain a link a document in Google Docs. These behaviors have
been observed leading to ransomware attacks.
been observed leading to ransomware attacks.
This query helps reviewing top 100 senders in your organization in last 30 days
In this detection, we track emails with personalized subjects.
In this detection,we use Email reported by user as malware or phish MDO alert as a starting point to identify the scope of a campaign.
This query helps reviewing list of top 10 URL domains attacking the organization
This query helps reviewing top targeted users with malware or phishing emails in an organization in last 30 days
This query helps hunting for emails from a sender with at least one email in quarantine
This query helps surface phishing campaigns associated with Appspot abuse.
Page 73 of 76