Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,631 detections
Filters
Last updated
All Time
Detection languages
1,055
161
128
83
72
Contributors
427
386
258
93
93
Categories
923
331
312
289
237
Platforms
768
403
356
303
295
Products / Services
820
308
216
159
157
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,631
CVEs
3
2
1
1
1
IDS Classtypes
108
26
18
5
3
IDS Protocols
100
33
20
3
This query visualises the original detection technology of emails submitted as phish false positive by admins
In this query, we hunt for inbound emails delivered having URLs from QR codes
This query visualises bad traffic (% of emails with threats) compared to total inbound emails over time summarising the data daily.
This query provides insights on users who clicked on a suspicious URL
This query provides insights on the detections done by SafeLinks protection in Defender for Office 365
Bazacall uses malicious Excel files to execute payloads on affected devices.
This query looks for a Word document attachment, from which a link was clicked, and after which there was a browser download.
This query is not noisy, but most of its results are clean.
It can also hserve as reference for other queries on email attachments, on browser downloads or for queries that join multiple events by time.
Tags: #EmailAttachment, #WordLink, #BrowserDownload, #Phishing, #DedupFileCreate.
Implementation comment #1: Matching events by time.
Matching the 3 different events (saving attachment, clicking on link, downloading file) is done purely by time difference - so could sometimes link together unrelated events.
Doing a more exact lookup would create a much more complex query due to.
Implementation comment #2: Deduping DeviceFileEvents.
Oftentimes there are multiple DeviceFileEvents for a single file - e.g. if the file keeps being appended into before being closed.
So, we query only for the last reported file state to ignore intermediate file states.
Explaining the underlying data:.
BrowserLaunchedToOpenUrl event:.
This query uses the BrowserLaunchedToOpenUrl event, that includes clicks on http:// or https:// links (clicks outside of browsers), or on .lnk files.
For this event, RemoteUrl contains the opened URL.
This query is not noisy, but most of its results are clean.
It can also hserve as reference for other queries on email attachments, on browser downloads or for queries that join multiple events by time.
Tags: #EmailAttachment, #WordLink, #BrowserDownload, #Phishing, #DedupFileCreate.
Implementation comment #1: Matching events by time.
Matching the 3 different events (saving attachment, clicking on link, downloading file) is done purely by time difference - so could sometimes link together unrelated events.
Doing a more exact lookup would create a much more complex query due to.
Implementation comment #2: Deduping DeviceFileEvents.
Oftentimes there are multiple DeviceFileEvents for a single file - e.g. if the file keeps being appended into before being closed.
So, we query only for the last reported file state to ignore intermediate file states.
Explaining the underlying data:.
BrowserLaunchedToOpenUrl event:.
This query uses the BrowserLaunchedToOpenUrl event, that includes clicks on http:// or https:// links (clicks outside of browsers), or on .lnk files.
For this event, RemoteUrl contains the opened URL.
This query helps hunting for good emails from senders with bad patterns
In this detection, we check the sender prevalence over the last 14 days and use the same to detect malicious activity via email containing QR code
In this query, we summarize volume of inbound emails with QR code URLs in last 30 days
This query helps reviewing external top malicious email sender with malware or phishing emails in an organization in last 30 days
This query provides insights on the detections done by Safe Attachment detections
This query visualises the total amount of admin false negative or false positive submissions by the verdict of the submission grading.
This query visualises the total amount of admin false positive submission by submission type.
This query visualises the amount of emails subject to a user type policy with action of allow, summarizing the data by type of override and threats type found
Use this query to find emails with message IDs that resemble IDs used in known attack emails and contain a link a document in Google Docs. These behaviors have
been observed leading to ransomware attacks.
been observed leading to ransomware attacks.
This query helps reviewing top targeted users with malware or phishing emails in an organization in last 30 days
This query helps surface phishing campaigns associated with Appspot abuse.
This query helps reviewing malicious clicks where user was allowed to proceed through malicious URL page.
One of the tricks used in phishing is obfuscating the domain name in a URL by
using the @ symbol. This technique goes all the way back to the original RFC
for URLs, RFC 1738. When you specify an @ in the DNS portion of a URL it denotes
that the left side of the DNS name holds a username and password for
authentication to the server on the right side of the @ sign. Unfortunately,
an attacker can use this technique to trick a user by formatting the URL as
http://www.trusteddomain.com@www.realdomain.com/. When a user sees the link
may they think they're going to www.trusteddomain.com when in fact they are
going to www.realdomain.com. For a working example, try this:
http://www.google.com@www.bing.com/.
This query finds this technique in URLs embedded within e-mails and highlights
the fake and real domains.
using the @ symbol. This technique goes all the way back to the original RFC
for URLs, RFC 1738. When you specify an @ in the DNS portion of a URL it denotes
that the left side of the DNS name holds a username and password for
authentication to the server on the right side of the @ sign. Unfortunately,
an attacker can use this technique to trick a user by formatting the URL as
http://www.trusteddomain.com@www.realdomain.com/. When a user sees the link
may they think they're going to www.trusteddomain.com when in fact they are
going to www.realdomain.com. For a working example, try this:
http://www.google.com@www.bing.com/.
This query finds this technique in URLs embedded within e-mails and highlights
the fake and real domains.
Detects strong indicators of a successful device code phishing attack. This rule correlates email events containing Microsoft device login URLs with subsequent Microsoft Entra ID authentication attempts that result in a specific error code (50199 or 0), indicating the user was prompted to confirm the application. The time window for correlation is set to 16 minutes, accounting for the typical 15-minute expiration of device codes.
Page 77 of 78