Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
57 detections
Filters
Last updated
All Time
Detection languages
27
18
6
3
2
Contributors
16
11
6
5
4
Categories
35
13
13
10
10
Platforms
25
19
11
4
4
Products / Services
26
18
14
5
4
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
6
4
4
3
1
IDS Protocols
14
3
1
Detects phishing emails containing QR codes rendered using HTML tables. This technique is used to evade image-based scanning and OCR security controls by representing the QR code as a grid of small, colored table cells (<td>) instead of a traditional image file.
This query detects URLs shared in Microsoft Teams messages, chats, or meetings that may represent potential security risks. It filters out internal domains, SharePoint URLs, placeholder links, and known system domains to focus specifically on unique external URLs being exchanged within the organization.
The detection is useful for identifying phishing attempts, malware distribution, unauthorized data sharing, or other unsafe activities originating from collaboration tools.
The detection is useful for identifying phishing attempts, malware distribution, unauthorized data sharing, or other unsafe activities originating from collaboration tools.
This query identifies when a suspicious SVG file, linked to known threat intelligence, is downloaded via a browser. This technique is often used for SVG smuggling, where attackers embed malicious JavaScript or links within the SVG's structure to bypass traditional content filters or sandboxing. Once rendered in the browser, the embedded content may redirect the victim to a malicious site or initiate further malicious activity.
KQL Query
KQL Query from file: Detecting External Microsoft Teams Spray
KQL Query from file: Advanced Vishing KQL Detection
KQL Query from file: Detecting TeamsPhisher attack with Azure Sentinel
KQL Query
KQL Query from file: Brands Impersonation Phishing Trend
KQL Query
Detects network connections to domains used by GrayAlpha (FIN7) for distributing malicious payloads via fake browser/software update pages, specifically targeting the 'cdnXX.click' pattern and '/download.php' endpoint. This activity is associated with the initial access phase, leading to the deployment of loaders like PowerNet or MaskBat.
This query looks for possible Teams phishing activity.
This query helps hunting for email conversation take over attempts
This query finds the 10 latest logons performed by email recipients within 30 minutes after they received known malicious emails. You can use this query to check whether the accounts of the email recipients have been compromised.
Bazacall uses malicious Excel files to execute payloads on affected devices.
Page 3 of 3