Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
27 detections
Filters
Last updated
All Time
Detection languages
13
11
3
Contributors
10
6
4
3
1
Categories
12
11
10
9
8
Platforms
13
9
4
3
1
Products / Services
13
11
10
4
2
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
11
2
IDS Protocols
8
3
2
This query visualises user submissions where admin also performed 'mark and notify' action on the submission
Listing Email Remediation Actions performed via Explorer in Defender for Office 365
In this query, we hunt for inbound emails having URLs from QR codes and send by non-prevalent senders
This query helps hunting for email conversation take over attempts
// Detect Active Directory service accounts that are not active because their last logon was more than 14 days ago
// Replace XXX on line 4 with the naming convention start of your Active Directory service accounts
// Replace XXX on line 4 with the naming convention start of your Active Directory service accounts
Identify prior activity from this campaign using IOCs shared by Microsoft's Threat Intelligence Center, or MSTIC.
Read more: https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/
Read more: https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/
Page 2 of 2