Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
60 detections
Filters
Last updated
All Time
Detection languages
49
5
3
1
1
Contributors
25
11
7
5
4
Categories
52
34
7
4
2
Platforms
53
8
4
2
1
Products / Services
53
10
6
4
4
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
3
IDS Protocols
3
This query visualises total emails with Phish (BEC) Spoof detections by Detection Technology over time
This query visualises total emails with Spoof - DMARC fails summarizing the data daily.
This query visualises total emails with Spoof - Composite Authentication fails summarizing the data daily.
This query visualises the amount of phish emails that are quarantined, summarized daily by the detection method
This query helps reviewing count of phish detections done by spoof detection methods
In this query, we are looking for emails containing malware accessed on a unmanaged device
Intent:
- Use MTP capability to look for insider threat potential risk indicators
- Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
Definition of Insider Threat:
"The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.
- Use MTP capability to look for insider threat potential risk indicators
- Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
Definition of Insider Threat:
"The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.
This query helps in reviewing top policies for user overrides (Allow/Block)
This query visualises total emails with Malware detections summarizing the data by ThreatNames of the malware detected.
This query visualises total emails with Phish detections over time summarizing the data daily by various Phish Detection technologies/controls
This query helps reviewing incoming email messages where the Display Name of the sender contains own or other partner company/brand name
Hunting for credential phishing using the "Referral" infrastructure using Defender for Office 365 data
This query correlates Microsoft Defender for Office 365 signals and Microsoft Entra ID identity data to find the relevant endpoint event BrowerLaunchedToOpen in Microsoft Defender ATP.
This event reflects relevant clicks on the malicious URL in the spear-phishing email recognized by Microsoft Defender for Office 365.
This event reflects relevant clicks on the malicious URL in the spear-phishing email recognized by Microsoft Defender for Office 365.
This query helps reviewing malicious email detections by detection methods
This query helps in checking for spoofing attempts on the domain with Authentication failures
This query helps reviewing count of spoof and impersonation detections done per sender IP
This query helps reviewing authentication failure count by authentication type. Update the authentication type below as DMARC, DKIM, SPM, CompAuth
This analytic detects SSL certificates with Punycode domains in the SSL issuer email domain, identified by the prefix "xn--". It leverages the Certificates Datamodel to flag these domains and uses CyberChef for decoding. This activity is significant as Punycode can be used for domain spoofing and phishing attacks. If confirmed malicious, attackers could deceive users and systems, potentially leading to unauthorized access and data breaches.
Page 3 of 3