Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
This query helps in reviewing malicious emails allowed due to user overrides
KQL Query from file: Detecting Windows Downdate Abuse
KQL Query
SPL Query
Identifies the top 10 external sender addresses delivering inbound emails classified as spam.
If you want to exclude your own organization's domains (including subdomains), add a filter after the spam filter, e.g.:
| where SenderFromAddress !contains ".yourdomain.com"
(Replace "yourdomain.com" with your actual domain.)
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
If you want to exclude your own organization's domains (including subdomains), add a filter after the spam filter, e.g.:
| where SenderFromAddress !contains ".yourdomain.com"
(Replace "yourdomain.com" with your actual domain.)
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
KQL Query from file: Git Critical Vulnerability CVE-2024-32002
KQL Query
KQL Query from file: Blob URIs creation trend analysis
KQL Query
SPL Query from file: Failed Authentication to Non-existing Accounts
KQL Query
KQL Query from file: Detect CVE-2024-43572 Abuse
KQL Query
Detects the execution of the `hdiutil` utility on macOS to mount disk images. This activity can be associated with malware delivery, as adversaries often use disk images (.dmg files) to distribute malicious payloads. Monitoring this utility can help identify suspicious attempts to introduce or execute malware on a system.
This query visualises total emails with Phish (BEC) Spoof detections by Detection Technology
This query visualises total emails with Phish-Spoof-internal domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain).
This query visualises top outbound recipient domains by outbound email volume and shows total number of inbound emails with Threats from the same domains (as inbound senders)
This query visualises total emails with Phish (BEC) Impersonation detections by Detection Technology over time
Visualises the top 10 users with click attempts on URLs in emails detected as malware, helping analysts identify risky user behaviour and potential targets.
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
Visualises malicious URL clicks that were allowed through Safe Links over time, helping analysts identify when users bypass security controls and click on malicious content.
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
This query visualises total emails with Spoof-DMARC fails detections summarizing the data by the top email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain).
Page 182 of 235