Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
234 detections
Filters
Last updated
All Time
Detection languages
147
31
27
9
7
Contributors
56
43
24
19
15
Categories
89
80
79
56
43
Platforms
181
77
51
45
7
Products / Services
182
34
19
16
15
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
1
1
1
IDS Classtypes
3
1
IDS Protocols
3
This detection identifies when a one-on-one Microsoft Teams chat is initiated with an external domain that has not been observed in previous Teams chats (past 90 days) or recent email communications (past 15 days). This may indicate a new, potentially unsolicited or suspicious contact attempting to engage with an internal user, which could represent a social engineering attempt or early-stage reconnaissance.
KQL Query
KQL Query
This query visualises total emails with Spam detections over time by various Spam Detection technologies/controls.
KQL Query from file: Threat hunting voice phishing for Teams
KQL Query from file: MailItemsAccessed Defense
KQL Query from file: External Attack Surface Monitoring KQL
KQL Query
KQL Query from file: One-Click ANY RUN Storm-1747 KQL Scan
KQL Query from file: Exposure Management + Defender for Office 365
KQL Query from file: LockBit Black Ransomware
KQL Query from file: Hunting DragonForce with ANY.RUN Threat Intelligence
KQL Query from file: Detecting Teams Red Team Tool ConvoC2
KQL Query from file: CVE-2025-32705 Out-of-bounds Read Detection
KQL Query from file: MDO Email Threat Classification By ISP
KQL Query from file: MDO Email Threat Classification By Country
KQL Query from file: Detecting Misconfigured EXO Transport Rules
KQL Query
KQL Query
KQL Query from file: Outlook New Requirements for High‐Volume Senders
Page 8 of 12