Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,598 detections
Filters
Last updated
All Time
Detection languages
1,151
134
65
63
53
Contributors
368
274
239
197
70
Categories
983
375
271
227
140
Platforms
871
506
164
160
149
Products / Services
949
298
133
113
108
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
1,598
CVEs
2
1
1
1
1
IDS Classtypes
18
5
4
1
1
IDS Protocols
15
8
4
3
KQL Query from file: Direct Send Abuse Detection
This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious .SVG file has been delivered into an Inbox.
KQL Query
KQL Query
KQL Query from file: FileFix Detection
This query visualises emails with Phish detections (High confidence) summarizing the data by Delivery Location.
This query visualises total emails with Phish detections over time summarizing the data daily by Delivery Location.
KQL Query from file: Detecting External Microsoft Teams Spray
KQL Query
KQL Query from file: Sentinel All-In-One IP ThreatHunt
KQL Query from file: ClickFix social engineering attack detection
This query visualises emails with Phish detections (Normal confidence) summarizing the data by Delivery Location.
This query visualises total inbound emails with Spam detections.
This query visualises top 15 users targeted with Spam with summarized spam detections.
KQL Query from file: The Hunt for QR Phisher
This query visualises total inbound emails with Spam detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain).
This query visualises emails with Spam detections (Normal confidence) summarizing the data by Delivery Location.
KQL Query
This query visualises total emails with Spam detections over time by various Spam Detection technologies/controls.
KQL Query from file: The Hunt for Blob Phishing Mail Domain
KQL Query from file: Hunting malicious oauth grant by phished user
Page 60 of 77