Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,598 detections
Filters
Last updated
All Time
Detection languages
1,151
134
65
63
53
Contributors
368
274
239
197
70
Categories
983
375
271
227
140
Platforms
871
506
164
160
149
Products / Services
949
298
133
113
108
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
1,598
CVEs
2
1
1
1
1
IDS Classtypes
18
5
4
1
1
IDS Protocols
15
8
4
3
KQL Query
KQL Query from file: Defending against dot zip domain phishing attack
KQL Query from file: Golden Chickens TerraStealerV2 Malware Detection
KQL Query
KQL Query
KQL Query
KQL Query from file: Enhanced Cloudflare Phishing Email Detections
KQL Query
KQL Query
KQL Query from file: Hunt for High Volume Phish ISP
This query helps in reviewing malicious emails allowed due to user overrides
KQL Query
Identifies the top 10 external sender addresses delivering inbound emails classified as spam.
If you want to exclude your own organization's domains (including subdomains), add a filter after the spam filter, e.g.:
| where SenderFromAddress !contains ".yourdomain.com"
(Replace "yourdomain.com" with your actual domain.)
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
If you want to exclude your own organization's domains (including subdomains), add a filter after the spam filter, e.g.:
| where SenderFromAddress !contains ".yourdomain.com"
(Replace "yourdomain.com" with your actual domain.)
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
KQL Query
KQL Query from file: Blob URIs creation trend analysis
KQL Query
KQL Query
KQL Query
This query visualises total emails with Phish (BEC) Spoof detections by Detection Technology
Page 63 of 77