Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,598 detections
Filters
Last updated
All Time
Detection languages
1,151
134
65
63
53
Contributors
368
274
239
197
70
Categories
983
375
271
227
140
Platforms
871
506
164
160
149
Products / Services
949
298
133
113
108
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
1,598
CVEs
2
1
1
1
1
IDS Classtypes
18
5
4
1
1
IDS Protocols
15
8
4
3
This query helps reviewing URL click count by ClickAction
In this query, we are looking for Url clicks on emails which are generated the alert-A potentially malicious URL click was detected
This query helps hunting for email conversation take over attempts
This query finds the 10 latest logons performed by email recipients within 30 minutes after they received known malicious emails. You can use this query to check whether the accounts of the email recipients have been compromised.
This query helps hunting for Automated email notifications and suspicious sign-in activity
This query helps in determining clickthroughs when email delivered because of detection overrides.
This detection approach correlates a user accessing an email with image/document attachments and a risky sign-in attempt from non-trusted devices.
This query helps hunt for emails with malicious URLs based on external IOC source
This query was originally published on Twitter, by @MsftSecIntel.
The query helps detect emails associated with a campaign that has used open redirector URLs. The campaign's URLs begin with the distinct pattern, hxxps://t. Attackers use URL redirection to manipulate users into visiting a malicious website or to evade detection.
Reference - https://twitter.com/MsftSecIntel
The query helps detect emails associated with a campaign that has used open redirector URLs. The campaign's URLs begin with the distinct pattern, hxxps://t. Attackers use URL redirection to manipulate users into visiting a malicious website or to evade detection.
Reference - https://twitter.com/MsftSecIntel
This query helps hunting for Emails containing links to IP addresses
This query visualises total emails with Malware detections summarizing the data by ThreatNames of the malware detected.
This query visualises total emails with Phish detections over time summarizing the data daily by various Phish Detection technologies/controls
This query helps reviewing incoming email messages where the Display Name of the sender contains own or other partner company/brand name
This query shows information about high confidence phish email that has been released from the Quarantine.
Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.
This query helps reviewing emails accessed by end users using cloud app events data
Detects a suspicious child process of a Microsoft HTML Help (HH.exe)
This query provides insights into AIR investigation actions in Microsoft Defender for Office 365.
This query visualises total emails with Malware detections over time summarizing the data daily by Delivery Location.
This query helps to find threats using display name impersonation for users not already protected with User Impersonation
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_judgement_panda_gtr19.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
Page 68 of 77