Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,598 detections
Filters
Last updated
All Time
Detection languages
1,151
134
65
63
53
Contributors
368
274
239
197
70
Categories
983
375
271
227
140
Platforms
871
506
164
160
149
Products / Services
949
298
133
113
108
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
1,598
CVEs
2
1
1
1
1
IDS Classtypes
18
5
4
1
1
IDS Protocols
15
8
4
3
This query checks devices for the presence of files that have been sent by a known malicious sender. To use this query, replace the email address with the address of the known malicious sender.
This query visualises total emails with Malware detections over time summarizing the data daily.
Hunting for credential phishing using the "Referral" infrastructure using Defender for Office 365 data
'Alerts in links that have been shared across multiple Zoom chat channels by the same user in a short space if time.
Adjust the threshold figure to change the number of channels a message needs to be posted in before an alert is raised.'
Adjust the threshold figure to change the number of channels a message needs to be posted in before an alert is raised.'
This query helps reviewing sender IPs sending malicious email of type Malware or Phish
Provides a summary of total number of detections
This query visualises total emails with Phish detections over time summarizing the data daily.
This query shows information about email that has been released from the Quarantine in Defender for Office 365.
Look for links opened from outlook.exe, followed by a browser download and then a SmartScreen app warning that was ignored by the user.
Read more about these events and this hunting approach in this post: https://techcommunity.microsoft.com/t5/forums/editpage/board-id/WDATPActor/message-id/34.
Data availability: SmartScreen events are available only on Windows 10 version 1703 and onwards.
Tags: #EmailLink, #BrowserDownload, #SmartScreen.
Read more about these events and this hunting approach in this post: https://techcommunity.microsoft.com/t5/forums/editpage/board-id/WDATPActor/message-id/34.
Data availability: SmartScreen events are available only on Windows 10 version 1703 and onwards.
Tags: #EmailLink, #BrowserDownload, #SmartScreen.
Query for links opened from mail apps - if a detection occurred right afterwards.
As there are many links opened from mails, to have a successful hunt we should have some filter or join with some other signal,.
Such as suspicious processes, network connections, etc.
Therefore, in this example, we query for alerts that might be related to links sent via email.
This could be indicative of a phishing or spear-phishing attacks.
Tags: #EmailLink, #Phishing, #GetNearbyAlerts.
Explaining the underlying data:.
This query uses the BrowserLaunchedToOpenUrl event, that includes clicks on http:// or https:// links (clicks outside of browsers), or on .lnk files.
For this event, RemoteUrl contains the opened URL.
As there are many links opened from mails, to have a successful hunt we should have some filter or join with some other signal,.
Such as suspicious processes, network connections, etc.
Therefore, in this example, we query for alerts that might be related to links sent via email.
This could be indicative of a phishing or spear-phishing attacks.
Tags: #EmailLink, #Phishing, #GetNearbyAlerts.
Explaining the underlying data:.
This query uses the BrowserLaunchedToOpenUrl event, that includes clicks on http:// or https:// links (clicks outside of browsers), or on .lnk files.
For this event, RemoteUrl contains the opened URL.
This query graphs top accounts performing user submissions
This query correlates Microsoft Defender for Office 365 signals and Microsoft Entra ID identity data to find the relevant endpoint event BrowerLaunchedToOpen in Microsoft Defender ATP.
This event reflects relevant clicks on the malicious URL in the spear-phishing email recognized by Microsoft Defender for Office 365.
This event reflects relevant clicks on the malicious URL in the spear-phishing email recognized by Microsoft Defender for Office 365.
This query identifies when a user clicks a link that opens a browser to navigate to a URL
which uses redirection. It then filters out any redirections to URLs in the same DNS namespace
as the originating URL. Redirection identification is done based on URL query parameters
outlined in the following article: https://www.bleepingcomputer.com/news/security/snapchat-amex-sites-abused-in-microsoft-365-phishing-attacks/
which uses redirection. It then filters out any redirections to URLs in the same DNS namespace
as the originating URL. Redirection identification is done based on URL query parameters
outlined in the following article: https://www.bleepingcomputer.com/news/security/snapchat-amex-sites-abused-in-microsoft-365-phishing-attacks/
Fake Replies
KQL
Use this query to find spoofed reply emails that contain certain keywords in the subject. The emails are also checked for a link to a document in Google Docs.
These attacks have been observed leading to ransomware
These attacks have been observed leading to ransomware
This query helps reviewing list of top users click on Phis URLs
This query visualises total inbound emails with Phish detections summarizing the data by the top email sender P2 domain (SenderFromDomain).
Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum
Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)
Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum
Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum
Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)
Page 69 of 77