Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,598 detections
Filters
Last updated
All Time
Detection languages
1,151
134
65
63
53
Contributors
368
274
239
197
70
Categories
983
375
271
227
140
Platforms
871
506
164
160
149
Products / Services
949
298
133
113
108
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
1,598
CVEs
2
1
1
1
1
IDS Classtypes
18
5
4
1
1
IDS Protocols
15
8
4
3
This query helps reviewing mail that is likely a reply but there is no history of the people chatting and the domain is new
This query helps reviewing count of total ZAP events
This query helps report daily on total number of emails, total number of emails detected aby Defender for Office 365
Check if file hashes published in the recent abuse.ch feed are found in your mail flow scanned by Office 365 ATP.
This query visualises all emails submitted as false positive by admins summarizing by the original filter verdict threat type
This query helps reviewing zero day threats via URL and file detonations
In this detection,we hunt for emails with randomly named attachment names from the same sender to multiple recipients
This query visualises total emails with Malware detections summarizing the data by various Malware detection technologies/controls.
How much phish and malware emails vs good emails received the user in the given timeframe.
Identify prior activity from this campaign using IOCs shared by Microsoft's Threat Intelligence Center, or MSTIC.
Read more: https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/
Read more: https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/
This query visualises the total amount of admin false negative submissions by the state of the submission.
Total Submissions by Submission State
This query visualises the original detection technology of emails submitted as phish false positive by admins
In this query, we hunt for inbound emails delivered having URLs from QR codes
This query visualises bad traffic (% of emails with threats) compared to total inbound emails over time summarising the data daily.
This query helps in reviewing group Quarantine released messages by detection type. Useful to see what is leading to the largest number of messages being released.
This query visualises the amount of emails subject to an admin policy with action of block, summarizing the data daily
// Author: jan geisbauer
// @janvonkirchheim
// ------------------------
// 1. A list of all devices that have this vulnerability
// 2. A list of all users that uses those devices
// 3. If these users received .mkv files recently
// @janvonkirchheim
// ------------------------
// 1. A list of all devices that have this vulnerability
// 2. A list of all users that uses those devices
// 3. If these users received .mkv files recently
This query provides insights on users who clicked on a suspicious URL
In this query, we are looking URL click actions by URL in the last 7 days
This query visualises the daily amount of admin false negative submission by submission type.
Page 72 of 77