Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
727 detections
Filters
Last updated
All Time
Detection languages
402
142
54
54
27
Contributors
153
152
78
42
33
Categories
227
208
134
132
119
Platforms
466
226
29
29
27
Products / Services
237
212
122
48
21
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
727
CVEs
5
5
5
4
4
IDS Classtypes
7
2
IDS Protocols
6
2
1
Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.
Detects Winword starting uncommon sub process FLTLDR.exe as used in exploits for CVE-2017-0261 and CVE-2017-0262
Detects a suspicious program execution in Outlook temp folder
The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries.
Detects the creation of a office macro file from a a suspicious process
Detects the creation of recent element file that points to an .ISO, .IMG, .VHD or .VHDX file as often used in phishing attacks.
This can be a false positive on server systems but on workstations users should rarely mount .iso or .img files.
This can be a false positive on server systems but on workstations users should rarely mount .iso or .img files.
Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from end-July 2022.
Detects the creation of a new office macro files on the systems via an application (browser, mail client).
This query helps reviewing admin reported email submissions
This query helps hunt for emails with malicious attachments based on SH256 hash from external IOC source
Jupyter, otherwise known as SolarMarker, is a malware family and cluster of components known for its info-stealing and backdoor capabilities that mainly proliferates through search engine optimization manipulation and malicious advertising in order to successfully encourage users to download malicious templates and documents. This malware has been popular since 2020 and currently is still active as of 2021.
Use this query to locate emails with subject indicators of a reply or forward, and the attachment is a .doc, or a .zip containing a .doc. Review results for suspicious emails.
IcedId can lead to ransomware
IcedId can lead to ransomware
In this detection approach, we correlate email from non-prevalent senders in the organization with impersonation intents
LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavior and escalated its operations in 2021. Today, beyond using resources for its traditional bot and mining activities, LemonDuck steals credentials, removes security controls, spreads via emails, moves laterally, and ultimately drops more tools for human-operated activity.
This query visualises the daily amount of admin false positive submission by submission type.
Check if file hashes published in the recent abuse.ch feed are found in your mail flow scanned by Office 365 ATP.
In this detection,we hunt for emails with randomly named attachment names from the same sender to multiple recipients
How much phish and malware emails vs good emails received the user in the given timeframe.
Identify prior activity from this campaign using IOCs shared by Microsoft's Threat Intelligence Center, or MSTIC.
Read more: https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/
Read more: https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/
// Author: jan geisbauer
// @janvonkirchheim
// ------------------------
// 1. A list of all devices that have this vulnerability
// 2. A list of all users that uses those devices
// 3. If these users received .mkv files recently
// @janvonkirchheim
// ------------------------
// 1. A list of all devices that have this vulnerability
// 2. A list of all users that uses those devices
// 3. If these users received .mkv files recently
Bazacall uses malicious Excel files to execute payloads on affected devices.
Page 32 of 35