Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,936
7,266
6,537
3,866
3,647
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
In this query, we are looking for Url clicks on emails which get actioned by Zerohour auto purge
This query visualises emails submitted as false negatives by admins where emails where already detected by MDO but there was an admin policy override
This query helps reviewing Malware, Phishing, Spam emails caught per day
This query helps hunting for top outbound recipient domains which are sending inbound emails with threats
The query helps detect emails associated with the open redirector URL campaign using Defender for Office 365 data.
This query helps report on who Previewed/Downloaded email messages using the Email entity page in Defender for Office 365
Use this query to locate emails with subject indicators of a reply or forward, and the attachment is a .doc, or a .zip containing a .doc. Review results for suspicious emails.
IcedId can lead to ransomware
IcedId can lead to ransomware
This query visualises the original detection technology of emails submitted as spam false positive by admins
This query visualises the top admins performing false negative submissions
This query helps in checking the sender-recipient contact establishment status
In this detection approach, we correlate email from non-prevalent senders in the organization with impersonation intents
This query visualises total inbound emails with Malware detections summarizing the data by the top email sender P2 domain (SenderFromDomain)
This query visualises total inbound emails with Malware detections summarizing the data by the top recipient email address (RecipientEmailAddress)
This query visualises total emails with Phish detections over time summarizing the data daily by Delivery Location.
This query visualises total emails with Phish detections summarizing the data by various Phish detection technologies/controls
LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavior and escalated its operations in 2021. Today, beyond using resources for its traditional bot and mining activities, LemonDuck steals credentials, removes security controls, spreads via emails, moves laterally, and ultimately drops more tools for human-operated activity.
Identify prior activity from this campaign using IOCs shared by Microsoft's Threat Intelligence Center, or MSTIC.
Read more: https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/
Read more: https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/
Use this query to locate emails and malicious downloads related to the IcedId activity that can lead to ransomware
This query visualises the daily amount of admin false positive submission by submission type.
This query helps reviewing mail that is likely a reply but there is no history of the people chatting and the domain is new
This query helps reviewing count of total ZAP events
Page 138 of 150