Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
This rule detects phishing attempts that leverage Google redirect links. It identifies emails where the URL contains 'google.' and '/url?' and the URL domain is 'google', but the extracted domain is not 'com'. This indicates a potential malicious redirect through Google's services, often used to obscure the final malicious destination. The rule then joins this URL information with email event data to provide context such as sender, recipient, subject, and delivery location, focusing on emails delivered to the Inbox or Junk folder but not quarantined.
This rule detects attempts to phish user credentials by identifying Base64 encoded User Principal Names (UPNs) or their domains within URLs clicked by users. Adversaries often encode sensitive information like UPNs in malicious URLs to bypass security controls or to make the links appear less suspicious. The rule specifically looks for partial Base64 encoded strings of the user's UPN or domain within the 'UrlChain' field of URL click events.
This query helps calculate overall efficacy of MDO based on threats blocked pre-delivery, post-delivery cleanups, or were uncaught.
KQL Query
KQL Query from file: Storm 1811 SE Attack Detection
This detection identifies when Microsoft Copilot Studio agents are created in your organization's tenant. This activity is significant as the default behavior in Copilot agent creation is to configure a new service principal with cloud app administrator role.
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
This analytic processes and enriches alerts from CrowdStrike Falcon Event Stream, specifically `DetectionSummaryEvent` and `IdpDetectionSummaryEvent`. It normalizes fields such as user, destination, severity, and MITRE ATT&CK information. The rule dynamically generates drilldown links and constructs a descriptive title and message for each alert. It is designed to provide a standardized view of various CrowdStrike detections, including NGAV, Intel Detection, and Identity Protection alerts, ensuring proper risk scoring and analyst queue population.
KQL Query from file: Direct Send Abuse Detection
This detection rule identifies when Microsoft Copilot Studio agent properties are modified in your organization's tenant. This activity is significant as the default behavior in Copilot agent creation is to configure a new service principal with cloud app administrator role.
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious .SVG file has been delivered into an Inbox.
KQL Query
KQL Query
Analyze Mail Bomb Attack by ISP
KQL Query
This query visualises emails with Phish detections (High confidence) summarizing the data by Delivery Location.
KQL Query from file: Detect Microsoft Graph API Abuse
KQL Query from file: Monitoring Cross-Tenant Abuse by Threat Actors
This query visualises total emails with Phish detections over time summarizing the data daily by Delivery Location.
KQL Query from file: Detecting External Microsoft Teams Spray
KQL Query
KQL Query from file: Sentinel All-In-One IP ThreatHunt
Page 146 of 179