Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,749 detections
Filters
Last updated
All Time
Detection languages
2,543
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,244
994
880
773
476
Platforms
2,849
1,449
1,229
356
73
Products / Services
10,677
9,759
6,693
4,421
3,749
MITRE Techniques
1,096
988
949
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Visualises where URLs have been identified in emails, summarizing by location (for example: Attachment, header, body) to help analysts understand distribution and risk.
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
This query visualises top 10 subjects of intra-org emails submitted as false negatives by users.
This query visualises the total ammount of user false negative submissions from the junk folder
Identifies the top 10 sender domains delivering inbound emails classified as malware, phishing, or spam.
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
Identifies the top 10 users receiving inbound emails classified as malware, phishing, or spam.
Based on concepts from the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
Based on concepts from the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
This query visualises the total ammount of user false negative or false positive submissions by the verdict of the submission grading.
Identifies the top 10 external sender addresses delivering inbound emails classified as phishing.
If you want to exclude your own organization's domains (including subdomains), add a filter after the phishing filter, e.g.:
| where SenderFromAddress !contains ".yourdomain.com"
(Replace "yourdomain.com" with your actual domain.)
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
If you want to exclude your own organization's domains (including subdomains), add a filter after the phishing filter, e.g.:
| where SenderFromAddress !contains ".yourdomain.com"
(Replace "yourdomain.com" with your actual domain.)
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
Identifies the top 10 external sender addresses delivering inbound emails classified as spam.
To exclude your own organization's domains (including subdomains), add a filter after the spam filter, e.g.:
| where SenderFromAddress !contains ".yourdomain.com"
(Replace "yourdomain.com" with your actual domain.)
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
To exclude your own organization's domains (including subdomains), add a filter after the spam filter, e.g.:
| where SenderFromAddress !contains ".yourdomain.com"
(Replace "yourdomain.com" with your actual domain.)
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the locations they are stored
This query helps reviewing quarantine release trend in Defender for Office 365
This query visualises the total amount of spam emails that are quarantined, summarized by the detection method
This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the workload in which they are stored
This query visualises total files located on SharePoint, OneDrive and Teams with Malware detections over time summarizing the data daily.
This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams over time summarizing the data by the various Malware families detected focusing on Defender for Office 365 detections (detonations)
This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams over time summarizing the data by the various Malware families detected focusing on built-in SharePoint AV detections
Detects the addition or update of key or password credentials specifically on the Microsoft Entra Connect Sync application registration (Service Principal) within Azure AD Audit Logs. This activity is highly suspicious as the normal update process for Entra Connect Sync typically replaces existing keys, and attackers may add credentials for persistence while leaving existing ones for legitimate operations.
This query visualises the amount of phish emails that are quarantined, summarized daily by the detection method
This query visualises the daily amount of emails that had a post delivery action from zero-hour auto purge, summarizing by phish,spam or malware detection action
This query visualises the amount of emails that had a post delivery action, summarizing the data daily by the final location as a result of the action
This query visualises the total amount of phish emails that are quarantined, summarized by the detection method
'This hunting query will alert on any Impossible travel activity in correlation with mailbox permission tampering followed by account being added to a PIM managed privileged group.
Ensure this impossible travel incident with increase of privileges is legitimate in your environment.'
Ensure this impossible travel incident with increase of privileges is legitimate in your environment.'
Page 155 of 179