Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,225 detections
Filters
Last updated
All Time
Detection languages
1,118
30
19
17
15
Contributors
391
236
131
85
62
Categories
313
252
228
185
166
Platforms
651
438
268
228
200
Products / Services
10,670
9,758
6,693
4,421
3,749
1,225
MITRE Techniques
264
259
234
217
208
CVEs
8
8
6
6
6
IDS Classtypes
2
2
1
1
1
IDS Protocols
2
1
KQL Query from file: DefenderXDR Exposure Management for CVE-2024-3094
KQL Query from file: Detecting Nation State Actors @ Near Realtime
KQL Query from file: M365 Copilot Extensions Threat Monitoring
KQL Query from file: .NET Reflection Defense Evasion (Reflective Code Loading)
KQL Query from file: Sentinel Timeroasting KQL detection
KQL Query from file: Honeypot Threat Intelligence (TI) Data
KQL Query from file: Unmanaged PowerShell Detection
KQL Query from file: Threat Hunting Mshta with Sentinel TI
KQL Query
KQL Query
KQL Query
KQL Query from file: CVE-2024-10443 Hunting: RISK:STATION
KQL Query from file: Hunting VEILDrive C2
KQL Query
This query visualises total emails with Phish (BEC) Spoof detections by Detection Technology
This query visualises total emails with Phish-Spoof-internal domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain).
This query visualises total emails with Phish (BEC) Impersonation detections by Detection Technology over time
This query visualises total emails with Phish-Spoof-external domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain).
This query visualises emails submitted as false negatives by users where emails were already detected by MDO but there was a policy override.
This query visualises top sender domains of inbound emails submitted as false negatives by users.
This query visualises total emails with Spoof - SPF fails summarizing the data daily.
Page 54 of 59