Detection rules

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

11,571
detections

Search detections

Filters

Showing 30 of 11,571

Netcraft Takedown - Latest record inventory

Latest takedown record state per `subject` for the last 7 days via `NetcraftTakedown_Latest` (`EventType == "takedown"` rolled up by Subject).

T1566T1583

Licence: MIT License
Published: Oct 22, 2026

UnknownMicrosoft Sentinel analytics

Netcraft Social - Result inventory

7-day inventory of latest Social results with platform, social type, and risk. Collapses deliveries to one row per ResultUuid via NetcraftSocialResult_Latest.

T1585T1593

Licence: MIT License
Published: Oct 22, 2026

UnknownMicrosoft Sentinel analytics

Netcraft Domain Detection - Result inventory

7-day inventory of latest Domain Detection results with risk, tag display_name flags, and infrastructure fields. Collapses deliveries to one row per DomainResultId via NetcraftDomainDetection_Latest.

T1583T1590

Licence: MIT License
Published: Oct 22, 2026

UnknownMicrosoft Sentinel analytics

Netcraft DDW Intelligence - Match inventory

7-day inventory of latest Deep & Dark Web intelligence matches (`match.discovered`) with priority, type, and source fields. Collapses deliveries to one row per MatchUuid via NetcraftDdwIntelligence_Latest.

T1593T1597

Licence: MIT License
Published: Oct 22, 2026

UnknownMicrosoft Sentinel analytics

Netcraft App - Result inventory

7-day inventory of latest App results with platform, developer, and risk. Collapses deliveries to one row per ResultUuid via NetcraftAppResult_Latest.

T1583T1593

Licence: MIT License
Published: Oct 22, 2026

UnknownMicrosoft Sentinel analytics

Netcraft Advert - Result inventory

7-day inventory of latest Advert results with advertiser, title, and risk. Collapses deliveries to one row per ResultUuid via NetcraftAdvertResult_Latest. Payload title is stored as AdvertTitle.

T1583T1593

Licence: MIT License
Published: Oct 22, 2026

InformationalMicrosoft Sentinel analytics

Netcraft Takedown - Resolved

Identifies Netcraft Takedown records whose status is `resolved` (`EventType == "takedown"`). The gateway status enum is lowercase. Raises an alert only; no incident is created.

T1583

Licence: MIT License
Published: Oct 22, 2026

HighMicrosoft Sentinel analytics

Netcraft Takedown - New takedown

Identifies new Netcraft Takedown records from the Integration Gateway (`EventType == "takedown"` and `ChangeType == "new"`). Updates to an existing takedown do not alert; use the Takedown workbook to follow status changes. `IsAuthorized` and `IsEscalated` are booleans.

T1566T1583

Licence: MIT License
Published: Oct 22, 2026

MediumMicrosoft Sentinel analytics

Netcraft Takedown - Important note changed

Identifies important notes added, updated, or deleted on Netcraft takedowns or takedown groups.

T1583

Licence: MIT License
Published: Oct 22, 2026

HighMicrosoft Sentinel analytics

Netcraft Takedown - Waiting for customer

Identifies Netcraft Takedown records where action is waiting on the customer (`EventType == "takedown"` and `ActionRequired` is not `no`).

T1583

Licence: MIT License
Published: Oct 22, 2026

MediumMicrosoft Sentinel analytics

Netcraft Social - Pending client input

Identifies Social results that are waiting for client input. A result needs client input when any tag on the result (`data.tags`) has category `input_required`. Uses NetcraftSocialResult_Latest so one ResultUuid alerts from the latest social result in the window.

T1566T1585

Licence: MIT License
Published: Oct 22, 2026

HighMicrosoft Sentinel analytics

Netcraft Social - High risk result

Identifies newly reported Social results (`ChangeType == "new"`) with `Risk.category` of highest or high. Uses NetcraftSocialResult_Latest so updates for the same ResultUuid do not re-alert unless they appear as a new result in the window.

T1566T1585

Licence: MIT License
Published: Oct 22, 2026

MediumMicrosoft Sentinel analytics

Netcraft Domain Detection - Preemptive disruption

Identifies Domain Detection results whose tag `display_name` is `Preemptive Disruption`. Uses NetcraftDomainDetection_Latest so the same DomainResultId alerts once per window.

T1566T1583

Licence: MIT License
Published: Oct 22, 2026

HighMicrosoft Sentinel analytics

Netcraft Domain Detection - Newly registered high risk

Identifies Domain Detection results whose tag `display_name` is `Newly Registered (24h)` with `Risk.category` of highest or high. Uses NetcraftDomainDetection_Latest so the same DomainResultId alerts once per window.

T1566T1583

Licence: MIT License
Published: Oct 22, 2026

HighMicrosoft Sentinel analytics

Netcraft Domain Detection - High risk result

Identifies newly reported Domain Detection results (`ChangeType == "new"`) with `Risk.category` of highest or high. Uses NetcraftDomainDetection_Latest so updates for the same DomainResultId do not re-alert unless they appear as a new result in the window.

T1566T1583

Licence: MIT License
Published: Oct 22, 2026

HighMicrosoft Sentinel analytics

Netcraft DDW Intelligence - Unacknowledged high priority

Identifies high-priority Deep & Dark Web intelligence matches that are still unacknowledged (`Acknowledged == false`). Uses NetcraftDdwIntelligence_Latest so the same MatchUuid alerts once per window.

T1552T1597

Licence: MIT License
Published: Oct 22, 2026

MediumMicrosoft Sentinel analytics

Netcraft DDW Intelligence - Takedown eligible match

Identifies Deep & Dark Web intelligence matches that are takedown eligible. Uses NetcraftDdwIntelligence_Latest so the same MatchUuid alerts once per window.

T1583T1597

Licence: MIT License
Published: Oct 22, 2026

HighMicrosoft Sentinel analytics

Netcraft DDW Intelligence - High priority match

Identifies Deep & Dark Web intelligence matches with Priority of high. Uses NetcraftDdwIntelligence_Latest so the same MatchUuid alerts once per window.

T1552T1597

Licence: MIT License
Published: Oct 22, 2026

MediumMicrosoft Sentinel analytics

Netcraft App - Pending client input

Identifies App results that are waiting for client input. A result needs client input when any tag on the result (`data.tags`) has category `input_required`. Uses NetcraftAppResult_Latest so one ResultUuid alerts from the latest app result in the window.

T1566T1583

Licence: MIT License
Published: Oct 22, 2026

HighMicrosoft Sentinel analytics

Netcraft App - High risk result

Identifies newly reported App results (`ChangeType == "new"`) with `Risk.category` of highest or high. Uses NetcraftAppResult_Latest so updates for the same ResultUuid do not re-alert unless they appear as a new result in the window.

T1566T1583

Licence: MIT License
Published: Oct 22, 2026

MediumMicrosoft Sentinel analytics

Netcraft Advert - Pending client input

Identifies Advert results that are waiting for client input. A result needs client input when any tag on the result (`data.tags`) has category `input_required`. Uses NetcraftAdvertResult_Latest so one ResultUuid alerts from the latest advert result in the window.

T1566T1583

Licence: MIT License
Published: Oct 22, 2026

HighMicrosoft Sentinel analytics

Netcraft Advert - High risk result

Identifies newly reported Advert results (`ChangeType == "new"`) with `Risk.category` of highest or high. Uses NetcraftAdvertResult_Latest so updates for the same ResultUuid do not re-alert unless they appear as a new result in the window.

T1566T1583