Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,001 detections
Filters
Last updated
All Time
Detection languages
1,439
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,401
11,795
5,864
5,145
4,864
3,001
Platforms
1,199
672
622
512
218
Products / Services
879
726
311
257
229
MITRE Techniques
1,659
1,107
903
465
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
Detects potential Active Directory enumeration via LDAP. This rule identifies suspicious LDAP search filters and distinguished name enumerations that are commonly used by reconnaissance tools like PowerView and SharpHound to gather information about users, groups, computers, and domain trusts within an Active Directory environment. The rule specifically looks for various 'groupType', 'sAMAccountType', 'objectCategory', 'objectClass', 'primaryGroupID', 'userAccountControl' attributes, and specific distinguished names or flags that indicate detailed AD reconnaissance.
This query helps calculate overall efficacy of MDO based on threats blocked pre-delivery, post-delivery cleanups, or were uncaught.
Detects when a Global Administrator elevates access to all subscriptions and management groups in a tenant. When a Global Administrator elevates access they are assigned the User Access Administrator role at root scope. This Sentinel analytics rule monitors who has elevated access in your tenant so that admins can take appropriate action.
This detection identifies when Microsoft Copilot Studio agents are created in your organization's tenant. This activity is significant as the default behavior in Copilot agent creation is to configure a new service principal with cloud app administrator role.
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
This detection rule identifies when Microsoft Copilot Studio agent properties are modified in your organization's tenant. This activity is significant as the default behavior in Copilot agent creation is to configure a new service principal with cloud app administrator role.
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
Analyze Mail Bomb Attack by ISP
Detects the use of known malicious PowerShell commandlets often associated with exploitation frameworks, red-teaming tools, and malware. This rule identifies a wide range of offensive PowerShell functions used for reconnaissance, credential dumping, privilege escalation, persistence, and data exfiltration.
KQL Query from file: Threat Hunting AzureHound Usage
KQL Query
KQL Query from file: Detect Microsoft Graph API Abuse
KQL Query from file: Monitoring Cross-Tenant Abuse by Threat Actors
KQL Query from file: Monitor Privilege User SSPR
KQL Query
KQL Query
KQL Query from file: Microsoft Entra Identity Attack Threat Detection
KQL Query
KQL Query from file: Sentinel UEBA Privilege Escalation Detection
KQL Query from file: DefenderXDR LDAP Enumeration Detection
KQL Query from file: Detect Privilege Admin under AiTM attack
KQL Query
KQL Query from file: Hunting Malicious Copilot Agent
Page 113 of 143