Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,001 detections
Filters
Last updated
All Time
Detection languages
1,439
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,401
11,795
5,864
5,145
4,864
3,001
Platforms
1,199
672
622
512
218
Products / Services
879
726
311
257
229
MITRE Techniques
1,659
1,107
903
465
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
KQL Query from file: Critical Monitor for Critical Assets
KQL Query from file: Technique profile eDiscovery misuse detection
KQL Query from file: ATP Detection for Critical Identities
KQL Query from file: Exposure Management + Defender for Office 365
KQL Query from file: Tracking The Most Dangerous Entra Admin Role
KQL Query
KQL Query from file: Sentinel Alerts & MITRE ATT&CK Analysis
KQL Query from file: Entra Risk Events & MITRE ATT&CK Analysis
KQL Query
KQL Query from file: Vulnerability Profile: CVE-2024-30040 (Zero-day)
KQL Query from file: Exposure Management - Slim's Metric (MaxCVSS-DAW)
KQL Query from file: Detecting Copilot Studio Bot Creation
KQL Query from file: Honeypot Threat Intelligence (TI) Data
KQL Query
This rule detects when the user risk and multi-factor authentication (MFA) registration policy is updated within Azure Active Directory (AAD). Attackers may modify these policies to bypass MFA, weaken security thresholds, facilitate further attacks, or maintain persistence by altering how users authenticate or register for MFA.
KQL Query from file: CVE-2024-38063 CVSS 9.8 Prioritization
KQL Query from file: Identity Blast Radius
KQL Query from file: Monthly Report Entra Eligible Role Activation
KQL Query
This query visualises emails submitted as false negatives by users where emails were already detected by MDO but there was a policy override.
This detection leverages Azure Graph activity logs to identify when Graph APIs have been used to identify 10 or more service principals. This type of behavior is associated with tools such as Azure enumeration tools like AzureHound or ROADtools.
Page 115 of 143