Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,733 detections
Filters
Last updated
All Time
Detection languages
909
387
164
127
68
Contributors
479
417
201
177
61
Categories
20,440
11,814
5,871
5,145
4,864
1,733
Platforms
822
436
329
274
206
Products / Services
498
378
118
96
79
MITRE Techniques
433
327
225
196
196
CVEs
12
12
10
10
6
IDS Classtypes
1
1
IDS Protocols
2
This detection identifies instances where a user grants consent to an OAuth application that has very low prevalence within the tenant and requests high-risk permissions. This pattern is a strong indicator of a targeted consent phishing attack, as malicious apps often target a small number of users to gain initial access.
Detects when a user generates an unusually high number of prompts to Copilot within a short period (e.g., 50 prompts in an hour). This could indicate automated activity, data exfiltration attempts, or misuse of the Copilot service.
This rule detects instances where a 'jailbreak' attempt is identified within a Microsoft Copilot interaction. It specifically looks for CopilotInteraction events where the 'JailbreakDetected' flag is set to true in the message data.
This query identifies rare or newly observed application sign-ins by comparing activity in the last 24 hours against a 30‑day historical baseline.
It highlights applications that are never used or seldom used in the tenant, helping detect anomalous or suspicious application activity that may indicate OAuth abuse, automation tools, or compromised accounts.
It highlights applications that are never used or seldom used in the tenant, helping detect anomalous or suspicious application activity that may indicate OAuth abuse, automation tools, or compromised accounts.
Detects when a user grants consent to an application that has not been seen in the environment before. This rule baselines known applications over a 30-day period and alerts on any new application consent grants or service principal additions within the last day that are not part of the baseline or an explicit allow list.
This rule detects Microsoft Teams chat or call activity initiated by external users whose domains are not present in a pre-defined whitelist. It specifically looks for 'ChatCreated' or 'CallParticipantDetail' actions from external users and filters out activity from known, whitelisted external domains. This can help identify potentially unauthorized or suspicious communication with external entities.
This rule detects the creation or modification of Chrome extension files (.crx) on a device, correlating it with browser extension installation/update events and file prevalence. It flags extensions that are rare, unsigned, small in size, or have suspicious IDs, indicating potential malicious activity or unauthorized installations.
Detects potential fraud: New payment card added, followed by deposit and large withdrawal (>500) within 24 hours
This rule detects Microsoft Teams chat or call activity initiated by external users whose domains are not present in a pre-defined whitelist. It specifically looks for 'ChatCreated' or 'CallParticipantDetail' actions from external users and filters out activity from known, whitelisted external domains. This can help identify potentially unauthorized or suspicious external communication within Microsoft Teams.
The malware used the legitimate curl.exe to upload data to temp[.]sh. This is a high-fidelity indicator as legitimate business processes rarely upload data to ephemeral pastebins via command line.
This query hunts for the specific "reconnaissance batch" behavior observed in this campaign: a process piping netstat, systeminfo, or tasklist output into a text file (specifically a.txt as seen in the report, though looking for any single-letter text file is a good heuristic).
This rule detects chat or call activity by external users in Microsoft Teams whose source tenant is not present in a pre-defined whitelist. This could indicate unauthorized external communication or potential data exfiltration attempts.
This query identifies devices with specific versions of installed software that are considered vulnerable. It is a template that can be easily adapted to track any software by changing the placeholder variables. It enriches the findings with device and user information for easier investigation.
This detection aims to identify suspicious popup activity on devices by analyzing process events that launch notifications. The query focuses on detecting referrers that generate multiple unique popup URLs, which could indicate potentially malicious behavior.
You can use this to check for potential browser popups generated by malicious sites gaining notification permission on a browser before they lead to further compromise of a host.
You can use this to check for potential browser popups generated by malicious sites gaining notification permission on a browser before they lead to further compromise of a host.
The current AI ecosystem has significant security gaps that can be weaponized for corporate espionage, supply-chain compromise, data harvesting, and even nation-state operations.
This KQL query identifies endpoints that are accessing, installing, or executing AI-related services or applications. The primary objective is to detect :
- Unauthorized AI usage (Policy Violation)
- Potential data exfiltration via AI platforms
- Shadow IT activity involving local or cloud-based LLMs
- High-risk AI deployments that bypass corporate policy
This KQL query identifies endpoints that are accessing, installing, or executing AI-related services or applications. The primary objective is to detect :
- Unauthorized AI usage (Policy Violation)
- Potential data exfiltration via AI platforms
- Shadow IT activity involving local or cloud-based LLMs
- High-risk AI deployments that bypass corporate policy
Detects Windows error reporting events where the process that crashed is LSASS (Local Security Authority Subsystem Service).
This could be the cause of a provoked crash by techniques such as Lsass-Shtinkering to dump credentials.
This could be the cause of a provoked crash by techniques such as Lsass-Shtinkering to dump credentials.
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.
Detect outbound connections initiated by P2P file-sharing applications. This can be used to find unauthorized P2P applications in enterprises environments that can be used to bypass security controls.
Detects an appx package that was added to the pipeline of the "to be processed" packages that is located in uncommon locations.
Detects a failed installation of a Exchange Transport Agent
Detects the Installation of a Exchange Transport Agent
Page 69 of 83