Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,061 detections
Filters
Last updated
All Time
Detection languages
594
173
103
71
51
Contributors
184
155
139
90
73
Categories
20,443
11,831
5,872
5,155
4,866
1,061
Platforms
576
267
228
221
116
Products / Services
499
220
129
118
86
MITRE Techniques
487
451
362
349
339
CVEs
10
5
4
3
2
IDS Classtypes
34
3
2
2
1
IDS Protocols
29
9
1
This rule detects activity from a list of specified malicious IP addresses across network connection events and sign-in attempts. It correlates `DeviceNetworkEvents` (network connections from devices) and `SigninLogs` (user authentication attempts) to identify instances where these IPs are involved. The rule is designed for hunting, looking back 30 days for any activity originating from the defined IP addresses.
KQL Query from file: Threat Hunt: Potential Password Spray Attacks
KQL Query from file: Potential MFASweep (tool) activity has been detected.
This KQL detection rule identifies suspicious login attempts in the SigninLogs dataset where a sign-in was blocked because it originated from an IP address flagged for malicious activity.
The rule specifically focuses on cases where valid credentials or token claims were used during the authentication process.
The rule specifically focuses on cases where valid credentials or token claims were used during the authentication process.
KQL Query from file: NauthNRPC Detection
KQL Query
KQL Query from file: Threat Hunting AzureHound Usage
KQL Query from file: Azure Cloud Security Monitoring
KQL Query from file: Sentinel KQL Detection for ShadowHound
KQL Query from file: Detect Microsoft Graph API Abuse
KQL Query from file: Monitor Privilege User SSPR
KQL Query
KQL Query from file: Microsoft Entra Identity Attack Threat Detection
KQL Query from file: The Hunt for QR Phisher
KQL Query from file: Sentinel UEBA Privilege Escalation Detection
KQL Query from file: Detect Privilege Admin under AiTM attack
KQL Query from file: Entra Cross-Tenant Activity Monitoring
KQL Query
KQL Query from file: Threat Intelligence Data from Sentinel UEBA
KQL Query
KQL Query from file: Detecting FIDO2 Passkey Abuse
Page 40 of 51