Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,666 detections
Filters
Last updated
All Time
Detection languages
1,077
189
170
102
53
Contributors
520
361
306
67
52
Categories
20,443
11,831
5,872
5,155
4,866
1,666
Platforms
1,091
591
441
252
122
Products / Services
1,130
476
189
125
117
MITRE Techniques
945
843
438
416
413
CVEs
12
12
9
6
5
IDS Classtypes
1
1
KQL Query from file: Malicious FIDO2 Registration Threat Detection
KQL Query from file: Entra User Account Compromised by C2
KQL Query from file: Attacker in the Middle Precision Detection
KQL Query from file: Entra Cross-Tenant Activity Monitoring
KQL Query from file: Nation State Actors via Microsoft Graph
KQL Query
KQL Query from file: Conditional Access Report
KQL Query from file: Hunting malicious oauth grant by phished user
KQL Query
KQL Query from file: Entra Passkey Addition Threat Detection
KQL Query from file: Entra ID Administrative Role (AD-Sync)
KQL Query from file: Azure cloud account takeover
KQL Query from file: User Sign-in Activity
KQL Query from file: ATP Detection for Critical Identities
KQL Query from file: Tracking The Most Dangerous Entra Admin Role
KQL Query
KQL Query from file: Identity Blast Radius 2
KQL Query from file: Identity Blast Radius
KQL Query
KQL Query from file: Monthly Report Entra Eligible Role Activation
This query helps hunting for possible device code Phishing attempts
Page 73 of 80