Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,438
11,829
5,873
5,150
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
KQL Query from file: Multi-Cloud DefenderXDR KQL Threat Detection
KQL Query
KQL Query from file: New Threat Actor Group Signature
KQL Query
KQL Query
KQL Query from file: Detect Power Pwn (aka LOLCopilot) Red Team Tool
KQL Query from file: Threat Hunting Nation State Actors
KQL Query from file: Critical Monitor for Critical Assets
KQL Query from file: Exposure Management + Defender for Office 365
KQL Query from file: T1555.003 - Credentials from Web Browsers
KQL Query from file: Threat Intelligence Data from Sentinel UEBA2
KQL Query
KQL Query from file: NTLMv2 Hash Leak via COM Detection
Detects changes to the "StrongAuthenticationRequirement" value, where the state is set to "0" or "Disabled". Threat actors were seen disabling multi factor authentication for users in order to maintain or achieve access to the account. Also see in SIM Swap attacks.
KQL Query from file: Entra Risk Events & MITRE ATT&CK Analysis
KQL Query from file: OAuth App for BEC & Phishing Detection
KQL Query from file: Identity Blast Radius 2
KQL Query from file: CVE-2024-7971 Patch Prioritization
KQL Query from file: Detecting Nation State Actors @ Near Realtime
KQL Query from file: Sentinel Timeroasting KQL detection
KQL Query
Page 175 of 206