Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
983 detections
Filters
Last updated
All Time
Detection languages
638
105
82
64
34
Contributors
242
226
216
58
46
Categories
20,443
11,831
5,872
5,155
4,866
983
Platforms
483
405
224
192
62
Products / Services
416
383
182
108
81
MITRE Techniques
496
496
263
234
233
CVEs
4
4
4
3
3
IDS Classtypes
1
This rule detects potential RDP lateral movement by identifying accounts that log on to multiple distinct workstations via RDP (LogonType 10) within a one-hour window, where the workstation name is different from the computer name. A logon chain of more than two distinct computers for the same account and IP address within an hour is flagged as suspicious.
Detects successful anonymous user logins on Windows systems. This activity can be legitimate for accessing public resources but is also commonly used by attackers for enumeration and unauthorized access (e.g., ZeroLogon).
Detects a successful user login from a country that is on a restricted or high-risk list. This can indicate account compromise or policy violation.
Detects Windows logon events where the account name starts with 'WAC_' and belongs to a domain outside of the organization's tenant. This pattern is a key indicator for CVE-2026-20965 exploitation, where an attacker uses a forged token from an external tenant to gain unauthorized access to a Windows Admin Center (WAC) managed machine.
Detects a user successfully logging in from multiple different countries within a short time frame (4 hours). This is a strong indicator of account takeover (T1078).
This rule detects anomalous logon activity for accounts containing 'your admin service account name' by comparing actual logon volumes against a dynamically generated machine learning baseline. It focuses on identifying deviations from expected behavior for these administrative service accounts over a 14-day lookback period, with a sensitivity threshold of 2.5.
This detection identifies successful logon activity (Event ID 4624) on a device that has been reported as stolen or missing. Such activity is highly suspicious and could indicate unauthorized access. The rule enriches the alert with ISP IP information from Azure AD sign-in logs to aid in investigation.
This rule detects logon events from Windows Admin Center (WAC) virtual accounts where the associated user principal name (UPN) belongs to an external or unknown tenant. This activity is a key indicator of compromise for CVE-2026-20965, where an attacker uses a forged token from an external tenant to gain unauthorized access.
This rule identifies successful device logons that meet all of the following criteria:
Logon was successful
Logon was performed by a non-machine account
Logon type is not a service or scheduled task
Logon occurred:
- Before 06:00 local time, or
- After 20:00 local time, or
- On Saturday or Sunday
The configuration details can be modified (timezone, start and end hours...) as needed.
Logon was successful
Logon was performed by a non-machine account
Logon type is not a service or scheduled task
Logon occurred:
- Before 06:00 local time, or
- After 20:00 local time, or
- On Saturday or Sunday
The configuration details can be modified (timezone, start and end hours...) as needed.
The purpose of this query is to identify accounts that have logged in from multiple different countries within a short time window (last hour or last day).
This is typically used for security monitoring to detect suspicious or anomalous authentication behavior.
This is typically used for security monitoring to detect suspicious or anomalous authentication behavior.
This query analyzes login events to identify users with more than five failed login attempts. It filters for login-related events, groups the data by username, endpoint name, failure reason, login type, and associated indicators, then counts the number of failed attempts. The results are sorted in descending order of failed attempts to highlight potentially suspicious activity.
This rule detects new device registrations in Azure Active Directory (AAD) that originate from an IP address not previously associated with the user's account within the last 29 days. It filters out registrations from corporate IP ranges and common mobile operating systems (iOS, Android) to reduce noise. The rule categorizes the risk level of the IP address based on historical sign-in counts, focusing on 'High Risk - New IP' events. It then enriches these events with additional sign-in details like device name, risk level during sign-in, country, and city.
Detect unauthorized access by identifying new country sign-ins for users through AADSignInEventsBeta analytics.
This rule detects potential Pass the Hash (PtH) activity by monitoring Windows Security Event IDs 4624 (successful logon) and 4625 (failed logon) where the LogonType is 3 (Network) and the LogonProcessName is 'NtLmSsp'. It specifically filters out 'ANONYMOUS LOGON' to reduce false positives. This combination of events indicates an attempt to authenticate over the network using NTLM, which is characteristic of PtH attacks for lateral movement.
Detects when Microsoft Cloud App Security (MCAS) reports a risky sign-in attempt due to an impossible travel scenario. This indicates a potential compromise of user credentials where an attacker logs in from a geographically distant location in a short timeframe, making physical travel impossible.
This rule detects interactive console logons (LogonType 2) to server systems and domain controllers. It specifically looks for successful (EventID 528, 4624) and failed (EventID 529, 4625) interactive logon attempts. The rule filters out events where the logon process name is 'Advapi' and the computer is a workstation, aiming to reduce false positives from legitimate workstation activities.
This rule detects successful remote logons by users whose usernames start with 'Admin' (e.g., Administrator, Admin-SQL) on Windows systems. It specifically looks for Event ID 4624 (successful logon), Logon Type 10 (RemoteInteractive), and the Negotiate authentication package. The rule aims to identify potential misuse of administrative accounts for remote access, which could indicate privilege escalation, persistence, or lateral movement. Its effectiveness relies on an internal pattern for administrator usernames and a policy mandating that these accounts are only used as secondary accounts.
Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account. This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges.
Detects successful RDP logons originating from public IP addresses. This can indicate an exposed RDP port being accessed externally, potentially by an attacker.
This rule detects logon events (EventID 4624) with LogonType 3 (network logon) where the TargetUserName is 'ANONYMOUS LOGON' and the WorkstationName is '-' (indicating a local system or unknown workstation). Additionally, the source IP address must be a loopback address ('127.0.0.1' or '::1'). This specific combination of characteristics is indicative of a RottenPotato-like attack pattern, which exploits local NTLM relay vulnerabilities to escalate privileges.
Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior, often associated with tools like Mimikatz's sekurlsa::pth module. This indicates an adversary is using stolen password hashes to authenticate to a system.
Page 40 of 47