Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
983 detections
Filters
Last updated
All Time
Detection languages
638
105
82
64
34
Contributors
242
226
216
58
46
Categories
20,443
11,831
5,872
5,155
4,866
983
Platforms
483
405
224
192
62
Products / Services
416
383
182
108
81
MITRE Techniques
496
496
263
234
233
CVEs
4
4
4
3
3
IDS Classtypes
1
KQL Query
KQL Query from file: NEW Real-time Anomalous Token Detection
KQL Query from file: Attacker in the Middle Precision Detection
KQL Query from file: Detecting FIDO2 Passkey Abuse
KQL Query from file: BadSuccessor Detection
KQL Query
KQL Query from file: DefenderXDR Advanced Hunting All-In-One IP Search
KQL Query
KQL Query from file: User Sign-in Activity
KQL Query
KQL Query from file: Sentinel All-In-One UPN ThreatHunt
KQL Query from file: New Threat Actor Group Signature
KQL Query
KQL Query from file: Exposure Management + Defender for Office 365
KQL Query
KQL Query from file: Tracking The Most Dangerous Entra Admin Role
KQL Query
KQL Query from file: Identity Blast Radius 2
KQL Query from file: Identity Blast Radius
KQL Query
'This query helps detect new Microsoft Entra ID sign in from a new location correlating with Office Activity data highlighting cases where user mails are being forwarded and shows if it is being forwarded to external domains as well.'
Page 42 of 47