Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
254 detections
Filters
Last updated
All Time
Detection languages
167
41
16
14
10
Contributors
61
60
42
18
13
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
133
108
85
38
34
Products / Services
112
83
65
30
30
MITRE Techniques
75
74
36
36
35
CVEs
7
6
6
6
6
This rule identifies potentially compromised Entra ID accounts by correlating multiple suspicious behaviors within a 14-day window. It aggregates four specific indicators: successful authentication following repeated MFA failures, impossible travel (sign-ins from multiple countries within a short timeframe), unusual hour logons (00:00-05:00), and sign-ins flagged with medium/high risk or reported as compromised. The rule triggers when an account exhibits two or more of these distinct anomalous behaviors.
This rule retrieves security anomaly events generated by Microsoft's identity protection or behavioral analysis systems for a specific user account over a defined time range. It leverages the 'Anomalies' table within Microsoft Sentinel to surface identity-related insights, activity patterns, and flagged risks.
Detects anomalous sign-in behavior shortly after a successful MFA-authenticated session in Microsoft 365. This rule flags scenarios where a subsequent session for the same user occurs within a short window (30 minutes) from a different IP, ASN, User-Agent, or device identifier, potentially indicating the replay of a stolen session cookie obtained via Adversary-in-the-Middle (AiTM) phishing.
Detects signs of Adversary-in-the-Middle (AiTM) phishing kits by identifying sequential, rapid-fire attempts to authenticate using multiple distinct MFA methods (such as push notifications, TOTP codes, or SMS) within a single sign-in session. These attempts are combined with explicit failure states (rejected passwords, rejected codes, or denied MFA requests), suggesting an attacker is relaying authentication challenges in real-time to a victim.
This rule correlates Microsoft Defender for Office 365 'Safe Links' phishing alerts, which indicate a user has clicked a potentially malicious URL. It extracts the malicious domain from the URL and aggregates multiple alert events by that domain to identify potential phishing campaigns impacting multiple users within the organization.
Detects non-interactive sign-ins, such as those using refresh or session tokens, originating from an IP address, ASN, device, or country that does not match the user's recent interactive sign-in history. The absence of an MFA challenge for these new contexts is characteristic of session token replay attacks, often associated with AiTM phishing campaigns.
Detects session hijacking activity characteristic of the Mirage2FA AiTM (Adversary-in-the-Middle) phishing toolkit. The rule identifies non-interactive authentication events (token reuse) that lack an MFA challenge, occurring shortly after interaction with a known malicious phishing proxy domain. It further correlates this activity with anomalous signals, such as impossible travel or the use of an unseen device/user-agent, to confirm high-fidelity malicious intent.
Finds Microsoft Sentinel analytics rules that generate high volumes of non-actionable closed incidents. The query calculates false positive, benign positive, undetermined, and true positive rates per rule, then provides practical tuning recommendations to help SOC and detection engineering teams reduce alert fatigue.
Correlates Microsoft Sentinel Security Alerts and Security Incidents associated with a specific user account over a 90-day period. The query identifies medium and high-severity alerts, maps them to their corresponding incidents, and provides investigation outcomes including classification, closure details, and ownership information.
This detection enables analysts to quickly understand a user's historical security exposure, determine whether previous incidents were resolved appropriately, and identify patterns of recurring security activity.
This detection enables analysts to quickly understand a user's historical security exposure, determine whether previous incidents were resolved appropriately, and identify patterns of recurring security activity.
Correlates Microsoft Entra identity risk detections with subsequent password changes, MFA registrations, and security information modifications. Helps identify potential account compromise scenarios where authentication methods or credentials are altered after suspicious sign-in activity.
Detects high or critical severity Data Loss Prevention (DLP) alerts triggered by the Zscaler NSS platform. The rule identifies web traffic involving sensitive information categories such as Personally Identifiable Information (PII), financial data, or source code, which have been either allowed or blocked by Zscaler policy.
Detects high or critical severity Data Loss Prevention (DLP) alerts triggered by the Zscaler NSS platform. The rule identifies web traffic involving sensitive information categories such as Personally Identifiable Information (PII), financial data, or source code, which have been either allowed or blocked by Zscaler policy.
This rule identifies active, high or critical severity regulatory compliance violations (e.g., GDPR, HIPAA, PCI-DSS, NIST) reported by Zscaler Data Security Posture Management (DSPM). It further highlights assets with repeat violations across multiple regulatory frameworks, facilitating prioritization of remediation efforts for critical compliance gaps.
Detects Zscaler ZIA logs identified as Advanced Threat Protection events, specifically targeting URL categories like Phishing and WebSpam, or traffic classified as Advanced Security Risk. The rule aggregates these events by user to identify potential malicious activity, flagging sessions where threats were allowed as higher severity.
Detects anomalous activity where a user account experiences access denials across a high number of distinct applications (>= 5) within a 15-minute window via Zscaler Private Access. This pattern often indicates unauthorized exploration, directory probing, or automated credential testing against enterprise resources.
Detects Microsoft Entra ID Protection risk telemetry for sign-ins with unfamiliar properties. Microsoft evaluates characteristics such as ASN, browser, device, and location against the user's historical behavior to identify anomalous sign-ins that may warrant investigation.
Detects anomalous activity where a user account experiences access denials across a high number of distinct applications (>= 5) within a 15-minute window via Zscaler Private Access. This pattern often indicates unauthorized exploration, directory probing, or automated credential testing against enterprise resources.
This rule detects high-frequency security alerts from Zscaler ZIA indicating that a single source IP has encountered three or more distinct threat signatures within a 15-minute window. This behavior is indicative of a host engaging in malicious activity, such as automated scanning, malware communication attempts, or accessing infrastructure associated with multiple malicious categories.
This rule identifies active, high or critical severity regulatory compliance violations (e.g., GDPR, HIPAA, PCI-DSS, NIST) reported by Zscaler Data Security Posture Management (DSPM). It further highlights assets with repeat violations across multiple regulatory frameworks, facilitating prioritization of remediation efforts for critical compliance gaps.
KQL Query
Detects a significant increase in Zscaler Risk360 risk scores or the emergence of new high-impact security insights. This rule monitors for category-specific risk spikes (External Attack Surface, Compromise, Lateral Propagation, or Data Loss) that exceed a defined delta threshold or are flagged as Critical/High severity, serving as a posture-based alert for security investigation.
Page 8 of 13