Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
72 detections
Filters
Last updated
All Time
Detection languages
31
18
14
8
1
Contributors
17
14
14
8
5
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
35
21
17
12
12
Products / Services
18
16
14
8
7
MITRE Techniques
27
21
15
12
12
CVEs
1
Indicates that a password spray attack has been successfully performed.
Indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns
Indicates access attempt to the PRT resource which can be used to move laterally into an organization or perform credential theft
Detects when a Microsoft Cloud App Security reported when users were active from an IP address that has been identified as an anonymous proxy IP address.
Indicates sign-in from a malicious IP address based on high failure rates.
Indicates sign-in from a malicious IP address known to be malicious at time of sign-in.
Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence.
These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account.
These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account.
Detects when a Microsoft Cloud App Security reported when an activity occurs from a location that wasn't recently or never visited by any user in the organization.
Detects when a Microsoft Cloud App Security reported when a user uploads files to the cloud that might be infected with ransomware.
Page 4 of 4