Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
837 detections
Filters
Last updated
All Time
Detection languages
436
190
77
62
40
Contributors
120
114
72
71
68
Categories
462
233
193
152
120
Platforms
288
272
154
88
56
Products / Services
220
169
162
90
74
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
837
CVEs
6
5
5
5
5
IDS Classtypes
4
2
IDS Protocols
1
KQL Query
KQL Query from file: Critical Identities OAuth Grant
KQL Query from file: Hunting malicious oauth grant by phished user
KQL Query from file: CloudApp Privilege OAuth Grant
KQL Query
KQL Query
KQL Query
KQL Query from file: ATP Detection for Critical Identities
KQL Query
KQL Query from file: CVE-2024-7971 Patch Prioritization
KQL Query from file: Detecting Copilot Studio Bot Creation
KQL Query
KQL Query from file: Monthly Report Entra Eligible Role Activation
KQL Query from file: HTTP Client Tools Exploitation for ATO Detection
KQL Query from file: RID Hijacking Technique and Detection
KQL Query
Detects scenarios where one can control another users or computers account without having to use their credentials.
'This query identifies attackers trying to enumerate the Storage keys as well as updating roles using AzureActivity,SigninLogs
and AuditLogs'
and AuditLogs'
'An account could be blocked if there are too many failed authentication attempts in a row. This hunting query identifies if a MFA user account that is set to blocked tries to login to Microsoft Entra ID.
This query has also been updated to include UEBA logs IdentityInfo and BehaviorAnalytics for contextual information around the results.'
This query has also been updated to include UEBA logs IdentityInfo and BehaviorAnalytics for contextual information around the results.'
'This query will determine multiple password resets by user across multiple data sources.
Account manipulation including password reset may aid adversaries in maintaining access to credentials and certain permission levels within an environment.'
Account manipulation including password reset may aid adversaries in maintaining access to credentials and certain permission levels within an environment.'
Looks for multiple users that had their admin role removed by a single user within a certain period.
Page 33 of 40