Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
608 detections
Filters
Last updated
All Time
Detection languages
346
84
61
42
40
Contributors
155
87
50
48
42
Categories
348
215
150
124
82
Platforms
197
190
120
88
75
Products / Services
169
92
45
44
43
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
10
5
1
1
1
IDS Classtypes
35
4
4
3
IDS Protocols
35
6
1
1
KQL Query from file: Multi-Cloud DefenderXDR KQL Threat Detection
KQL Query from file: Sentinel All-In-One UPN ThreatHunt
KQL Query from file: New Threat Actor Group Signature
KQL Query
KQL Query from file: Threat Hunting Nation State Actors
KQL Query from file: KQL to check Azure API spray attacks
KQL Query from file: DISCOVERY: Obsolete device connecting to Entra
KQL Query from file: Threat Intelligence Data from Sentinel UEBA2
KQL Query
KQL Query from file: Entra Risk Events & MITRE ATT&CK Analysis
KQL Query
KQL Query from file: Identity Blast Radius 2
KQL Query from file: Sentinel Timeroasting KQL detection
KQL Query
SPL Query from file: Failed Authentication to Non-existing Accounts
This detection targets suspicious ROPC (Resource Owner Password Credentials) authentication attempts involving brute-forcing of application client IDs, specifically related to the `Invoke-BruteClientIDs` function in MFA Sweep. This function can be used for enumerating gaps in MFA and/or CA policies, in addition to password validation via credential stuffing.
NTLM Brute Force
Sigma
Detects common NTLM brute force device names
CrackMapExecWin
Sigma
Detects CrackMapExecWin Activity as Described by NCSC
This query creates a list of IP addresses with the number of failed login attempts to Entra ID
above a set threshold ( default of 5 ). It then looks for any successful Palo Alto VPN logins from any of these IPs within the same timeframe.
above a set threshold ( default of 5 ). It then looks for any successful Palo Alto VPN logins from any of these IPs within the same timeframe.
'This query will determine multiple password resets by user across multiple data sources.
Account manipulation including password reset may aid adversaries in maintaining access to credentials and certain permission levels within an environment.'
Account manipulation including password reset may aid adversaries in maintaining access to credentials and certain permission levels within an environment.'
'Identifies a list of IP addresses with a minimum number (default of 5) of failed logon attempts to Microsoft Entra ID.
Uses that list to identify any successful remote logons to hosts from these IPs within the same timeframe.'
Uses that list to identify any successful remote logons to hosts from these IPs within the same timeframe.'
Page 23 of 29