Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
4
Contributors
3
1
Categories
2
1
1
1
1
Platforms
3
2
1
1
Products / Services
4
1
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
KQL Query from file: Detect Copilot Plugin Installation
'This detection identifies high-severity alerts across various Microsoft security products, including Microsoft Defender XDR and Microsoft Entra ID, and correlates them with instances of Google Cloud VM creation. It focuses on instances where VMs were created within a short timeframe of high-severity alerts, potentially indicating suspicious activity.'
"This query searches for any action type with high frequency that involves adding, modifying, or removing something in cloud app policies. It sees where the properties are modified such that the old value and new value are different for every property except for minor property changes such as Display Name."
"This query searches for any files in Cloud App Events that have trigger a security alert."