Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
34 detections
Filters
Last updated
All Time
Detection languages
20
9
3
1
1
Contributors
11
9
6
2
1
Categories
9
8
7
7
5
Platforms
15
9
6
5
5
Products / Services
11
9
8
7
4
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
CVEs
1
IDS Classtypes
8
1
1
IDS Protocols
9
The current AI ecosystem has significant security gaps that can be weaponized for corporate espionage, supply-chain compromise, data harvesting, and even nation-state operations.
This KQL query identifies endpoints that are accessing, installing, or executing AI-related services or applications. The primary objective is to detect :
- Unauthorized AI usage (Policy Violation)
- Potential data exfiltration via AI platforms
- Shadow IT activity involving local or cloud-based LLMs
- High-risk AI deployments that bypass corporate policy
This KQL query identifies endpoints that are accessing, installing, or executing AI-related services or applications. The primary objective is to detect :
- Unauthorized AI usage (Policy Violation)
- Potential data exfiltration via AI platforms
- Shadow IT activity involving local or cloud-based LLMs
- High-risk AI deployments that bypass corporate policy
Detects agentic AI jailbreak attempts that try to establish persistent control over M365 Copilot through rule injection, universal triggers, response automation, system overrides, and persona establishment techniques. The detection analyzes the PromptText field for keywords like "from now on," "always respond," "ignore previous," "new rule," "override," and role-playing commands (e.g., "act as," "you are now") that attempt to inject persistent instructions. The search computes risk by counting distinct jailbreak indicators per user session, flagging coordinated manipulation attempts.
KQL Query from file: Hunting Exposed MCP Server
This detection detect non corporate devices running agentic AI programs attempting
Agentic AI Access to Entra
Cortex XDR
This query searches for instances where the agent type matches that of Agentic AI.
Note: This requires Azure Event Hub / Azure Ingestion. Best to run on Cortex XSIAM
Note: This requires Azure Event Hub / Azure Ingestion. Best to run on Cortex XSIAM
KQL Query
KQL Query
KQL Query from file: LLM Hunting in a MDE Environment
KQL Query
KQL Query from file: Azure AI Security Finding Report
KQL Query from file: Threat Intelligence Data from Sentinel UEBA2
KQL Query
This query helps reviewing malicious email detections by detection methods
Page 2 of 2