Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9 detections
Filters
Last updated
All Time
Detection languages
9
Contributors
6
3
Categories
5
4
3
2
2
Platforms
9
3
Products / Services
3
3
3
3
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
KQL Query from file: Detect Privilege Admin under AiTM attack
KQL Query
KQL Query from file: Conditional Access Report
KQL Query from file: Mitigating security risks in MCP implementations
KQL Query
KQL Query
In this detection,we hunt for any sign-in attempt from a non-managed, non-compliant, untrusted device.
Looks for multiple users that had their admin role removed by a single user within a certain period.
'Identifies accounts that have been added to a PIM managed privileged group'