Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,865 detections
Filters
Last updated
All Time
Detection languages
2,524
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,934
7,265
6,535
3,865
3,645
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Monitor and alert for Bitlocker key retrieval.
Monitor and alert for changes to the device registration policy.
Monitor and alert for users added to device admin roles.
Detects when a configuration change is made to an applications AppID URI.
Detects when a configuration change is made to an applications URI.
URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.
URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.
Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.
Detects when a user that doesn't have permissions to invite a guest user attempts to invite one.
Detects the change of user type from "Guest" to "Member" for potential elevation of privilege.
Detects when PIM alerts are set to disabled.
Detects when changes are made to PIM roles
Detects when a user is added to a privileged role.
Detects when a new admin is created.
Detect when a user has reset their password in Azure AD
Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.
Atypical Travel
Sigma
Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.
Impossible Travel
Sigma
Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second.
Detects suspicious rules that delete or move messages or folders are set on a user's inbox.
New Country
Sigma
Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent locations.
Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser
Indicates user activity that is unusual for the user or consistent with known attack patterns.
Identifies when an account hasn't signed in during the past n number of days.
Page 136 of 185