Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,865 detections
Filters
Last updated
All Time
Detection languages
2,524
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,934
7,265
6,535
3,865
3,645
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Invalid PIM License
Sigma
Identifies when an organization doesn't have the proper license for PIM and is out of compliance.
Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack.
Identifies when the same privilege role has multiple activations by the same user.
Identifies when a privilege role can be activated without performing mfa.
Identifies when a user has been assigned a privilege role and are not using that role.
Monitor and alert for device registration or join events where MFA was not performed.
Detects risky authentication from a non AD registered device without MFA being required.
Monitor and alert for sign-ins where the device was non-compliant.
Monitor and alert for Sign-ins by unknown devices from non-Trusted locations.
Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments.
If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted.
This can be a misconfigured application or potentially something malicious.
If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted.
This can be a misconfigured application or potentially something malicious.
Detects when an account is disabled or blocked for sign in but tried to log in
Alert on when legacy authentication has been used on an account
User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.
Detects when there is a interruption in the authentication process.
Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.
KQL Query from file: Admin consent for M365 Connector for Claude
This rule detects the presence of newly exposed risky web components, such as administrative panels or development tools, that have been discovered by Microsoft Defender External Attack Surface Management (EASM). The rule identifies components from a predefined list of 'risky_components' that have been seen for the first time within the last 7 days, indicating a recent exposure that could increase the attack surface.
KQL Query from file: M365 Connector for Claude Detection
Detects multiple multi-factor authentication (MFA) attempts that are denied or ignored by a user beyond a defined threshold within a specific lookback window. This behavior is indicative of an MFA fatigue attack, where an adversary repeatedly sends MFA requests to a user in hopes they will eventually approve one to stop the annoyance.
This rule detects two related scenarios: 1. Device Code Phishing: Correlates successful device code authentications with subsequent device registrations for the same user within a short time frame. This can indicate an attacker using a phished device code to register a new device. 2. Primary Refresh Token (PRT) Device Registration: Identifies device registrations that occur after an authentication to the Device Registration Service using a Primary Refresh Token. This pattern is indicative of an attacker minting a PRT and then using it to register or join a device, potentially bypassing conditional access policies.
KQL Query from file: KQL Detection for MDI Password Protection Insight
Page 137 of 185