Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
414 detections
Filters
Last updated
All Time
Detection languages
226
76
49
34
16
Contributors
129
50
43
42
35
Categories
152
125
118
106
84
Platforms
338
155
147
27
11
Products / Services
10,665
9,758
6,692
4,418
3,749
414
MITRE Techniques
254
202
134
129
109
CVEs
1
1
1
This rule identifies risky sign-in attempts in Azure Active Directory where the sign-in originates from an IP address that has not been seen before or has been seen fewer than 3 times in the last 29 days for that specific user. It filters out guest users, non-compliant devices, and unmanaged devices, focusing on sign-ins with an aggregated risk level greater than 1 and a sign-in risk level of 50 or higher. Excluded applications are specified to reduce false positives.
This rule identifies unusual activity from locations not previously observed for a user within a defined lookback period. It leverages Microsoft Entra ID (Azure AD) Behavior Analytics and SigninLogs to baseline legitimate user locations and filter out trusted devices/IPs. The rule flags unusual activity where the source IP location is new for the user and exceeds a configurable threshold of 'unusual' behavior indicators, while also excluding specified trusted countries.
This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. Threat actors like Static Tundra have been observed configuring TFTP servers to make device configuration files accessible for exfiltration after gaining initial access. The detection specifically looks for commands that expose critical configuration files such as startup-config, running-config, and other sensitive system information through TFTP. This activity is particularly concerning as it may represent an attempt to steal credentials, network topology information, and other sensitive data stored in device configurations.
This rule detects suspicious inbox forwarding rules, specifically those that forward a copy of all emails to an external address. This behavior is often indicative of an attacker attempting to exfiltrate sensitive information from a compromised mailbox.
Indicates suspicious rules such as an inbox rule that forwards a copy of all emails to an external address
Detect suspicious graph user activity with behavioral analytics (UEBA)
A user inadvertently granted consent to an external, unverified OAuth application. Exploiting the high-level permissions obtained, a threat actor initiated an attack targeting the tenant’s environment via Microsoft Graph.
This rule detects potentially malicious sign-in attempts that occur shortly after a user clicks on a URL, especially when the sign-in originates from a different IP address or subnet than the URL click. It specifically looks for risky sign-ins to Microsoft first-party applications. The logic aims to identify scenarios where a user might be phished (e.g., via a malicious link) and then their credentials are used to sign in from an attacker-controlled location.
KQL Query from file: Detect Microsoft Graph API Abuse
KQL Query
KQL Query
KQL Query from file: The Hunt for QR Phisher
KQL Query from file: NEW Real-time Anomalous Token Detection
KQL Query from file: Malicious FIDO2 Registration Threat Detection
KQL Query from file: Attacker in the Middle Precision Detection
KQL Query from file: Detect Privilege Admin under AiTM attack
KQL Query
KQL Query from file: Threat Intelligence Data from Sentinel UEBA
KQL Query from file: Critical Identities OAuth Grant
KQL Query
KQL Query
Page 14 of 20