Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,864 detections
Filters
Last updated
All Time
Detection languages
2,523
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,448
1,199
1,091
792
575
Platforms
39,931
7,261
6,535
3,864
3,642
Products / Services
1,755
1,449
1,120
438
406
MITRE Techniques
1,888
1,391
913
814
726
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
This detection looks for administrative activity that creates or updates Cross-Tenant Access Settings or Cross-Tenant Identity Synchronization Settings in Microsoft Entra ID (Azure AD). These settings control how identities, claims, and trust relationships are shared between Microsoft Entra tenants.
Detects suspicious access to multiple Azure Storage Accounts using a Shared Access Signature (SAS) token from a single external IP address. This pattern can indicate the use of a compromised, potentially overly permissive, SAS token for reconnaissance or lateral movement.
Detects strong indicators of a successful device code phishing attack.
Detects users who accessed Microsoft Copilot Studio and correlates that activity with OAuth consent events for third-party applications in Azure Active Directory. Optionally, it verifies whether the consented application was used to access data via Microsoft Graph API, indicating potential account compromise.
This KQL Query helps to keep an eye on accounts that are being excluded from Conditional Access (CA) policies which they should be blocked by it and which specific field triggered the CA detection and got them excluded.
The aim of this case is to identify:
Spot CA policies with a high number of exclusions.
Find exclusions that don’t make sense, like skipping MFA when it’s mandatory for privileged accounts.
Catch new exclusions that might not have been approved.
Check how exclusions are actually working (e.g., excluding a device is fine, but if it’s connecting from risky countries or open networks, that’s a problem—hopefully, other CA policies cover this).
Identify unexpected exclusions, which could mean an attacker got in and excluded themselves to bypass CA controls
The aim of this case is to identify:
Spot CA policies with a high number of exclusions.
Find exclusions that don’t make sense, like skipping MFA when it’s mandatory for privileged accounts.
Catch new exclusions that might not have been approved.
Check how exclusions are actually working (e.g., excluding a device is fine, but if it’s connecting from risky countries or open networks, that’s a problem—hopefully, other CA policies cover this).
Identify unexpected exclusions, which could mean an attacker got in and excluded themselves to bypass CA controls
This detection monitors the CommonSecurityLog (which adheres to the Common Event Format - CEF) for indications of malicious network activity. Specifically, it flags outgoing HTTP requests originating from system utilities such as curl, wget, and PowerShell. These requests are often leveraged by attackers for data theft (exfiltration) or establishing command-and-control channels.
Review the full user agent string and destination hostname. Investigate the source IP and user context. Check whether the tool usage aligns with expected behavior for the host or user. Correlate with other indicators such as unusual process execution, file access, or authentication anomalies. Escalate if the destination is unknown or suspicious. Remove the KQL summarise line to view more details.
UA_Check and SafeHosts will require tuning for your specific environment setup and traffic.
Review the full user agent string and destination hostname. Investigate the source IP and user context. Check whether the tool usage aligns with expected behavior for the host or user. Correlate with other indicators such as unusual process execution, file access, or authentication anomalies. Escalate if the destination is unknown or suspicious. Remove the KQL summarise line to view more details.
UA_Check and SafeHosts will require tuning for your specific environment setup and traffic.
This rule detects when an MDI (Microsoft Defender for Identity) sensor is deleted. This could indicate an adversary attempting to impair defenses by removing security monitoring tools.
This query identifies user sign-ins leveraging legacy authentication protocols in Azure Active Directory (AAD). Legacy authentication methods, such as IMAP, POP3, Exchange ActiveSync, SMTP, and older Outlook protocols, do not support modern security features like multi-factor authentication (MFA). Their use increases the risk of account compromise, brute force attacks, and credential theft.
Monitoring for legacy authentication activity is a critical security control to detect potential unauthorized access or accounts bypassing modern security protections.
Monitoring for legacy authentication activity is a critical security control to detect potential unauthorized access or accounts bypassing modern security protections.
This rule detects when an MDE offboarding package is downloaded.
This activity could indicate an attempt to remove an endpoint from security monitoring or management, potentially by an insider threat or an attacker attempting to evade detection.
This activity could indicate an attempt to remove an endpoint from security monitoring or management, potentially by an insider threat or an attacker attempting to evade detection.
This KQL query identifies vulnerable VPN clients installed on endpoints that have High or Critical severity CVEs. VPN software is a high-value target for attackers because vulnerabilities can be exploited to bypass network access controls, intercept traffic, or gain remote access to internal networks.
This query identifies onboarded devices in the environment that have not completed a successful antivirus scan within the last 30 days. It provides visibility into endpoint compliance, ensuring that all devices are actively monitored and protected by Microsoft Defender or other antivirus solutions.
Maintaining up-to-date AV scan activity is critical as devices without recent scans may harbor unobserved threats or be at increased risk of compromise.
Maintaining up-to-date AV scan activity is critical as devices without recent scans may harbor unobserved threats or be at increased risk of compromise.
This hunting query validates the health and availability of Microsoft Defender telemetry sources across environments based on their respective common data tables.
This includes the different Defender solution:
Defender for Endpoint
Defender for Identity
Defender for Office 365
Defender for Cloud Apps
Defender for Cloud
The query enumerates all key log tables within the Log Analytics workspace and checks whether they:
Are present and actively ingesting data (logs seen within the last 7 days)
Are stale (no new events within the last 7 days)
Are missing entirely, indicating the data connector is disabled or misconfigured
The output provides a quick health status (✅ Active, ⚠️ Stale, or ❌ Missing) for each core log source
Monitoring these sources ensures that critical endpoint, identity, email, and cloud security telemetry is being ingested into Microsoft Sentinel as a singular method.
This includes the different Defender solution:
Defender for Endpoint
Defender for Identity
Defender for Office 365
Defender for Cloud Apps
Defender for Cloud
The query enumerates all key log tables within the Log Analytics workspace and checks whether they:
Are present and actively ingesting data (logs seen within the last 7 days)
Are stale (no new events within the last 7 days)
Are missing entirely, indicating the data connector is disabled or misconfigured
The output provides a quick health status (✅ Active, ⚠️ Stale, or ❌ Missing) for each core log source
Monitoring these sources ensures that critical endpoint, identity, email, and cloud security telemetry is being ingested into Microsoft Sentinel as a singular method.
This detection identifies single-factor ROPC (Resource Owner Password Credentials) logins from new countries not seen in the last 14 days for a given user+app combination. ROPC authentication does not support MFA, making it a frequent vector for attackers to bypass MFA misconfigurations and gain initial access or escalate privileges in Azure AD.
This hunting query verifies the availability and health of critical Microsoft 365, Azure, and Defender data sources that are essential for visibility in the case of incident response.
Ensuring these log sources are active is fundamental for maintaining readiness to conduct full-scope investigations when an incident occurs without data loss or visibility gaps.
The query enumerates all key log tables within the Log Analytics workspace and checks whether they:
Are present and actively ingesting data (logs seen within the last 7 days)
Are stale (no new events within the last 7 days)
Are missing entirely, indicating the data connector is disabled or misconfigured
The output provides a quick health status (✅ Active, ⚠️ Stale, or ❌ Missing) for each core log source
Ensuring these log sources are active is fundamental for maintaining readiness to conduct full-scope investigations when an incident occurs without data loss or visibility gaps.
The query enumerates all key log tables within the Log Analytics workspace and checks whether they:
Are present and actively ingesting data (logs seen within the last 7 days)
Are stale (no new events within the last 7 days)
Are missing entirely, indicating the data connector is disabled or misconfigured
The output provides a quick health status (✅ Active, ⚠️ Stale, or ❌ Missing) for each core log source
This rule detects a highly suspicious sequence of events: a user clicking on a URL (potentially a phishing link) followed by a risky sign-in attempt to Azure AD from an IP address outside the organization's defined range. The rule specifically looks for sign-ins with a high-risk level (>= 50) that occur after a URL click event, suggesting a potential compromise initiated by a phishing attack.
https://www.proofpoint.com/us/blog/threat-insight/beyond-credentials-weaponizing-oauth-applications-persistent-cloud-access
In Microsoft 365 environments, administrators and certain privileged users can access mailbox content through actions such as email preview or message download. While these capabilities are often used for legitimate purposes — such as security investigations, eDiscovery, or incident response — they also represent a potential insider threat or privacy violation risk if misused.
Unauthorized access to mailbox data can expose confidential communications, sensitive attachments, or personally identifiable information (PII). Therefore, it’s crucial to continuously monitor when administrators perform actions like:
GetMailPreviewUrl – viewing an email’s content through a preview link
DownloadEMail – exporting or downloading a full email message
If these actions are not tied to a legitimate investigation or security workflow, they could indicate abuse of administrative privileges or data exfiltration attempts.
Unauthorized access to mailbox data can expose confidential communications, sensitive attachments, or personally identifiable information (PII). Therefore, it’s crucial to continuously monitor when administrators perform actions like:
GetMailPreviewUrl – viewing an email’s content through a preview link
DownloadEMail – exporting or downloading a full email message
If these actions are not tied to a legitimate investigation or security workflow, they could indicate abuse of administrative privileges or data exfiltration attempts.
Detects user sign-ins occurring outside of predefined normal business hours and from locations not explicitly whitelisted. This rule aims to identify potentially unauthorized access attempts or compromised accounts being used at unusual times or from unexpected geographies.
Detects the registration of a new device or MFA authentication method in Microsoft Entra ID from an IP address geolocated to Morocco. This is a persistence tactic used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539).
This rule detects when multi-factor authentication (MFA) has been explicitly disabled for a user in Azure Active Directory. This activity could indicate an adversary attempting to bypass authentication mechanisms to gain unauthorized access or maintain persistence.
Detects successful authentication attempts originating from clients using legacy authentication methods, identifiable via specific user agent strings. This activity can indicate an adversary attempting to bypass multi-factor authentication (MFA), potentially as part of a password spray attack. Legacy authentication protocols often do not support modern MFA mechanisms, making them a target for attackers who have obtained valid credentials through other means or are performing brute-force attacks like password spraying.
Page 146 of 184