Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
414 detections
Filters
Last updated
All Time
Detection languages
226
76
49
34
16
Contributors
129
50
43
42
35
Categories
152
125
118
106
84
Platforms
338
155
147
27
11
Products / Services
10,665
9,758
6,692
4,418
3,749
414
MITRE Techniques
254
202
134
129
109
CVEs
1
1
1
KQL Query from file: Hunting malicious oauth grant by phished user
KQL Query from file: Hunting Rockstar 2FA
KQL Query from file: Detecting High Risk Passkey Users
KQL Query from file: Entra Admin Roles Query
KQL Query
KQL Query
KQL Query
KQL Query from file: Threat Hunting Nation State Actors
KQL Query from file: Critical Monitor for Critical Assets
KQL Query from file: ATP Detection for Critical Identities
KQL Query from file: Exposure Management + Defender for Office 365
KQL Query from file: Threat Intelligence Data from Sentinel UEBA2
KQL Query
KQL Query from file: Entra Risk Events & MITRE ATT&CK Analysis
KQL Query from file: Identity Blast Radius 2
KQL Query from file: Detecting Nation State Actors @ Near Realtime
KQL Query from file: Honeypot Threat Intelligence (TI) Data
KQL Query from file: Identity Blast Radius
This query helps hunting for possible device code Phishing attempts
'Malware authors will sometimes hardcode user agent string values when writing the network communication component of their malware. Malformed user agents can be an indication of such malware.'
'Detects when there is a Service Principal login attempt from a country that has not seen a successful login in the previous 14 days.
Threat actors may attempt to authenticate with credentials from compromised accounts - monitoring attempts from anomalous locations may help identify these attempts.
Authentication attempts should be investigated to ensure the activity was legitimate and if there is other similar activity.
Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-for-failed-unusual-sign-ins'
Threat actors may attempt to authenticate with credentials from compromised accounts - monitoring attempts from anomalous locations may help identify these attempts.
Authentication attempts should be investigated to ensure the activity was legitimate and if there is other similar activity.
Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-for-failed-unusual-sign-ins'
Page 15 of 20