Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,864 detections
Filters
Last updated
All Time
Detection languages
2,523
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,448
1,199
1,091
792
575
Platforms
39,931
7,261
6,535
3,864
3,642
Products / Services
1,755
1,449
1,120
438
406
MITRE Techniques
1,888
1,391
913
814
726
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
KQL Query from file: T1555.003 - Credentials from Web Browsers
KQL Query from file: KQL to check Azure API spray attacks
KQL Query from file: DISCOVERY: Obsolete device connecting to Entra
KQL Query from file: Threat Intelligence Data from Sentinel UEBA2
KQL Query
KQL Query from file: Tracking The Most Dangerous Entra Admin Role
KQL Query from file: Check for Azure Outdated Security Protocols
Detects changes to the "StrongAuthenticationRequirement" value, where the state is set to "0" or "Disabled". Threat actors were seen disabling multi factor authentication for users in order to maintain or achieve access to the account. Also see in SIM Swap attacks.
KQL Query
KQL Query from file: Sentinel Alerts & MITRE ATT&CK Analysis
KQL Query from file: Entra Risk Events & MITRE ATT&CK Analysis
KQL Query
KQL Query from file: Identity Blast Radius 2
KQL Query from file: DefenderXDR Exposure Management for CVE-2024-3094
KQL Query from file: Detecting Nation State Actors @ Near Realtime
KQL Query
KQL Query from file: M365 Copilot Extensions Threat Monitoring
KQL Query from file: .NET Reflection Defense Evasion (Reflective Code Loading)
KQL Query from file: Exposure Management - Slim's Metric (MaxCVSS-DAW)
KQL Query from file: Detecting Copilot Studio Bot Creation
KQL Query from file: CVE-2024-3094 with CVSS Score 10
Page 160 of 184