Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,224 detections
Filters
Last updated
All Time
Detection languages
1,117
30
19
17
15
Contributors
391
236
131
85
62
Categories
313
252
228
185
166
Platforms
651
437
269
228
200
Products / Services
10,680
9,761
6,694
4,418
3,744
1,224
MITRE Techniques
265
260
234
217
209
CVEs
8
8
6
6
6
IDS Classtypes
2
2
1
1
1
IDS Protocols
2
1
This query visualises total emails with Spam detections summarizing the data by email sender IP address (SenderIPv4, SenderIPv6).
Detecting LOLDrivers using www.loldrivers.io and MDE telemetry.
This rule was created by Mehmet Ergene from BluRaven Academy and added to Detections.ai as it was missing from the repository.
This rule was created by Mehmet Ergene from BluRaven Academy and added to Detections.ai as it was missing from the repository.
Detects suspicious registry modifications for IFEO entries which can be used by attackers for persistence.
This is based off of testing with Atomic Red Team tests - https://www.atomicredteam.io/atomic-red-team/atomics/T1546.012
This is based off of testing with Atomic Red Team tests - https://www.atomicredteam.io/atomic-red-team/atomics/T1546.012
This KQL detection is designed for use in Microsoft Defender for Endpoint Advanced Hunting or Microsoft Sentinel, depending on table availability.
It focuses on identifying two common persistence techniques used by threat actors:
COM hijacking via user-specific registry hives (InprocServer32 and LocalServer32), particularly when leveraged by .NET or PowerShell-based malware; and uncommon registry-based persistence through suspicious keys such as DelegateExecute, TreatAs, and ScriptletURL.
The KQL focusses on user-specific registry hives as they don't require elevated privileges to modify and is why we also ignore "nt authority" activity as this detection is focused on low hanging fruit that would be easily accessible to a threat actor initially for persistence without privilege escalation.
It focuses on identifying two common persistence techniques used by threat actors:
COM hijacking via user-specific registry hives (InprocServer32 and LocalServer32), particularly when leveraged by .NET or PowerShell-based malware; and uncommon registry-based persistence through suspicious keys such as DelegateExecute, TreatAs, and ScriptletURL.
The KQL focusses on user-specific registry hives as they don't require elevated privileges to modify and is why we also ignore "nt authority" activity as this detection is focused on low hanging fruit that would be easily accessible to a threat actor initially for persistence without privilege escalation.
KQL Query from file: Potential MFASweep (tool) activity has been detected.
Detects when a Global Administrator elevates access to all subscriptions and management groups in a tenant. When a Global Administrator elevates access they are assigned the User Access Administrator role at root scope. This Sentinel analytics rule monitors who has elevated access in your tenant so that admins can take appropriate action.
This detection identifies when Microsoft Copilot Studio agents are created in your organization's tenant. This activity is significant as the default behavior in Copilot agent creation is to configure a new service principal with cloud app administrator role.
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
This KQL detection rule identifies suspicious login attempts in the SigninLogs dataset where a sign-in was blocked because it originated from an IP address flagged for malicious activity.
The rule specifically focuses on cases where valid credentials or token claims were used during the authentication process.
The rule specifically focuses on cases where valid credentials or token claims were used during the authentication process.
DEVMAN Ransomware Detection
KQL Query from file: Kerberos Roasting Detection
KQL Query from file: GraphRunner Recon Detection & Response
KQL Query from file: Azure Cloud Security Monitoring
KQL Query from file: Sentinel KQL Detection for ShadowHound
KQL Query from file: Monitoring Cross-Tenant Abuse by Threat Actors
This query visualises total emails with Phish detections over time summarizing the data daily by Delivery Location.
KQL Query from file: Sentinel - Threat Hunting DNS Tunneling
KQL Query
KQL Query from file: Sentinel All-In-One IP ThreatHunt
This query visualises emails with Phish detections (Normal confidence) summarizing the data by Delivery Location.
KQL Query
KQL Query
Page 51 of 59