Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,866 detections
Filters
Last updated
All Time
Detection languages
2,525
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects instances where the same user performs both a role assignment (potentially for privilege escalation) and executes a Run Command on an Azure Virtual Machine within a one-hour window. This behavior is indicative of an attacker modifying access control and immediately executing arbitrary code on the target resource.
This rule aggregates sign-in log activity for a specific user to identify the volume and distribution of authentication attempts across different IP addresses, applications, and client types within a specified time range. It is primarily used for identifying anomalies in access patterns that might indicate credential abuse or unauthorized access.
This rule detects a significant spike in usage for Azure Cognitive Services, specifically for operations like Chat Completions or Image Generation. By comparing the request count per caller to their historical average (hourly), the rule identifies potential abuse, service disruption, or unauthorized resource usage.
Detects session hijacking activity characteristic of the Mirage2FA AiTM (Adversary-in-the-Middle) phishing toolkit. The rule identifies non-interactive authentication events (token reuse) that lack an MFA challenge, occurring shortly after interaction with a known malicious phishing proxy domain. It further correlates this activity with anomalous signals, such as impossible travel or the use of an unseen device/user-agent, to confirm high-fidelity malicious intent.
Detects anomalous authentication behavior indicative of an Adversary-in-the-Middle (AiTM) phishing kit. The rule identifies multiple password submission attempts (failures) followed by a successful authentication within a short period, consistent with an attacker testing multiple harvested credentials against an active session.
Identifies DNS queries to a known malicious C2 domain and summarizes activity by client IP, including the first and last observed query and total query count.
Identifies Microsoft Entra Privileged Identity Management (PIM) role activations occurring outside normal business hours or during weekends.
The query reviews role management audit events, converts timestamps to a defined local timezone, and highlights successful privileged role activations that occur outside business hours and on weekends.
This detection helps security teams identify unusual, privileged access activity that may warrant additional investigation, especially for highly privileged roles.
The query reviews role management audit events, converts timestamps to a defined local timezone, and highlights successful privileged role activations that occur outside business hours and on weekends.
This detection helps security teams identify unusual, privileged access activity that may warrant additional investigation, especially for highly privileged roles.
Detects modifications, registrations, or deletions of security information for a user account, or general management updates within the user directory, which may indicate account tampering or unauthorized privilege persistence.
Finds Microsoft Sentinel analytics rules that generate high volumes of non-actionable closed incidents. The query calculates false positive, benign positive, undetermined, and true positive rates per rule, then provides practical tuning recommendations to help SOC and detection engineering teams reduce alert fatigue.
Detects successful device code authentication flows from users who have not utilized this authentication method within the past 14 days. This rule monitors Entra ID (Azure AD) sign-in logs and non-interactive logs, enriching results with Intune device compliance data and authentication protocol details to assist in identifying anomalous access patterns that may indicate credential abuse or device-code phishing.
A host repeatedly queries the same DNS domain within a short period, which may indicate automated command-and-control beaconing.
Correlates Microsoft Sentinel Security Alerts and Security Incidents associated with a specific user account over a 90-day period. The query identifies medium and high-severity alerts, maps them to their corresponding incidents, and provides investigation outcomes including classification, closure details, and ownership information.
This detection enables analysts to quickly understand a user's historical security exposure, determine whether previous incidents were resolved appropriately, and identify patterns of recurring security activity.
This detection enables analysts to quickly understand a user's historical security exposure, determine whether previous incidents were resolved appropriately, and identify patterns of recurring security activity.
This rule detects potential password spraying activity by monitoring Microsoft Entra sign-in logs for multiple failed authentication attempts originating from the same source IP address targeting ten or more distinct user accounts within a ten-minute time window.
Detects periodic beaconing and configuration polling by the TWINLOOT implant using Azure Blob Storage as a dead-drop mechanism. The rules identify specific TLS SNI patterns and HTTP requests for 'cfg.json' files hosted on Azure Blob storage using non-browser user-agents.
Detects successful Microsoft Entra RoleManagement activity where a member is assigned permanently to a role outside of Privileged Identity Management (PIM). This is flagged as a privileged access risk because it bypasses just-in-time eligibility and activation controls.
This rule detects potentially malicious, unauthenticated GraphQL mutation requests targeting common data modification operations ('delete', 'destroy', 'remove', 'update'). By checking for missing Authorization and Session tokens during frequent mutation attempts, it identifies potential exploitation attempts or unauthorized data manipulation attempts against an exposed GraphQL endpoint.
Aggregates identity, endpoint, cloud application, and messaging telemetry to build a consolidated profile of the devices, clients, applications, and user agents associated with a specific user account.
The query combines Microsoft Entra sign-in data, endpoint logon activity, cloud application events, and email telemetry to provide a high-level overview of a user's activity footprint across the environment.
This query is useful for incident response, account compromise investigations, insider threat investigations, and validating whether a user is accessing services from expected devices and client applications.
The query combines Microsoft Entra sign-in data, endpoint logon activity, cloud application events, and email telemetry to provide a high-level overview of a user's activity footprint across the environment.
This query is useful for incident response, account compromise investigations, insider threat investigations, and validating whether a user is accessing services from expected devices and client applications.
Correlates Microsoft Entra Privileged Identity Management (PIM) role eligibility with actual activation activity to identify how privileged roles are being used across the environment.
The query combines eligible PIM assignments with activation events and submitted business justifications, allowing security teams to determine which privileged roles are frequently activated, rarely used, or never activated.
This is useful for privileged access reviews, least-privilege initiatives, role cleanup exercises, and validating whether users are providing meaningful activation justifications.
The query combines eligible PIM assignments with activation events and submitted business justifications, allowing security teams to determine which privileged roles are frequently activated, rarely used, or never activated.
This is useful for privileged access reviews, least-privilege initiatives, role cleanup exercises, and validating whether users are providing meaningful activation justifications.
Correlates Microsoft Entra identity risk detections with subsequent password changes, MFA registrations, and security information modifications. Helps identify potential account compromise scenarios where authentication methods or credentials are altered after suspicious sign-in activity.
Detects Microsoft Entra audit events where a user is added to either the Global Administrator or Cloud Device Administrator built-in roles, which are high-privilege administrative roles.
Identifies Microsoft Sentinel scheduled analytics rules that have executed successfully over a specified period but have never produced any query results.
The query reviews Microsoft Sentinel health telemetry and highlights rules that consistently execute without generating matching events. These rules may represent outdated detections, unused content, environmental mismatches, incorrect data source assumptions, or opportunities for detection engineering review.
This query helps SOC and detection engineering teams reduce maintenance overhead, improve content quality, and identify candidates for retirement or redesign.
The query reviews Microsoft Sentinel health telemetry and highlights rules that consistently execute without generating matching events. These rules may represent outdated detections, unused content, environmental mismatches, incorrect data source assumptions, or opportunities for detection engineering review.
This query helps SOC and detection engineering teams reduce maintenance overhead, improve content quality, and identify candidates for retirement or redesign.
Page 82 of 185