Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,445
11,833
5,875
5,151
4,864
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
KQL Query
KQL Query from file: Detecting EXO MS Graph Enumeration Attacks
KQL Query
KQL Query from file: Critical Monitor for Critical Assets
KQL Query from file: Technique profile eDiscovery misuse detection
KQL Query from file: ATP Detection for Critical Identities
KQL Query from file: Exposure Management + Defender for Office 365
KQL Query from file: Tracking The Most Dangerous Entra Admin Role
KQL Query
KQL Query from file: Sentinel Alerts & MITRE ATT&CK Analysis
KQL Query from file: Entra Risk Events & MITRE ATT&CK Analysis
KQL Query
KQL Query from file: Vulnerability Profile: CVE-2024-30040 (Zero-day)
KQL Query from file: Exposure Management - Slim's Metric (MaxCVSS-DAW)
KQL Query from file: Detecting Copilot Studio Bot Creation
KQL Query from file: Honeypot Threat Intelligence (TI) Data
KQL Query
This rule detects when the user risk and multi-factor authentication (MFA) registration policy is updated within Azure Active Directory (AAD). Attackers may modify these policies to bypass MFA, weaken security thresholds, facilitate further attacks, or maintain persistence by altering how users authenticate or register for MFA.
KQL Query from file: CVE-2024-38063 CVSS 9.8 Prioritization
KQL Query from file: Identity Blast Radius
KQL Query from file: Monthly Report Entra Eligible Role Activation
Page 115 of 144