Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,443
11,831
5,875
5,151
4,864
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
Added credential from country X and Signed-In from country Y in a pecific time window:
This query tries to find all applications that credentials were added to them from country X while the application's identity Signed-In from country Y in a specific time window.
This query tries to find all applications that credentials were added to them from country X while the application's identity Signed-In from country Y in a specific time window.
This query helps identifying when new items being added to the Tenant/Allow Block List (TABL) in Defender for Office 365.
'This query looks at the last 14 days for "Consent to application" operation by a user/app which could potentially mean unauthorized access. Additional context is added from AuditLogs based on CorrleationId from the same account that performed the action.'
'Identifies whenever a user account has the setting "Password Never Expires" in the user account properties selected.
This is indicated in Security event 4738 in the EventData item labeled UserAccountControl with an included value of %%2089.
%%2089 resolves to "Don't Expire Password - Enabled".'
This is indicated in Security event 4738 in the EventData item labeled UserAccountControl with an included value of %%2089.
%%2089 resolves to "Don't Expire Password - Enabled".'
This query monitors for users running Log Analytics queries that contain filters for specific, defined VIP user accounts or the VIPUser watchlist template.
Use this detection to alert for users specifically searching for activity of sensitive users.
Use this detection to alert for users specifically searching for activity of sensitive users.
This query visualises the total amount of admin false positive submissions by the state of the submission.
'This hunting query identifies GitHub activites where permissions are updated that may be a sign of compromise.'
This query visualises emails submitted by admins as false negatives, summarizing the data by top 10 sender domains of those emails
This query displays the configuration auditing for 'Safe Attachments for SharePoint, OneDrive, and Microsoft Teams' and 'Safe Documents' in Microsoft Defender for Office 365.
'This query will alert on any sign-ins from devices infected with malware in correlation with workspace deletion activity.
Attackers may attempt to delete workspaces containing compute instances after successful compromise to cause service unavailability to regular business operation.'
Attackers may attempt to delete workspaces containing compute instances after successful compromise to cause service unavailability to regular business operation.'
This query looks for Entra ID role adds identified by Microsoft Defender for Cloud Apps. It will require an corresponding app connector in Microsoft Defender for Cloud Apps.
This query helps reviewing admin reported email submissions
This query visualises emails submitted by admins as false positives, summarizing the data by top 10 sender domains of those emails
This query visualises emails submitted as false negatives by admins where emails where already detected by MDO but there was an admin policy override
'This hunting query looks for users who have run queries that have not previously been seen running queries.'
This query visualises the original detection technology of emails submitted as spam false positive by admins
This query visualises the top admins performing false negative submissions
Find accounts that have been added/removed from groups in AD.
This query visualises the daily amount of admin false positive submission by submission type.
This query helps hunting for Tenant allow/block list (TABL) changes in Defender for Office 365
This query helps report daily on total number of emails, total number of emails detected aby Defender for Office 365
Page 121 of 144