Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,064 detections
Filters
Last updated
All Time
Detection languages
597
173
103
71
51
Contributors
184
155
139
90
73
Categories
20,443
11,831
5,875
5,151
4,864
1,064
Platforms
575
266
228
223
118
Products / Services
498
220
130
118
86
MITRE Techniques
488
451
363
349
341
CVEs
10
5
4
3
2
IDS Classtypes
34
3
2
2
1
IDS Protocols
29
9
1
This detection monitors for signs of a shared or potentially compromised root account on ESXi hosts by tracking the number of unique IP addresses logging in as root within a short time window. Multiple logins from different IPs in a brief period may indicate credential misuse, lateral movement, or account compromise.
This rule detects potentially malicious sign-in attempts that occur shortly after a user clicks on a URL, especially when the sign-in originates from a different IP address or subnet than the URL click. It specifically looks for risky sign-ins to Microsoft first-party applications. The logic aims to identify scenarios where a user might be phished (e.g., via a malicious link) and then their credentials are used to sign in from an attacker-controlled location.
Detects a sequence of events indicative of a new device being registered using a refresh token, a TTP associated with the ROADtools framework following an OAuth phishing attack. This sequence involves the Device Registration Service adding a device with a specific hardcoded OS version, followed by user and owner assignments, all within a short timeframe and sharing the same correlation ID.
This rule detects activity from a list of specified malicious IP addresses across network connection events and sign-in attempts. It correlates `DeviceNetworkEvents` (network connections from devices) and `SigninLogs` (user authentication attempts) to identify instances where these IPs are involved. The rule is designed for hunting, looking back 30 days for any activity originating from the defined IP addresses.
KQL Query from file: Threat Hunt: Potential Password Spray Attacks
KQL Query from file: Potential MFASweep (tool) activity has been detected.
This KQL detection rule identifies suspicious login attempts in the SigninLogs dataset where a sign-in was blocked because it originated from an IP address flagged for malicious activity.
The rule specifically focuses on cases where valid credentials or token claims were used during the authentication process.
The rule specifically focuses on cases where valid credentials or token claims were used during the authentication process.
KQL Query from file: NauthNRPC Detection
KQL Query
KQL Query from file: Threat Hunting AzureHound Usage
KQL Query from file: Azure Cloud Security Monitoring
KQL Query from file: Sentinel KQL Detection for ShadowHound
KQL Query from file: Detect Microsoft Graph API Abuse
KQL Query from file: Monitor Privilege User SSPR
KQL Query
KQL Query from file: Microsoft Entra Identity Attack Threat Detection
KQL Query from file: The Hunt for QR Phisher
KQL Query from file: Sentinel UEBA Privilege Escalation Detection
KQL Query from file: Detect Privilege Admin under AiTM attack
KQL Query from file: Entra Cross-Tenant Activity Monitoring
KQL Query
Page 40 of 51