Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,064 detections
Filters
Last updated
All Time
Detection languages
597
173
103
71
51
Contributors
184
155
139
90
73
Categories
20,443
11,831
5,875
5,151
4,864
1,064
Platforms
575
266
228
223
118
Products / Services
498
220
130
118
86
MITRE Techniques
488
451
363
349
341
CVEs
10
5
4
3
2
IDS Classtypes
34
3
2
2
1
IDS Protocols
29
9
1
KQL Query
KQL Query from file: Detect Power Pwn (aka LOLCopilot) Red Team Tool
KQL Query from file: Threat Hunting Nation State Actors
KQL Query from file: Critical Monitor for Critical Assets
KQL Query from file: Exposure Management + Defender for Office 365
KQL Query from file: DISCOVERY: Obsolete device connecting to Entra
KQL Query from file: NTLMv2 Hash Leak via COM Detection
KQL Query from file: Entra Risk Events & MITRE ATT&CK Analysis
KQL Query
KQL Query from file: Identity Blast Radius 2
KQL Query from file: Detecting Nation State Actors @ Near Realtime
KQL Query from file: Sentinel Timeroasting KQL detection
KQL Query from file: Honeypot Threat Intelligence (TI) Data
KQL Query
KQL Query from file: Identity Blast Radius
KQL Query from file: HTTP Client Tools Exploitation for ATO Detection
Detects suspicious Kerberos TGT requests with pre-authentication disabled (Pre-Authentication Type = 0) and Ticket Encryption Type (0x17) i.e, RC4-HMAC.
This may indicate an AS-REP Roasting attack, where attackers request AS-REP messages for accounts without pre-authentication and attempt to crack the encrypted ticket offline to recover user passwords.
This may indicate an AS-REP Roasting attack, where attackers request AS-REP messages for accounts without pre-authentication and attempt to crack the encrypted ticket offline to recover user passwords.
This query helps hunting for possible device code Phishing attempts
'This hunting query will alert on any Impossible travel activity in correlation with mailbox permission tampering followed by account being added to a PIM managed privileged group.
Ensure this impossible travel incident with increase of privileges is legitimate in your environment.'
Ensure this impossible travel incident with increase of privileges is legitimate in your environment.'
This query looks for users sharing access to files with external users.
This applies to SharePoint and OneDrive users.
Audit event and Cloud application identifier references.
Reference - https://learn.microsoft.com/microsoft-365/compliance/audit-log-sharing?view=o365-worldwide
Reference - https://learn.microsoft.com/azure/sentinel/entities-reference#cloud-application-identifiers
This applies to SharePoint and OneDrive users.
Audit event and Cloud application identifier references.
Reference - https://learn.microsoft.com/microsoft-365/compliance/audit-log-sharing?view=o365-worldwide
Reference - https://learn.microsoft.com/azure/sentinel/entities-reference#cloud-application-identifiers
In this detection,we hunt for any sign-in attempt from a non-managed, non-compliant, untrusted device.
Page 42 of 51