Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,311 detections
Filters
Last updated
All Time
Detection languages
2,035
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,456
11,839
5,876
5,155
4,865
4,311
Platforms
2,572
793
615
382
319
Products / Services
767
740
659
513
348
MITRE Techniques
2,350
917
848
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
KQL Query from file: Threat Hunt: Potential Password Spray Attacks
KQL Query from file: Potential MFASweep (tool) activity has been detected.
Detects suspicious Kerberos Ticket Granting Ticket (TGT) requests where pre-authentication is disabled (Pre-Authentication Type = 0) and the ticket encryption type is RC4-HMAC (0x17). This combination is indicative of an AS-REP Roasting attack, where an adversary requests AS-REP messages for accounts without pre-authentication and attempts to crack the encrypted ticket offline to recover user passwords.
Detects the use of known malicious PowerShell commandlets often associated with exploitation frameworks. These commandlets perform various adversarial actions such as credential dumping, reconnaissance, persistence, privilege escalation, and data exfiltration.
KQL Query from file: Kerberos Roasting Detection
Detects the use of known malicious PowerShell commandlets often associated with exploitation frameworks, red-teaming tools, and malware. This rule identifies a wide range of offensive PowerShell functions used for reconnaissance, credential dumping, privilege escalation, persistence, and data exfiltration.
KQL Query from file: GraphRunner Recon Detection & Response
KQL Query from file: Azure Cloud Security Monitoring
KQL Query from file: Sentinel KQL Detection for ShadowHound
KQL Query from file: Detect Microsoft Graph API Abuse
KQL Query from file: Monitor Privilege User SSPR
KQL Query from file: Password Spraying Detection in Active Directory
KQL Query
KQL Query from file: ClickFix social engineering attack detection
KQL Query
KQL Query from file: High-Risk assets with command line credentials
KQL Query from file: Microsoft Entra Identity Attack Threat Detection
KQL Query
KQL Query from file: Sentinel UEBA Privilege Escalation Detection
KQL Query from file: NEW Real-time Anomalous Token Detection
KQL Query from file: Malicious FIDO2 Registration Threat Detection
Page 173 of 206