Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,311 detections
Filters
Last updated
All Time
Detection languages
2,035
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,456
11,839
5,876
5,155
4,865
4,311
Platforms
2,572
793
615
382
319
Products / Services
767
740
659
513
348
MITRE Techniques
2,350
917
848
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
KQL Query
KQL Query from file: Detecting Mamba 2FA phishing-as-a-service
KQL Query
KQL Query from file: Multi-Cloud DefenderXDR KQL Threat Detection
KQL Query
KQL Query from file: New Threat Actor Group Signature
KQL Query
KQL Query
KQL Query from file: Detect Power Pwn (aka LOLCopilot) Red Team Tool
KQL Query from file: Threat Hunting Nation State Actors
KQL Query from file: Critical Monitor for Critical Assets
KQL Query from file: Exposure Management + Defender for Office 365
KQL Query from file: T1555.003 - Credentials from Web Browsers
KQL Query from file: Threat Intelligence Data from Sentinel UEBA2
KQL Query
KQL Query from file: NTLMv2 Hash Leak via COM Detection
Detects changes to the "StrongAuthenticationRequirement" value, where the state is set to "0" or "Disabled". Threat actors were seen disabling multi factor authentication for users in order to maintain or achieve access to the account. Also see in SIM Swap attacks.
KQL Query from file: Entra Risk Events & MITRE ATT&CK Analysis
KQL Query from file: OAuth App for BEC & Phishing Detection
KQL Query from file: Identity Blast Radius 2
KQL Query from file: CVE-2024-7971 Patch Prioritization
Page 175 of 206