Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
188 detections
Filters
Last updated
All Time
Detection languages
154
11
11
7
3
Contributors
47
34
22
16
9
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
100
58
51
32
23
Products / Services
72
20
19
13
12
MITRE Techniques
86
71
56
52
33
CVEs
5
5
5
4
4
IDS Classtypes
7
4
IDS Protocols
10
1
This rule identifies devices that are missing recommended security updates based on data from Microsoft Defender for Endpoint's TVM (Threat and Vulnerability Management) capabilities. It joins vulnerability information with knowledge base articles to pinpoint specific missing updates.
This rule identifies devices onboarded to Microsoft Defender that are vulnerable to a specific CVE (CVE-2024-38063) by querying the DeviceTvmSoftwareVulnerabilities table and joining it with DeviceInfo to filter for onboarded devices. It aims to help identify the presence of a known vulnerability across the environment's devices.
This rule identifies a source IP address that is triggering a variety of Akamai WAF rules across multiple hosts, which is indicative of broad scanning or reconnaissance activity. It aggregates events by source IP within 30-minute windows, counting distinct WAF rules and hosts targeted. The rule then applies thresholds to identify suspicious behavior, specifically looking for an IP that triggers more than 5 distinct WAF rules, targets more than 2 distinct hosts, and generates over 10 denied events.
This rule detects the creation or modification of ASPX/ASP files within specific SharePoint web server directories on devices identified as vulnerable to CVE-2025-49706 or CVE-2025-53770. It leverages vulnerability management data to narrow down the scope to only vulnerable SharePoint servers, then monitors file events in common SharePoint LAYOUTS paths for web shell indicators. The rule also uses file profiling to identify potentially novel or malicious ASPX/ASP files that lack Defender visibility.
This rule identifies devices that are both critical to the organization (based on exposure graph data) and are vulnerable to CVE-2024-30040. It leverages Microsoft Defender Vulnerability Management data to correlate critical assets with known vulnerabilities.
KQL Query
KQL Query from file: Threat Intelligence Data from Sentinel UEBA
KQL Query from file: Remote code execution exploit chain in OpenVPN
KQL Query
KQL Query
KQL Query
KQL Query
KQL Query
KQL Query from file: Perimeter Defense - Attack Surface Reduction
KQL Query from file: Internet facing devices vulnerablility report
KQL Query from file: CVE-2024-7971 Patch Prioritization
KQL Query from file: Vulnerability Profile: CVE-2024-30040 (Zero-day)
KQL Query from file: DefenderXDR Exposure Management for CVE-2024-3094
KQL Query from file: CVE-2024-26234 and CVE-2024-29988
KQL Query
KQL Query from file: Exposure Management - Slim's Metric (MaxCVSS-DAW)
Page 7 of 9