Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
839 detections
Filters
Last updated
All Time
Detection languages
438
190
77
62
40
Contributors
120
114
72
71
68
Categories
464
233
193
152
122
Platforms
288
274
154
88
56
Products / Services
220
169
162
90
76
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
839
CVEs
6
5
5
5
5
IDS Classtypes
4
2
IDS Protocols
1
KQL Query from file: Threat Intelligence Data from Sentinel UEBA
KQL Query
KQL Query
KQL Query from file: Critical Identities OAuth Grant
KQL Query from file: Hunting malicious oauth grant by phished user
KQL Query from file: CloudApp Privilege OAuth Grant
KQL Query
KQL Query
KQL Query
KQL Query from file: ATP Detection for Critical Identities
KQL Query
KQL Query from file: CVE-2024-7971 Patch Prioritization
KQL Query from file: Detecting Copilot Studio Bot Creation
KQL Query
KQL Query from file: Monthly Report Entra Eligible Role Activation
KQL Query from file: HTTP Client Tools Exploitation for ATO Detection
KQL Query from file: RID Hijacking Technique and Detection
KQL Query
Detects scenarios where one can control another users or computers account without having to use their credentials.
'This query identifies attackers trying to enumerate the Storage keys as well as updating roles using AzureActivity,SigninLogs
and AuditLogs'
and AuditLogs'
'An account could be blocked if there are too many failed authentication attempts in a row. This hunting query identifies if a MFA user account that is set to blocked tries to login to Microsoft Entra ID.
This query has also been updated to include UEBA logs IdentityInfo and BehaviorAnalytics for contextual information around the results.'
This query has also been updated to include UEBA logs IdentityInfo and BehaviorAnalytics for contextual information around the results.'
Page 33 of 40