Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
158 detections
Filters
Last updated
All Time
Detection languages
86
29
20
11
4
Contributors
36
20
17
16
15
Categories
128
67
12
11
11
Platforms
106
46
35
27
10
Products / Services
57
39
28
19
16
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
3
IDS Classtypes
1
IDS Protocols
1
KQL Query from file: Nation State Actors via Microsoft Graph
KQL Query
KQL Query
KQL Query from file: Conditional Access Report
KQL Query from file: EntraFalcon Detection
KQL Query
KQL Query from file: AWS NoSuchBucket Check
KQL Query from file: OAuth app using the OD file picker permission
KQL Query from file: Azure AI Security Finding Report
KQL Query
KQL Query
KQL Query from file: Honeypot Threat Intelligence (TI) Data
KQL Query
This detection leverages Azure Graph activity logs to identify when Graph APIs have been used to identify 10 or more service principals. This type of behavior is associated with tools such as Azure enumeration tools like AzureHound or ROADtools.
This detection identifies the presence of the default AzureHound user-agent string within Microsoft Graph Activity logs and NonInteractive SignIn Logs. AzureHound is a tool used for gathering information about Azure Active Directory environments, often employed by security professionals for legitimate auditing purposes. However, it can also be leveraged by malicious actors to perform reconnaissance activities, mapping out the Azure AD infrastructure to identify potential vulnerabilities and targets for further exploitation. Detecting its usage can help in identifying unauthorized access attempts and preemptively mitigating potential security threats to your Azure environment.
In this detection,we hunt for any sign-in attempt from a non-managed, non-compliant, untrusted device.
Looks for multiple users that had their admin role removed by a single user within a certain period.
'This detection identifies high-severity alerts across various Microsoft security products, including Microsoft Defender XDR and Microsoft Entra ID, and correlates them with instances of Google Cloud VM creation. It focuses on instances where VMs were created within a short timeframe of high-severity alerts, potentially indicating suspicious activity.'
'This query look for users starting an Azure CloudShell session and summarizes the Azure Activity from that
user account during that timeframe (by default 1 hour). This can be used to help identify abuse of the CloudShell
to modify Azure resources.'
user account during that timeframe (by default 1 hour). This can be used to help identify abuse of the CloudShell
to modify Azure resources.'
Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters
Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters
Page 6 of 8