Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,952
7,270
6,537
3,867
3,651
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
KQL Query from file: Potential MFASweep (tool) activity has been detected.
KQL Query from file: Storm 1811 SE Attack Detection
This detection identifies when Microsoft Copilot Studio agents are created in your organization's tenant. This activity is significant as the default behavior in Copilot agent creation is to configure a new service principal with cloud app administrator role.
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
KQL Query from file: Direct Send Abuse Detection
This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious .SVG file has been delivered into an Inbox.
KQL Query
KQL Query
Analyze Mail Bomb Attack by ISP
KQL Query from file: GraphRunner Recon Detection & Response
KQL Query
KQL Query
This query visualises emails with Phish detections (High confidence) summarizing the data by Delivery Location.
KQL Query from file: Detect Microsoft Graph API Abuse
KQL Query from file: Monitoring Cross-Tenant Abuse by Threat Actors
This query visualises total emails with Phish detections over time summarizing the data daily by Delivery Location.
KQL Query from file: Detecting External Microsoft Teams Spray
KQL Query
KQL Query from file: Sentinel All-In-One IP ThreatHunt
KQL Query
This query visualises emails with Phish detections (Normal confidence) summarizing the data by Delivery Location.
KQL Query
Page 123 of 150