Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,868 detections
Filters
Last updated
All Time
Detection languages
2,527
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,092
793
576
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,757
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects changes to Microsoft.ManagedServices resources (registration definitions and assignments) where the affected resource group matches your known Sentinel resource group. In other words: someone touched your delegation.
This covers both expected changes (your own team onboarding or offboarding a customer) and unexpected ones (a customer admin making unauthorised modifications). The rule fires on both write and delete operations with a successful status.
This covers both expected changes (your own team onboarding or offboarding a customer) and unexpected ones (a customer admin making unauthorised modifications). The rule fires on both write and delete operations with a successful status.
Detects when an administrator grants consent to an application on behalf of all users in an Azure AD tenant. This can be a legitimate administrative action but can also be abused by attackers to gain broad access to resources and data within the organization.
This rule identifies "impossible travel" scenarios where a user logs in from two geographically distant locations within a short period (less than 2 hours). This can indicate a compromised account being used by an attacker, potentially leveraging VPNs or other proxy services to obscure their true location.
This detection highlights potential privilege escalation through misuse of the Agent ID Administrator role. In the past, this role has been exploited to bypass restrictions by granting the actor ownership of sensitive Service Principals, enabling them to add unauthorized credentials.
This hunting query detect detects network traffic and browser events communicating with TDS nodes and landing pages associated with an IRSF SMS scam campaign leveraging fake CAPTCHAs.
This rule detects successful sign-ins to specific Microsoft 365 applications (identified by ApplicationId '08ad6f98-a4f8-4635-bb8d-f1a3044760f0' or '07c030f6-5743-41b7-ba00-0a6e85f37c17') from devices that have previously established a network connection with a process named 'cowork-svc'. The rule correlates network connection events with Azure AD sign-in events over a 30-day lookback period to identify potentially legitimate or suspicious activity related to 'cowork-svc' application usage.
Detects when the same SessionId is used to sign in from more than one location across interactive and non-interactive sign-ins.
This rule detects when an 'Agent ID Administrator' role adds an owner to a service principal in Azure Active Directory. This activity could indicate an attempt to escalate privileges or maintain persistence within the Azure environment by granting control over service principals to potentially unauthorized entities.
This rule detects anomalous mass device wipe or deletion activity in Microsoft Intune by comparing current activity against an actor's historical behavior. It identifies four patterns: first-time wipers with high volume, known actors statistically far above their norm (Z-score), thin-history actors exceeding their personal peak, and time-compressed bursts of wipes. The rule calculates a severity based on the volume and rate of wipes.
This rule detects when a device wipe or delete operation is performed via Microsoft Intune. It specifically looks for 'wipe ManagedDevice' or 'Delete ManagedDevice' operations in Intune audit logs within the last 24 hours. The rule is designed to be correlated with other alerts by filtering on a specific ActorUPN, indicating a potential malicious mass device wipe attack.
This rule detects the assignment of highly privileged roles such as 'Global Administrator', 'Intune Administrator', or 'Cloud Device Administrator' within Azure Active Directory. This activity is often a precursor to significant malicious actions, including mass device wipes, as highlighted by the referenced threat intelligence. Monitoring these assignments helps identify potential privilege escalation or unauthorized administrative access.
This rule detects attempts to perform a mass device wipe or deletion using Microsoft Intune. It identifies devices that have been wiped or deleted within the last 24 hours and enriches this information with device details such as name, user, OS, and ownership. This can indicate a destructive attack or an attempt to remove evidence.
Detects unauthorized processes attempting to access or interact with the dynamically generated Azure Arc identity token .key files. These files reside in a protected directory and are limited to SYSTEM-level ARC agent processes
(CVE-2026-26117)
(CVE-2026-26117)
This rule detects suspicious sign-in activity for a specific user principal name (UPN) within the last 7 days, immediately preceding a device wipe event. It focuses on identifying the actor's initial access or activity before initiating a mass device wipe.
Detects signed executable files with untrusted certificates (expired, revoked,
or broken chain) that were downloaded from the internet and executed within one
hour of being written to a high-risk path such as user temp, AppData, Downloads,
or Public directories.
An untrusted certificate on a downloaded executable can indicate use of a
revoked or stolen code-signing certificate, a technique observed in multiple
Iranian APT campaigns including Seedworm/MuddyWater (ref: CyberProof, April 2026)
and consistent with CISA advisory AA26-097A.
Note: IsTrusted reflects certificate status at time of MDE cloud scan, not
real-time revocation status. Files executed before MDE scan completion or before
CA revocation may not be detected.
or broken chain) that were downloaded from the internet and executed within one
hour of being written to a high-risk path such as user temp, AppData, Downloads,
or Public directories.
An untrusted certificate on a downloaded executable can indicate use of a
revoked or stolen code-signing certificate, a technique observed in multiple
Iranian APT campaigns including Seedworm/MuddyWater (ref: CyberProof, April 2026)
and consistent with CISA advisory AA26-097A.
Note: IsTrusted reflects certificate status at time of MDE cloud scan, not
real-time revocation status. Files executed before MDE scan completion or before
CA revocation may not be detected.
This rule identifies potential network scanning or high-volume communication by detecting a large number of connections (50 or more) between a single source IP and a single destination IP within a 5-minute time window. It aggregates connection details such as total connections, sent bytes, and received bytes from the CommonSecurityLog.
Detects LOLBins (cmd.exe, powershell.exe, rundll32.exe, mshta.exe, etc.) spawned
directly by a web browser, indicative of FileFix or ClickFix-style social engineering
execution.
In these attacks, a malicious webpage silently copies a disguised command
to the user's clipboard; the user is then instructed to paste it into the Windows File
Explorer address bar or Run dialog, resulting in LOLBin execution under the browser's
process context.
Observed delivering loaders, RATs, and ransomware precursors in the
wild since July 2025.
Exclusions applied for Chrome Native Messaging IPC, ClickOnce
application launchers, and OAuth2/OIDC SSO token redirect fragments.
directly by a web browser, indicative of FileFix or ClickFix-style social engineering
execution.
In these attacks, a malicious webpage silently copies a disguised command
to the user's clipboard; the user is then instructed to paste it into the Windows File
Explorer address bar or Run dialog, resulting in LOLBin execution under the browser's
process context.
Observed delivering loaders, RATs, and ransomware precursors in the
wild since July 2025.
Exclusions applied for Chrome Native Messaging IPC, ClickOnce
application launchers, and OAuth2/OIDC SSO token redirect fragments.
Detects inbound network connections and Azure AD sign-in attempts originating from the 21-IP RDP scanning fleet attributed to AS213438 (ColocaTel Inc., Seychelles), as reported by GreyNoise on April 10, 2026. The fleet generated 67.4% of global RDP Crawler activity on April 7, 2026 across four /24 blocks geolocated to the Netherlands. The same ASN demonstrated a burst-and-crash pattern in both March and April 2026, suggesting further rotations are likely.
Identifies when a firewall is created, modified, or deleted.
Detect when users are authenticating without MFA being required.
Detects successful sign-ins using the axios/1.7.9 user agent. Storm-2755 uses this to replay stolen session tokens and maintain persistence via automated sign-ins approximately every 30 minutes. The rule filters for successful authentications and requires at least two authentications from the same user, IP, and user agent within the time window to identify the repeated automated persistence loop.
Page 134 of 185