Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects when a configuration change is made to an applications AppID URI.
Detects when a configuration change is made to an applications URI.
URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.
URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.
Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.
Detects when a user that doesn't have permissions to invite a guest user attempts to invite one.
Detects the change of user type from "Guest" to "Member" for potential elevation of privilege.
Detects when PIM alerts are set to disabled.
Detects when changes are made to PIM roles
Detects when a user is added to a privileged role.
Detects when a new admin is created.
Detect when a user has reset their password in Azure AD
Identifies when a privilege role can be activated without performing mfa.
Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.
Detects disabling of Multi Factor Authentication.
Detects the addition of a new Federated Domain.
Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address.
KQL Query from file: Admin consent for M365 Connector for Claude
KQL Query
Detects early-stage collection and reconnaissance activities targeting sensitive email data prior to exfiltration via Exchange cmdlets. This rule identifies the use of 'New-MailboxSearch' and 'Get-Recipient' cmdlets, which can be leveraged by adversaries to discover and collect email-related information. Detection covers both endpoint PowerShell execution and cloud audit logs for Microsoft Exchange Online.
KQL Query from file: M365 Connector for Claude Detection
This rule detects the exposure of Kuwaiti Civil ID numbers in various log sources, including process command lines, additional device event fields, and email subjects/sender addresses. A Kuwaiti Civil ID is identified by a 12-digit number starting with 1, 2, or 3.
This rule detects the exposure of Kuwaiti Civil ID numbers in various log sources, including process command lines, additional device event fields, and email subjects/sender addresses. A Kuwaiti Civil ID is identified by a 12-digit number starting with 1, 2, or 3.
Page 135 of 179