Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,868 detections
Filters
Last updated
All Time
Detection languages
2,527
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,092
793
576
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,757
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser
Indicates user activity that is unusual for the user or consistent with known attack patterns.
Identifies when an account hasn't signed in during the past n number of days.
Invalid PIM License
Sigma
Identifies when an organization doesn't have the proper license for PIM and is out of compliance.
Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack.
Identifies when the same privilege role has multiple activations by the same user.
Identifies when a privilege role can be activated without performing mfa.
Identifies when a user has been assigned a privilege role and are not using that role.
Monitor and alert for device registration or join events where MFA was not performed.
Detects risky authentication from a non AD registered device without MFA being required.
Monitor and alert for sign-ins where the device was non-compliant.
Monitor and alert for Sign-ins by unknown devices from non-Trusted locations.
Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments.
If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted.
This can be a misconfigured application or potentially something malicious.
If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted.
This can be a misconfigured application or potentially something malicious.
Detects when an account is disabled or blocked for sign in but tried to log in
Alert on when legacy authentication has been used on an account
User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.
Detects when there is a interruption in the authentication process.
Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.
KQL Query from file: Admin consent for M365 Connector for Claude
This rule detects the presence of newly exposed risky web components, such as administrative panels or development tools, that have been discovered by Microsoft Defender External Attack Surface Management (EASM). The rule identifies components from a predefined list of 'risky_components' that have been seen for the first time within the last 7 days, indicating a recent exposure that could increase the attack surface.
KQL Query from file: M365 Connector for Claude Detection
Page 137 of 185