Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,866 detections
Filters
Last updated
All Time
Detection languages
2,525
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
KQL Query from file: Exposure Management + Defender for Office 365
KQL Query from file: Malware C2 Comms over Azure Blob Metadata
KQL Query from file: T1555.003 - Credentials from Web Browsers
KQL Query from file: KQL to check Azure API spray attacks
KQL Query from file: DISCOVERY: Obsolete device connecting to Entra
KQL Query from file: Threat Intelligence Data from Sentinel UEBA2
KQL Query
KQL Query from file: Tracking The Most Dangerous Entra Admin Role
KQL Query from file: Check for Azure Outdated Security Protocols
Detects changes to the "StrongAuthenticationRequirement" value, where the state is set to "0" or "Disabled". Threat actors were seen disabling multi factor authentication for users in order to maintain or achieve access to the account. Also see in SIM Swap attacks.
KQL Query
KQL Query from file: Sentinel Alerts & MITRE ATT&CK Analysis
KQL Query from file: Entra Risk Events & MITRE ATT&CK Analysis
KQL Query
KQL Query from file: Identity Blast Radius 2
KQL Query from file: DefenderXDR Exposure Management for CVE-2024-3094
KQL Query from file: Detecting Nation State Actors @ Near Realtime
KQL Query
KQL Query from file: M365 Copilot Extensions Threat Monitoring
KQL Query from file: .NET Reflection Defense Evasion (Reflective Code Loading)
KQL Query from file: Exposure Management - Slim's Metric (MaxCVSS-DAW)
Page 160 of 185