Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,866 detections
Filters
Last updated
All Time
Detection languages
2,525
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
KQL Query from file: Detecting Copilot Studio Bot Creation
KQL Query from file: CVE-2024-3094 with CVSS Score 10
KQL Query from file: Honeypot Threat Intelligence (TI) Data
KQL Query
KQL Query from file: Unmanaged PowerShell Detection
This rule detects when the user risk and multi-factor authentication (MFA) registration policy is updated within Azure Active Directory (AAD). Attackers may modify these policies to bypass MFA, weaken security thresholds, facilitate further attacks, or maintain persistence by altering how users authenticate or register for MFA.
KQL Query from file: Identity Blast Radius
KQL Query
KQL Query from file: Blob URI Unique Domain Count
KQL Query
KQL Query from file: Monthly Report Entra Eligible Role Activation
KQL Query from file: HTTP Client Tools Exploitation for ATO Detection
KQL Query
This detection targets suspicious ROPC (Resource Owner Password Credentials) authentication attempts involving brute-forcing of application client IDs, specifically related to the `Invoke-BruteClientIDs` function in MFA Sweep. This function can be used for enumerating gaps in MFA and/or CA policies, in addition to password validation via credential stuffing.
This detection leverages Azure Graph activity logs to identify when Graph APIs have been used to identify 10 or more service principals. This type of behavior is associated with tools such as Azure enumeration tools like AzureHound or ROADtools.
This detection identifies the presence of the default AzureHound user-agent string within Microsoft Graph Activity logs and NonInteractive SignIn Logs. AzureHound is a tool used for gathering information about Azure Active Directory environments, often employed by security professionals for legitimate auditing purposes. However, it can also be leveraged by malicious actors to perform reconnaissance activities, mapping out the Azure AD infrastructure to identify potential vulnerabilities and targets for further exploitation. Detecting its usage can help in identifying unauthorized access attempts and preemptively mitigating potential security threats to your Azure environment.
This detection identifies when an Azure Service Principal elevates privileges by adding itself to a new app role assignment. This activity is indicative of privilege escalation within an Azure Active Directory environment, where a service principal grants itself additional permissions.
This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the locations they are stored
Detects the addition or update of key or password credentials specifically on the Microsoft Entra Connect Sync application registration (Service Principal) within Azure AD Audit Logs. This activity is highly suspicious as the normal update process for Entra Connect Sync typically replaces existing keys, and attackers may add credentials for persistence while leaving existing ones for legitimate operations.
'Discover all critical ports from a list having rules like 'Any' for sourceIp, which means that they are opened to everyone. Critial ports should not be opened to everyone, and should be filtered.'
'This hunting query will alert on any Impossible travel activity in correlation with mailbox permission tampering followed by account being added to a PIM managed privileged group.
Ensure this impossible travel incident with increase of privileges is legitimate in your environment.'
Ensure this impossible travel incident with increase of privileges is legitimate in your environment.'
Page 161 of 185