Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,864 detections
Filters
Last updated
All Time
Detection languages
2,523
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,448
1,199
1,091
792
575
Platforms
39,921
7,246
6,535
3,864
3,627
Products / Services
1,755
1,449
1,120
438
406
MITRE Techniques
1,888
1,391
913
814
726
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Behavioral hunt for accounts whose non-interactive sign-ins over 30 days are dominated (>=95%) by a single IP using a scripted client (python/aiohttp/httpx/urllib) with no browser. Scripted now requires BOTH no browser AND a scripted user agent, and Microsoft ASN egress is excluded.
Detects network, file, process, and email interactions associated with known IOCs related to Power BI phishing and rogue ScreenConnect campaigns over a 30-day lookback period.
Detects the removal of user accounts from a specific sensitive Microsoft Entra ID group, which may indicate unauthorized group membership changes or potential privilege escalation activities.
Detects a user account that performs a device code sign-in flow followed by the registration of five or more devices with deceptive names (matching patterns like microsoft- or windows-) within a one day timeframe. This behavior can indicate an adversary establishing persistence or attempting tenant resource exhaustion using compromised accounts.
Detects a single application or service principal performing a password reset, a license assignment, and a privileged role grant within a one-hour window. This sequence matches Storm-3119 admin-panel abuse of a compromised tenant client secret through an app-only flow in Microsoft 365 or Entra ID.
Detects successful non-interactive sign-ins by Entra ID service principals from an IP address and location never seen in the prior 14 days, helping to identify potentially compromised application credentials used from unfamiliar locations.
Detects potential cloud storage object discovery activity in Azure Blob Storage by identifying anomalous listing or enumeration operations from callers, including high request counts, extensive container access, high failure rates, or anonymous authentication.
Correlates a high-risk or compromised Microsoft Entra sign-in event with a subsequent device registration (Add device or Register device) performed by the same user account within a 3-hour window.
Users who received a delivered phishing email and then signed in from an IP not seen for them in the prior 30 days within 24 hours. Hunting query, not an alert.
Detects service principal sign-ins involving known compromised application IDs associated with the ConnectWise cloud backup and management supply-chain attack.
Detects an Entra 'Add device' event within 2 minutes after a successful sign-in from an IP never seen for that user in the lookback window, and where the registration originates from that same new IP (rogue device persistence after token replay).
Detects multiple failed sign-in attempts against specific high-privilege break-glass accounts in Microsoft Entra ID within a 1-hour window.
Detects a service principal adding itself or another principal to a directory role in Azure Active Directory, specifically highlighting known ConnectWise supply-chain related activity.
IOC sweep for ARTEX campaign indicators: C2 host, nine proxy IPs, xcai.pro and its subdomains, and the CLAUDE.md URL across Defender, CEF/firewall, DNS and Entra sign-in telemetry. Domains match on exact host or subdomain only, connection types are limited to real connection events, and sign-ins are limited to successes and credential failures.
Detects successful Azure Active Directory (Entra ID) sign-ins using the device code flow where the originating device is neither registered nor trusted (managed or compliant), which may indicate suspicious authentication attempts or token abuse.
Detects a successful device-code sign-in followed within 60 minutes by non-interactive replay from a different IP AND a persistence action (inbox rule, app consent, device add) from a non-original IP. Persistence is now mandatory (inner join) instead of optional, and the retired AADSignInEventsBeta table is replaced by EntraIdSignInEvents.
Detects and monitors sign-in events for specific high-privilege or sensitive accounts, such as break-glass accounts, within Microsoft Entra ID.
Define a baseline threshold for failed sign-ins due to Conditional Access failures
Detects instances where an OAuth token is used from a new IP address and a new country within 24 hours of a successful device-code sign-in for the same user, potentially indicating token theft or abuse.
Detects network, file, process, and email interactions associated with known IOCs related to Power BI phishing and rogue ScreenConnect campaigns over a 30-day lookback period.
Summarizes the count of devices by CPU manufacturer and architecture using Kusto Query Language (KQL).
Page 3 of 184