Detection rules › By event

Entra-AuditLogs _catch_all

29 detection rules reference this event. View event page.

Elastic (2)

Entra ID Kali365 Default User-Agent Detected severity high T1078, T1078.004, T1528, T1550, T1550.001, T1566
Entra ID Sign-in BloodHound Suite User-Agent Detected severity medium T1069, T1069.003, T1082, T1087, T1087.004, T1201

Kusto (27)

Application ID URI Changed severity medium T1078, T1078.004
Bulk Changes to Privileged Account Permissions severity high T1078, T1078.004
Changes to Application Logout URL severity low T1078, T1078.004
Conditional Access Policy Modified by New User severity medium T1078, T1078.004
Cross-tenant Access Settings Organization Added severity medium T1078, T1078.004, T1087, T1087.004, T1136, T1136.003
Cross-tenant Access Settings Organization Deleted severity medium T1078, T1078.004, T1087, T1087.004, T1136, T1136.003
Cross-tenant Access Settings Organization Inbound Collaboration Settings Changed severity medium T1078, T1078.004, T1087, T1087.004, T1136, T1136.003
Cross-tenant Access Settings Organization Inbound Direct Settings Changed severity medium T1078, T1078.004, T1087, T1087.004, T1136, T1136.003
Cross-tenant Access Settings Organization Outbound Collaboration Settings Changed severity medium T1078, T1078.004, T1087, T1087.004, T1136, T1136.003
Cross-tenant Access Settings Organization Outbound Direct Settings Changed severity medium T1078, T1078.004, T1087, T1087.004, T1136, T1136.003
Detect changes to Connect Sync Application T1078, T1078.004, T1098, T1556, T1556.007
Detect credential add to Connect Sync Application T1078, T1078.004, T1098, T1098.001, T1556, T1556.007
Detect PIM Alert Disabling activity severity medium T1078, T1098
End-user consent stopped due to risk-based consent severity medium T1078, T1078.004
First access credential added to Application or Service Principal where no credential was present severity high T1550, T1550.001
Mail.Read Permissions Granted to Application severity medium T1098
Multiple admin membership removals from newly created admin. severity medium T1531
New access credential added to Application or Service Principal severity medium T1550, T1550.001
NRT First access credential added to Application or Service Principal where no credential was present severity medium T1550, T1550.001
NRT New access credential added to Application or Service Principal severity medium T1550
Power Platform - Account added to privileged Microsoft Entra roles severity low T1068, T1078, T1548
Privileged Account Permissions Changed severity medium T1078, T1078.004
Rare application consent severity medium T1068, T1136
Service Principal Assigned Privileged Role severity medium T1078, T1078.004
Threat Essentials - Multiple admin membership removals from newly created admin. severity medium T1531
Threat Essentials - User Assigned Privileged Role severity high T1078, T1078.004
User Assigned New Privileged Role severity high T1078, T1078.004

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Entra-AuditLogs _catch_all

Elastic (2)

Kusto (27)

Keyboard shortcuts

Search operators