Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,061 detections
Filters
Last updated
All Time
Detection languages
594
173
103
71
51
Contributors
184
155
139
90
73
Categories
20,443
11,831
5,872
5,155
4,866
1,061
Platforms
576
267
228
221
116
Products / Services
499
220
129
118
86
MITRE Techniques
487
451
362
349
339
CVEs
10
5
4
3
2
IDS Classtypes
34
3
2
2
1
IDS Protocols
29
9
1
Detects M365 Copilot users with failed authentication attempts, MFA failures, or multi-location access patterns indicating potential credential attacks or account compromise. The detection aggregates M365 Copilot Graph API authentication events per user, calculating metrics like distinct cities/countries accessed, unique IP addresses and browsers, failed login attempts (status containing "fail" or "error"), and MFA failures (error code 50074). Users are flagged when they access Copilot from multiple cities (cities_count > 1), experience any authentication failures (failed_attempts > 0), or encounter MFA errors (mfa_failures > 0), which are indicators of credential stuffing, brute force attacks, or compromised accounts attempting to bypass multi-factor authentication.
This rule detects suspicious sign-in attempts to Microsoft services (login.microsoftonline.com, graph.microsoft.com, outlook.office365.com) that occur within 30 minutes of a user clicking on a URL associated with these services. The sign-in is considered suspicious if it originates from a user agent commonly used by automated tools (e.g., axios, curl, python-requests, httpclient, Go-http-client) and is flagged with a 'atRisk' or 'high' risk level by Azure AD. This combination suggests a potential credential compromise following a phishing attempt, where an attacker might be using automated tools to leverage stolen credentials.
Detects a potential 'UnPAC the Hash' Kerberos attack, a technique used by Akira ransomware. The attack involves requesting an Active Directory certificate and then using it for a User-to-User (U2U) Kerberos authentication with PKINIT to extract NTLM hashes.
This rule detects instances where a user clicks on a URL identified as potentially malicious (phishing-related) and subsequently has a risky sign-in event in Azure AD. The rule correlates URL click events from email with Azure AD sign-in logs, specifically looking for sign-ins marked as risky or originating from suspicious user agents (e.g., specific axios versions). The phishing URLs are identified by keywords such as 'azureapplicationregistration.pages.dev', 'chrnobinson.com', 'workers.dev', '.pages.dev', '.web.core.windows.net', '/oauth2/v2.0/authorize', 'client_id=', and 'scope=openid'.
This rule detects VPN connections originating from countries that are not the user's usual work country. It leverages VPN logs, specifically Zscaler VPN logs, to identify active connections and compares the source IP's country with a lookup of the user's expected work country. Alerts are generated when a mismatch is found, indicating a potentially unauthorized or suspicious access attempt.
KQL Query
Indicates that there are anomalous patterns of behavior like suspicious changes to the directory.
This rule identifies risky sign-in attempts in Azure Active Directory where the sign-in originates from an IP address that has not been seen before or has been seen fewer than 3 times in the last 29 days for that specific user. It filters out guest users, non-compliant devices, and unmanaged devices, focusing on sign-ins with an aggregated risk level greater than 1 and a sign-in risk level of 50 or higher. Excluded applications are specified to reduce false positives.
This KQL query analyzes Microsoft Entra ID (formerly Azure AD) sign-in and audit logs to identify potentially risky multi-factor authentication (MFA) registration events. It works by checking for MFA registrations initiated from a new, previously unseen IP address.
The query joins historical sign-in data with recent MFA-related events. It calculates how many unique days an IP address has been used by a specific user over the last 30 days. It then flags any MFA registration event from the last 24 hours where the IP address is a new IP (seen zero days before). The final results are filtered to exclude events from new user accounts (created in the last 60 days) to focus on more established accounts.
The query joins historical sign-in data with recent MFA-related events. It calculates how many unique days an IP address has been used by a specific user over the last 30 days. It then flags any MFA registration event from the last 24 hours where the IP address is a new IP (seen zero days before). The final results are filtered to exclude events from new user accounts (created in the last 60 days) to focus on more established accounts.
Detects potential abuse of Microsoft Actor tokens for cross-tenant impersonation attacks targeting Entra ID tenants. This rule identifies suspicious audit log entries that may indicate exploitation of CVE-2025-55241, a critical vulnerability in Azure AD Graph API that allowed attackers to impersonate any user across Entra ID tenants using malicious Actor tokens.
Detects a user authorizing a Salesforce application via the '/setup/connect' page. This specific TTP is associated with ShinyHunters vishing campaigns where attackers impersonate IT staff and trick employees into entering a connection code, thereby granting a malicious application access to the organization's Salesforce environment.
Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID). This could be a sign of exploitation of elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping. Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing.
This query identifies Azure AD sign-ins that are using legacy TLS versions (below TLS 1.2). It highlights the accounts, devices, and applications involved, providing visibility into insecure protocol usage. Tracking these events helps detect weak encryption risks and enables proactive remediation to enforce modern, secure standards.
Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID)
This could be a sign of exploitation of the elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping.
Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing.
This could be a sign of exploitation of the elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping.
Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing.
This rule identifies unusual activity from locations not previously observed for a user within a defined lookback period. It leverages Microsoft Entra ID (Azure AD) Behavior Analytics and SigninLogs to baseline legitimate user locations and filter out trusted devices/IPs. The rule flags unusual activity where the source IP location is new for the user and exceeds a configurable threshold of 'unusual' behavior indicators, while also excluding specified trusted countries.
Detects multiple denied or failed multi-factor authentication (MFA) prompts for a single user within a short time window. This pattern is commonly associated with MFA fatigue or push bombing attacks, where an attacker attempts to trick the user into approving an MFA request by spamming prompts repeatedly.
This detection uses Azure AD sign-in logs and does not require asset inventory or conditional access policies to be effective.
This detection uses Azure AD sign-in logs and does not require asset inventory or conditional access policies to be effective.
This query is designed to detect a series of anomalous user behaviors that, when combined, may indicate a compromised account. It flags activity that is uncharacteristic for a specific user, such as performing an unusual action, using an unfamiliar application, connecting from an unexpected ISP or country, or logging in from a new device for the first time. The final filter | where InvestigationPriority > 5 focuses the results on high-priority alerts, which are more likely to be legitimate threats. This approach uses behavioral analytics to identify deviations from a user's normal baseline, making it effective for detecting both insider threats and external attacks that have breached credentials.
Detects errors when a target server doesn't have suitable keys for generating kerberos tickets.
This issue can occur for example when a service uses a user account or a computer account that is configured for only DES encryption on a computer that is running Windows 7 which has DES encryption for Kerberos authentication disabled.
This issue can occur for example when a service uses a user account or a computer account that is configured for only DES encryption on a computer that is running Windows 7 which has DES encryption for Kerberos authentication disabled.
Detects a user initiating an OAuth flow with the Microsoft Authentication Broker (MAB) client to the Device Registration Service (DRS) from multiple IP addresses within a short time window. This pattern is indicative of an adversary using a phished authorization code to begin the process of registering a malicious device in the target tenant, a key step for establishing persistence. The rule specifically looks for sessions that involve at least one browser-based request, which is common in the initial phishing stage.
Identifies Entra ID sign-in events where a user authenticates using a refresh token issued to the Microsoft Authentication Broker (MAB) client, targeting the Device Registration Service (DRS) with the "adrs_access" OAuth scope. This pattern is a strong indicator of an adversary using a stolen refresh token to initiate a malicious device registration flow, often with tools like ROADtx, as a step towards establishing persistence.
Detects attempts to read the Key Distribution Service (KDS) Root Key from Active Directory. This is often a preliminary step in the Golden dMSA attack, where an attacker with high privileges attempts to retrieve the key material needed to forge tickets for Delegated Managed Service Accounts (dMSA) to establish domain persistence. The rule looks for access to the 'msKds-ProvRootKey' object, identified either by its name or its schema ID GUID 'aa02fd41-17e0-4f18-8687-b2239649736b'.
Page 38 of 51