Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,666 detections
Filters
Last updated
All Time
Detection languages
1,077
189
170
102
53
Contributors
520
361
306
67
52
Categories
20,443
11,831
5,872
5,155
4,866
1,666
Platforms
1,091
591
441
252
122
Products / Services
1,130
476
189
125
117
MITRE Techniques
945
843
438
416
413
CVEs
12
12
9
6
5
IDS Classtypes
1
1
Detects successful sign-ins to Microsoft Office applications using the device code flow (FOCI AppId d3590ed6-52b3-4102-aeff-aad2292ab01c) that originate from an untrusted network location. This activity can indicate a device code phishing attack where an adversary has tricked a user into authenticating a malicious application.
This rule detects when a single account initiates 5 or more successful Remote Desktop Protocol (RDP) connections within a one-hour window. This behavior can be indicative of an adversary attempting to gain widespread access within a network, potentially through credential stuffing, brute-force attacks, or lateral movement using compromised credentials.
This rule detects potential Pass-the-Hash (PtH) attacks by looking for multiple successful network logons (LogonType 3) using NTLM authentication for the same user from the same IP address. A count of 5 or more such events is considered suspicious.
This rule detects suspicious application consent activity in Azure AD. It identifies instances where a user successfully grants consent to three or more applications within a one-hour window. This behavior can indicate an adversary attempting to gain access to resources by tricking users into consenting to malicious applications.
This rule detects a high volume of successful sign-in attempts to Exchange Online from a single IP address where the UserPrincipalName ends with '@' (indicating an anonymous or malformed UPN) and Conditional Access was not applied. This pattern can be indicative of anonymous SMTP relay abuse, often used for spamming or phishing campaigns.
This rule detects when a single user principal name (UPN) attempts five or more sign-ins from the same IP address within a one-hour window, and each sign-in is flagged with a 'RiskDetail' other than 'none' but still results in a 'Success' status. This could indicate an attacker attempting to bypass security controls or an account compromise where the attacker is repeatedly trying to access the account from a consistent location, possibly with different credentials or methods, until successful.
This rule detects multiple successful RDP logons (LogonType 10) within a one-hour window by accounts containing '$' (often machine accounts) or 'admin' (privileged accounts). This behavior can be indicative of an adversary attempting to gain remote access and potentially deploy ransomware or other malicious payloads, especially if multiple source IPs are observed.
Detects successful device code authentications specifically for the Microsoft Office application (AppId d3590ed6-52b3-4102-aeff-aad2292ab01c) that do not originate from trusted named locations. This can indicate a device code phishing attempt where an attacker has tricked a user into authenticating to a malicious application.
Identifies a risky sign-in to a known O365 landing page followed shortly by the creation of an inbox rule that deletes messages or moves them to junk/trash. This pattern frequently indicates account compromise (e.g., BEC or AiTM) attempting to hide malicious activity.
This rule detects an unusually high volume of logon events (both successful and failed) or a large number of unique users attempting to log on within a 5-minute window. This behavior is indicative of potential brute-force attacks or credential stuffing attempts against Windows systems.
This rule detects unusual logon activity for service accounts. It identifies service accounts by looking for a dollar sign ($) at the end of the username. The rule then counts logons, unique IP addresses, and unique computers for these service accounts within one-hour bins. An alert is triggered if a service account has 10 or more logons or logs in from 5 or more unique IP addresses within that hour, indicating potential abuse or compromise.
This rule detects suspicious Azure AD sign-in activity where a user successfully signs in from multiple unusual cities within a 24-hour period. It specifically looks for sign-ins that are not from a trusted network and are not from a compliant device, aggregating successful sign-ins by UserPrincipalName and IpAddress, and flagging if there are 5 or more distinct cities.
This rule detects potential 'impossible travel' scenarios within Azure AD sign-in logs. It identifies users who successfully sign in to Office 365 from two geographically distant IP addresses within a one-hour window, suggesting a potential compromise or an attempt to bypass security controls.
This rule detects suspicious application consent activity in Azure AD. It identifies instances where a user successfully grants consent to three or more applications within a one-hour window. This behavior can indicate an adversary attempting to gain access to resources by tricking users into consenting to malicious applications.
This rule detects multiple successful RDP logons (LogonType 10) within a one-hour window by accounts containing '$' (often machine accounts) or 'admin' (privileged accounts). This behavior can be indicative of an adversary attempting to gain remote access and potentially deploy ransomware or other malicious payloads, especially if multiple source IPs are observed.
Detects a successful login from a non-compliant, unmanaged device followed by an inbox rule creation or modification within 10 minutes. This sequence aligns with post-compromise evasion tactics observed in device code phishing campaigns like Kali365, where attackers quickly suppress security alerts after gaining access.
Detects successful Microsoft Entra ID sign-ins where the user agent indicates a Node.js-based HTTP client (e.g., node, axios, undici, node-fetch). Tycoon 2FA and other AiTM phishing kits heavily leverage these backend automated tools for token relay and renewal immediately following MFA interception.
This rule detects the issuance of OAuth tokens or OAuth consent events within cloud applications. It specifically looks for these events where the client application is not 'Microsoft Teams' or 'Azure CLI'. The rule summarizes the number of grants and distinct users for each client application and token ID over hourly intervals. This can help identify potentially unauthorized or suspicious OAuth application consents.
This rule detects suspicious Azure AD sign-in activity where a user successfully signs in from multiple unusual cities within a 24-hour period. It specifically looks for sign-ins that are not from a trusted network and are not from a compliant device, aggregating successful sign-ins by UserPrincipalName and IpAddress, and flagging if there are 5 or more distinct cities.
This rule detects a pattern indicative of password spraying or brute force attacks against user accounts. It identifies instances where a single user principal name (UPN) and IP address combination has at least 5 failed sign-in attempts and at least 1 successful sign-in attempt within a 30-minute window. This combination of failed and successful logins from the same source for the same user suggests an attacker successfully guessed a password after multiple attempts, or a password spraying attack where one of the sprayed passwords was correct.
Detects successful interactive device-code flow sign-ins through the Microsoft Authentication Broker application (Client ID 29d9ed98-a469-4536-ade2-f981bc1d605e). Tycoon 2FA operators frequently abuse this specific flow to bypass multi-factor authentication and steal session tokens.
Page 65 of 80