Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
This rule detects API requests to the Microsoft Graph search/query endpoint. This endpoint can be used by adversaries to enumerate items such as SharePoint site URLs, which is a common technique used by tools like GraphRunner's Get-SharePointSiteURLs function. The detection specifically looks for successful POST requests to 'https://graph.microsoft.com/v1.0/search/query'.
This rule detects the successful creation of a new group within Microsoft Graph API. It specifically looks for HTTP POST requests to the `/v1.0/groups` endpoint that result in a 201 (Created) HTTP response code. The rule's description indicates it can be triggered by the `Invoke-SecurityGroupCloner` function from the GraphRunner tool, which is used for cloning security groups.
This rule identifies API requests made to the Microsoft Graph API to access user mailboxes and retrieve a specified number of messages. It specifically looks for GET requests to the `/v1.0/users/*/mailFolders/*/messages?$top=` endpoint with a successful HTTP 200 response. This activity could indicate an attacker attempting to exfiltrate emails from a compromised mailbox.
This rule identifies when the HTTP DELETE method is used within the Microsoft Graph API. This can indicate administrative activities such as deleting users, groups, or other resources. The rule specifically looks for network HTTP events where the product event type is 'Microsoft Graph Activity' and the HTTP method is 'DELETE'. It excludes IP addresses within a specific Azure CIDR range (20.151.0.0/16) to reduce noise from internal Azure operations. Further tuning can be applied to target specific API endpoints or user agents.
This rule detects requests to the Microsoft Graph API endpoint for listing applications (https://graph.microsoft.com/v1.0/applications). This activity can be indicative of reconnaissance by an attacker attempting to enumerate applications within an Entra ID (Azure AD) environment. The rule specifically looks for successful GET requests (HTTP 200 response code) to this endpoint.
This rule detects calls to the undocumented 'Estimate Access' API in Microsoft Graph. This API is used by tools like GraphRunner for reconnaissance purposes, specifically to determine what actions a user can perform. While not inherently malicious, its use can indicate an adversary attempting to enumerate permissions or discover accessible resources within an Azure environment. The rule filters for successful POST requests to the specific beta endpoint and excludes certain Microsoft IP ranges to reduce false positives.
This rule detects the enumeration of both users and group members within an Entra ID (formerly Azure Active Directory) tenant via the Microsoft Graph API. It specifically looks for two distinct HTTP GET requests originating from the same IP address and within a 15-minute window: one targeting the `/v1.0/users` endpoint and another targeting the `/v1.0/groups/*/members` endpoint. This activity is often associated with reconnaissance efforts, such as those performed by tools like GraphRunner, to map out an organization's user and group structure.
This rule detects HTTP 400 Bad Request errors when attempting to interact with the Microsoft Graph API's /v1.0/groups endpoint via a POST request. This specific activity can indicate a failed attempt to duplicate a group, potentially by tools like GraphRunner's Invoke-SecurityGroupCloner function. It focuses on identifying issues during group creation or modification operations within Azure AD through the Graph API.
This rule detects attempts to enumerate updatable groups within Microsoft Entra ID (formerly Azure Active Directory) using the Microsoft Graph API. Specifically, it looks for a combination of a GET request to the `/v1.0/groups` endpoint and a POST request to the `/beta/roleManagement/directory/estimateAccess` endpoint within a 5-minute window from the same IP address and session. This activity is indicative of tools like GraphRunner's `Get-UpdatableGroups` function, which adversaries might use to identify groups they can modify for privilege escalation or persistence.
This rule detects requests to the Microsoft Graph API's '/v1.0/users' endpoint with a GET method and a successful 200 response code. This API call is used to enumerate users within an Azure Active Directory environment. The rule is designed to identify potential reconnaissance activities where an attacker might be collecting a listing of users. It notes that this can be a 'chatty' API call, meaning it might generate a high volume of legitimate traffic.
Detects when the Single Sign-On (SSO) recovery codes are accessed for a GitHub enterprise or organization. An adversary may attempt to access or steal SSO recovery codes in order to maintain access to their target's GitHub environment.
Detects when a GitHub repository is transferred.
Detects when the visibility for a GitHub repository is changed to public.
Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authentication token being used.
This may indicate an attacker attempting to leverage credentials they have obtained.
This may indicate an attacker attempting to leverage credentials they have obtained.
Estimate Access is an undocumented API in MS Graph and is used in the following GraphRunner functions Get-UpdatableGroups, Get-DynamicGroups and Invoke-GraphRecon. Although not inherently malicious, it does submit an action and then determines if the user can perform it
This detects actions intended to identify updatable groups in Entra ID. GraphRunner contains a function called Get-UpdatableGroups but other tools may as well.
Detects authentication to O365 followed by a non-interactive sign-ins that aligns to suspicious activity.
Detect when a GCP Firewall rule is opened to the world (0.0.0.0/0) on all protocols.
The authorization policy of Entra ID (User Settings) contains information about who can create applications, invite guest users and more. It's not something that is generally modified or reviewed except by administrators so it's worth knowing who may be requesting this endpoint.
Identify when the http delete method is being called within the Microsoft Graph API.
Identify the use GraphRunner's Invoke-DumpApps function to collect applications and external apps as well as users that consented to permissions in their apps.
Page 123 of 135