Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
This detects when a 401 Unauthorized status is received on multiple attempts of the same file when attempting to download from OneDrive and may indicate a permissions issue for the user.
Identify the use of the GraphRunner recon command Invoke-GraphRecon with the permission enum flag set, providing allowed actions and conditional access data for the current user.
Identify the enumeration of members within groups in Entra ID. This is based on GraphRunner Get-SecurityGroups function behavior so modifications may be needed for other scenarios
This detects when the groups endpoint is called in the Graph API. GraphRunner contains a function called Get-DynamicGroups but other tools may as well.
Identify when mailboxes are being accessed with requests for N number of messages
Identify the use of the user API call to collect a listing of users. This can be chatty due to other commands calling this single API.
Detect mail items accessed via API through an unapproved Entra ID application.
Application creation can be legitimate but aren't frequently created. Validating application creation may be appropriate to ensure rogue apps aren't being created.
Adding permissions to an application is expected, however if excessive permissions are changed at one time over a defined threshold, it may be worth validating.
Detects when a group is deleted.
GraphRunner contains a function that forges UA strings. The UA strings below are found in that function. Can be used for other UA strings if desired
Identify the use of the application API call to collect a listing of applications in Entra ID. This can be chatty due to other commands calling this single API.
Identify a 400 bad request to the groups endpoint in the MS Graph API. GraphRunner's Invoke-SecurityGroupCloner function will trigger this if it fails to duplicate a group.
Identify a successful group creation. Triggered through the use of GraphRunner's Invoke-SecurityGroupCloner function.
This detects when the search/query endpoint is called which can be used for enumeration of items like SharePoint site URLs. GraphRunner contains a function called Get-SharePointSiteURLs but other tools may as well.
Identify enumeration of inboxes across the Entra ID tenant. This detection is based on the Invoke-GraphOpenInboxFinder in GraphRunner but the concepts are applicable to other tools that scan for accessible inboxes.
Identify the enumeration of both the users and members of groups in the Entra ID tenant. While these are two separate functions in GraphRunner, they are often run in support of one another.
Detects API calls originating from AWS accounts that are not part of the organization, based on a reference list of approved AWS account IDs. This could indicate unauthorized access or activity from external entities.
Detects when Google Cloud Audit logs are removed from all services at either the project or organization level. This action can indicate an adversary attempting to impair defenses by disabling logging to hide their activities.
This rule detects when highly privileged administrative roles, specifically 'Owner' or 'Editor', are assigned to a service account within Google Cloud Platform. This activity is significant because service accounts with such elevated permissions can be leveraged by attackers for persistence, privilege escalation, and to perform a wide range of actions within the GCP environment, potentially leading to compromise of cloud resources.
This rule detects when multiple HMAC (Hash-based Message Authentication Code) authentication keys are deleted from Google Cloud Storage settings within a one-hour window by the same user. HMAC keys are used for programmatic access to Cloud Storage, and their deletion can indicate an attempt to disrupt legitimate access, cover tracks, or impact service availability.
Page 124 of 135