Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects instances where an IAM user or role attempts to assume a role in a different AWS account (Cross-Account) without providing a valid ExternalID. This often indicates unauthorized attempts to access or abuse cross-account trust relationships, which is a common technique for lateral movement or privilege escalation in cloud environments.
Detects instances where an IAM user or role attempts to assume a role in a different AWS account (Cross-Account) without providing a valid ExternalID. This often indicates unauthorized attempts to access or abuse cross-account trust relationships, which is a common technique for lateral movement or privilege escalation in cloud environments.
Detects mailbox permission changes (FullAccess, SendAs) or abnormally high volume of mailbox item access events occurring shortly after a risky, non-interactive, or unusual location sign-in. This pattern indicates a potential follow-on activity from a successful session hijacking or token theft attack.
Detects mailbox permission changes (FullAccess, SendAs) or abnormally high volume of mailbox item access events occurring shortly after a risky, non-interactive, or unusual location sign-in. This pattern indicates a potential follow-on activity from a successful session hijacking or token theft attack.
Detects a user account adding a new client secret or certificate to an Azure AD application/service principal, followed by a sign-in event from that same service principal originating from an IP address not observed in the prior 14 days. This behavior is indicative of potential persistent access creation by an adversary using newly generated credentials.
This rule correlates a risky or compromised sign-in event in Entra ID (Azure AD) with a subsequent OAuth consent grant by the same user within 60 minutes. It specifically looks for grants that request sensitive permissions such as Mail.Read, Mail.ReadWrite, Files.ReadWrite.All, or offline_access, which are commonly associated with consent phishing and persistence tactics.
Detects non-interactive sign-in events (including refresh-token or PRT-based authentication) where the originating device is not managed by Intune/Jamf, not marked as compliant, and lacks a registered trust type. This behavior is indicative of potential stolen session token replay or unauthorized access using intercepted artifacts.
Detects instances where a risky Azure AD sign-in (e.g., token replay or confirmed compromise) is closely followed (within 24 hours) by sensitive application or service principal credential modifications by the same user account. This behavior is indicative of potential persistence establishment via account manipulation.
Detects Microsoft Entra ID (formerly Azure AD) PIM or Just-In-Time role activations that occur without a proper approval workflow, are self-approved, or coincide with identified risky sign-in signals.
Detects non-interactive sign-in events (including refresh-token or PRT-based authentication) where the originating device is not managed by Intune/Jamf, not marked as compliant, and lacks a registered trust type. This behavior is indicative of potential stolen session token replay or unauthorized access using intercepted artifacts.
Detects anomalous authentication behavior where a single session identifier is used to access three or more distinct SaaS applications within a one-hour window. This behavior often indicates the unauthorized use of a stolen session cookie or OAuth token (Pass-the-Cookie) across multiple SSO-integrated platforms.
Detects instances where a risky Azure AD sign-in (e.g., token replay or confirmed compromise) is closely followed (within 24 hours) by sensitive application or service principal credential modifications by the same user account. This behavior is indicative of potential persistence establishment via account manipulation.
Detects Microsoft Entra ID (formerly Azure AD) PIM or Just-In-Time role activations that occur without a proper approval workflow, are self-approved, or coincide with identified risky sign-in signals.
This rule detects potentially compromised accounts by correlating suspicious authentication activity (such as risky sign-ins, impossible travel, or malicious OAuth/Mail-rule configurations) with a subsequent spike in SharePoint or OneDrive file access, downloads, or external link sharing within a one-hour window. This behavior is indicative of an adversary performing cloud-based data exfiltration after gaining unauthorized access to an account.
Detects mailbox configuration changes in Exchange Online where email forwarding (ForwardingSmtpAddress, ForwardingAddress, or DeliverToMailboxAndForward) is enabled to an external, non-tenant domain. This technique is commonly used for persistence and data exfiltration following account compromise, allowing attackers to redirect incoming communications to an external mailbox even after the original account credentials have been reset.
Detects the addition of new credentials (certificates, secrets, or keys) to Azure AD Service Principals or Applications, occurring outside of standard business hours (6 AM to 8 PM). This pattern is often indicative of an adversary establishing or maintaining persistent access to an enterprise cloud environment.
Detects the addition of new credentials (certificates, secrets, or keys) to Azure AD Service Principals or Applications, occurring outside of standard business hours (6 AM to 8 PM). This pattern is often indicative of an adversary establishing or maintaining persistent access to an enterprise cloud environment.
This rule detects when a user is assigned a highly privileged role in Azure AD (e.g., Global Administrator, Security Administrator) shortly after that user has performed a sign-in event flagged as risky. This behavior is a strong indicator of account takeover or malicious privilege escalation within the cloud environment.
Detects anomalous OAuth 2.0 device authorization grant sign-in activity within Microsoft 365. The rule identifies suspicious token redemption behavior where the initial device code request and the subsequent token redemption occur from disparate IP addresses or utilize different user-agent strings, which is indicative of EvilTokens or similar adversary-in-the-middle (AiTM) device-code phishing frameworks.
Detects high-privilege OAuth application consent grants (such as Mail.Read or Files.ReadWrite.All) occurring within four hours of a risky or anomalous user sign-in. This sequence indicates a potential compromise where an attacker uses a compromised account to authorize a malicious OAuth application for persistent access and data exfiltration.
Detects the assignment of a highly privileged administrative or directory role to a user or service principal following a high-risk or anomalous sign-in event. This pattern is indicative of potential session hijacking where an adversary attempts to escalate privileges within a cloud environment after gaining initial access to a compromised account.
Page 25 of 135