Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
The following analytic identifies when an O365 email recipient receives and then deletes emails related to password or banking/payroll changes within a short period.
This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.
This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.
This rule monitors cloud application events for high-frequency, automated API calls directed at AI/ML inference endpoints. A high volume of queries (over 1000) accessing a diverse range of objects (over 50) within a short window (60 minutes) by a single identity or IP address is flagged. Such behavior is characteristic of model extraction or distillation attacks, where an adversary probes an AI model to replicate its capabilities or internal parameters.
Detects the deletion of GitHub workflow logs that occur in close temporal proximity to sensitive operations such as secret access or package publication. The rule also flags deletions associated with workflow names containing AI-themed keywords, which may indicate an attempt to conceal malicious automation or activity.
Detects anomalous, high-volume activity by a single identity involving the provisioning of compute-intensive GPU-based EC2 instances or the bulk invocation of LLM models via AWS Bedrock and SageMaker services within a short timeframe. This behavior may indicate account compromise, resource hijacking for unauthorized AI workloads, or crypto-mining.
This rule detects administrative or user activity within Azure via AzureActivity logs and web request patterns in AppServiceHTTPLogs that originate from a predefined list of known malicious IP addresses.
Detects high-volume account existence checks targeting the Microsoft Teams API. The rule identifies anomalous authentication attempts characterized by the use of outdated Electron/Chrome user-agent strings associated with the TeamFiltration tool, specifically targeting the Microsoft Teams API AppId (1fec8e78-bce4-4aaf-ab1b-5451cc387264).
Detects the modification or creation of Azure AD applications that include specific malicious redirect URIs associated with 'TrustSink' style attacks, which abuse external authentication callback mechanisms to intercept tokens and bypass MFA.
Detects the granting of tenant-wide admin consent for 'openid' and 'profile' scopes to 'AllPrincipals' within an Azure environment. This activity is indicative of the final stage in a TrustSink or similar rogue External Authentication Method (EAM) attack, where an adversary configures an application to bypass user consent prompts for sensitive identity scopes.
This rule detects potentially malicious interactions with Azure OpenAI deployments, specifically looking for prompts indicative of malware-authoring, safety filter bypass attempts, and abnormal volumes of requests from a single identity.
Detects the creation or invitation of new users in Azure AD where integrated identity-verification platforms have flagged document authenticity, liveness, or face matching as anomalies. These flags are cross-referenced with suspicious account attributes such as geolocation mismatches, the use of VOIP phone numbers, or the usage of newly registered email domains, suggesting a potential fraudulent account creation attempt.
Detects potential abuse of the Microsoft Graph API by correlating device-code authentication events with subsequent high-volume activity, such as mail or file enumeration, from the same account within a short window. This pattern is indicative of ARToken-style token proxying, where an attacker intercepts an OAuth device-code token to gain unauthorized access to an user's resources.
Detects potential persistence establishment in M365 environments following anomalous or risky sign-in events. This pattern is characteristic of Adversary-in-the-Middle (AiTM) attacks where a session cookie is stolen, followed by immediate adversary actions to secure long-term access, such as MFA method registration, OAuth app consent, or mailbox rule configuration.
Detects anomalous OAuth 2.0 device authorization grant requests where the Microsoft Authentication Broker application ID is utilized by non-standard clients, specifically the python-requests library. This pattern is indicative of the GhostCode phishing backend infrastructure, which attempts to programmatically perform device code phishing rather than relying on interactive browser-based flows.
This rule monitors for potential privilege escalation activity occurring shortly after an initial authentication event. It includes two primary vectors: 1) Azure AD users assigned to highly privileged roles shortly after a successful sign-in; 2) Users performing interactive or remote logons to Linux/Unix systems followed quickly by sudo or su commands to obtain root privileges.
Detects high-volume, broad enumeration of sensitive Microsoft Graph API endpoints (users, groups, directory objects, applications, and mail folders) from a single host or user. This behavior is indicative of automated reconnaissance or post-compromise discovery of cloud identity environments.
Detects a sequence where an AWS Secrets Manager secret is retrieved via CloudTrail, followed within 30 minutes by an EDR-monitored process initiating an outbound network connection on a non-standard port (not 80 or 443). This behavior is consistent with an adversary using stolen credentials to pivot into a persistent command-and-control channel.
Detects Azure AD/Entra ID sign-ins performed using the OAuth device-code flow, excluding common administrative tools like the Azure CLI or PowerShell. This flow is frequently abused in phishing campaigns (such as EvilTokens or ARToken) where attackers entice victims to enter a device code into a malicious application, allowing the attacker to gain authorized access to the victim's session.
Detects potential account compromise by identifying a specific sequence of behavior: reconnaissance of sensitive users (HR/Payroll) via Microsoft Graph API calls, followed by the creation of inbox rules (e.g., forwarding) by the same user account within a 12-hour window.
Detects non-interactive sign-in events to M365 that claim to be from the Outlook client application but utilize suspicious or unexpected User-Agent strings (e.g., Python requests, specific Firefox versions). This behavior is often indicative of programmatic access or automated tools used by attackers to harvest credentials or interact with mailboxes, bypassing standard browser-based authentication controls.
Detects a suspicious spike in MailItemsAccessed operations occurring across multiple distinct tenant organization IDs within a 60-second window, using the same ClientAppId. This behavior is indicative of automated, centralized credential abuse or mailbox collection tools (often associated with campaigns like Storm-2755) rather than legitimate, isolated user or service-level activity.
Detects reconnaissance activity targeting sensitive personnel groups (payroll, HR, finance) via Microsoft Graph API. The rule identifies suspicious URI patterns combined with the use of the 'axios' User-Agent library, potentially indicating automated enumeration by an adversary to map high-value targets for future business email compromise or credential theft.
Page 32 of 135