Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects administrative role assignments or additions, such as 'Global Administrator', occurring for a user shortly after a device code authentication event. This pattern is indicative of ARToken-based post-compromise activity where an adversary uses an illicitly obtained device code to escalate privileges within a cloud environment.
Detects suspicious device registration or join events occurring within 60 minutes of a Device Code authentication flow. This pattern is consistent with the ARToken post-compromise technique, where an adversary uses an intercepted authentication code to register a new device to maintain persistent access to an Entra ID (Azure AD) environment.
Detects access to Microsoft Graph API endpoints related to mail, contacts, drive, or messages from a device that was registered within the last 24 hours. This behavior may indicate an adversary using stolen session tokens or credentials to access cloud-based email and data shortly after device registration or enrollment.
Detects potential privilege escalation in Entra ID (Azure AD) by monitoring for the assignment of high-privileged administrative roles to users or the granting of admin consent to applications, which can be leveraged to maintain persistence or escalate privileges.
Detects non-interactive sign-in events to the Microsoft Graph API by applications that are not part of a known set of standard Microsoft applications. This pattern may indicate the use of stolen access tokens or compromised sessions (e.g., via device code phishing) to access M365 data without user interaction.
Detects suspicious Entra ID (Azure AD) events related to device registration, Primary Refresh Token (PRT) issuance, and account-level flags (such as 'enforceMfa' or broker mode) that are indicative of persistence techniques used in device code phishing campaigns, such as the ARToken platform.
Detects instances where a user grants OAuth application permissions to GitHub or Slack shortly (within 30 minutes) after signing into a low-trust application (Discourse or OpenAI Community), suggesting a potential session hijacking or trusted-relationship abuse scenario where an attacker leverages an existing SSO session to authorize malicious applications.
Detects high-frequency, diverse access patterns against the Microsoft Graph API, indicative of automated enumeration or discovery of SharePoint, OneDrive, or search resources. The rule monitors for distinct paths (e.g., sites, drives, children) requested by a single actor within a 20-minute window.
This rule identifies sustained, low-volume activity (low-and-slow) against Microsoft 365 services (SharePoint, OneDrive, and Exchange) which may indicate an adversary is using automated methods via the Graph API to collect sensitive files or emails over an extended period. The rule buckets events by user and time, requiring a minimum of three hours of activity with consistent but low-volume interactions to identify potential data collection behavior that avoids traditional volume-based detection thresholds.
Detects anomalous activity in Microsoft Graph API logs where a single user or application interacts with three or more distinct category endpoints (e.g., users, groups, mailfolders) and at least six unique paths within a 30-minute interval, suggesting reconnaissance or broad enumeration of the M365 tenant environment.
Detects anomalous, high-frequency cloud management API requests across multiple sensitive paths (such as directory roles, applications, and service principals) from a single account. This pattern is indicative of automated enumeration or discovery of cloud infrastructure, permissions, and identity configurations, which is often a precursor to further exploitation.
Detects the use of the OAuth device code authentication flow in Azure AD/Entra ID sign-in events. This flow is frequently abused by attackers who use vishing or SMS phishing pretexts to trick users into authorizing a device login, enabling the attacker to obtain a valid session token without direct credential harvesting or cookie theft.
This rule detects high-volume interactions with the Exchange Online REST API originated from the 'One Outlook Web' application ID, specifically filtering for events with associated token IDs. This pattern may indicate automated mailbox data exfiltration or unauthorized bulk email access, which has been observed in recent phishing-based identity compromise campaigns.
Detects high-volume, automated access and download activity targeting sensitive data within Microsoft 365 services (SharePoint, OneDrive, and Exchange) using the Microsoft Graph API. The rule identifies suspicious patterns of URI access associated with file downloading and mail item access, which may indicate automated data exfiltration by an adversary using compromised credentials or OAuth tokens.
Detects anomalous activity in GitHub repositories where a code push by an actor is followed by an NPM package publish event from the same actor within a 105-minute window. This behavioral pattern is indicative of a potential compromised maintainer session or malicious code injection into the software supply chain.
Detects instances of a force push to a GitHub repository where the commit author and committer names do not match, potentially indicating identity spoofing or tampering within the repository's history.
Detects rapid mass-cloning or downloading of private GitHub repositories shortly after an OAuth token authorization, originating from IP addresses or countries not previously associated with the user account. This behavior is indicative of unauthorized bulk data extraction using compromised credentials, consistent with threat actor activity (e.g., TeamPCP/UNC6780).
Detects potentially unauthorized or anomalous activations of highly privileged Entra ID roles (e.g., Global Administrator). The rule identifies activations that lack a business justification, occur during unusual hours (outside of 06:00-22:00), or exhibit burst patterns of repeated activation/deactivation cycles which may indicate automated credential abuse or persistence attempts.
Detects a suspicious sequence of events where a user performs a device-code authentication followed by a device registration or PRT issuance within a 30-minute window. This behavior is indicative of an adversary using an OAuth device code flow to phish an initial access token, subsequently using it to register an adversary-controlled device for persistent access or to bypass Conditional Access policies.
This rule detects anomalous high-frequency search activity within Microsoft 365 environments targeting sensitive keyword terms like 'invoice', 'payment', 'wire', or 'bank.details'. The detection identifies users performing multiple searches across mailbox or graph activity within a short period, which may indicate account compromise or unauthorized email exfiltration attempts.
Detects successful Microsoft Intune enrollment events initiated using the Device Code authentication protocol in Azure AD/Entra ID. This flow is often abused by adversaries to perform OAuth device code phishing, allowing them to gain unauthorized access to cloud resources by tricking users into authorizing a malicious application on their own devices.
Page 47 of 135