Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects high-volume access to Microsoft Graph API endpoints related to messages, mail folders, and attachments by a single user account within a 30-minute window. This behavior is indicative of automated, unauthorized email and attachment scraping, often associated with remote email collection attempts.
This rule monitors for OAuth device-code authentication flow completions initiated from devices flagged as non-compliant or unmanaged in Azure AD. This behavior is indicative of potential token theft via vishing or SMS-based phishing lures (consistent with Storm-3121/Storm-3032 TTPs), where an adversary tricks a user into completing a device authorization grant to facilitate MFA bypass and persistence.
Detects anomalous or high-volume activity related to Microsoft Graph API calls targeting email messages, mail folders, or attachments. This behavior is indicative of potential unauthorized bulk email collection or exfiltration attempts, often observed in account compromise scenarios where an attacker enumerates and downloads mail contents.
Detects anomalous, high-volume access to Exchange Online via the REST API, potentially indicating programmatic exfiltration of email content. This rule monitors for specific suspicious Application IDs, Account Display Names, or Account Object IDs that exceed a threshold of 500 Exchange REST events, which is characteristic of mass-email collection patterns often seen in cloud-based identity compromises.
This rule monitors various logs (device network events, Entra ID sign-ins, cloud application events, and email events) for any interaction with a predefined list of indicator IP addresses identified as being associated with malicious actor egress traffic.
Detects a single user account authenticating, performing Graph API reconnaissance, and conducting data exfiltration across three distinct source IP addresses within a one-hour window. This behavior is indicative of threat actors like Storm-3121 or Storm-3032 rotating infrastructure per attack stage to evade network-based detection.
Detects a single user account authenticating, performing Graph API reconnaissance, and conducting data exfiltration across three distinct source IP addresses within a one-hour window. This behavior is indicative of threat actors like Storm-3121 or Storm-3032 rotating infrastructure per attack stage to evade network-based detection.
This rule detects high-volume usage (500+ events per hour) of Microsoft Exchange Online resources by accounts that lack an associated AccountObjectId but utilize a TokenObjectId. This pattern is indicative of service accounts or potentially compromised tokens performing bulk actions, such as mass email access or data collection within the Exchange environment.
This rule detects anomalous behavior where an identity performs multi-category discovery (e.g., users, groups, directory roles, applications) via Microsoft Graph API within a single session, followed by intensive collection of content (files, attachments, or messages). This sequence is indicative of an adversary performing reconnaissance to map an environment before moving to data exfiltration or theft.
Detects interaction with known infrastructure associated with the PREY-0058 campaign, which utilizes Adversary-in-the-Middle (AiTM) phishing lures mimicking passkey or MFA registration pages to target Microsoft 365 and other SaaS applications.
Detects modifications to credentials associated with Azure AD service principals or applications, such as adding new secrets or certificates. This behavior is commonly associated with attackers maintaining persistence or escalating privileges by creating backdoored credentials.
Detects usage of the OAuth device code authentication flow by high-value accounts (Finance, Accounts Payable, Admins). This flow is often abused in phishing campaigns to obtain access tokens by coercing users to authorize malicious applications via a code entry process.
Detects the creation or modification of inbox and transport rules in Office 365 that perform automatic email actions such as redirecting, forwarding, deleting, or marking emails as read, especially when targeting keywords related to sensitive information (e.g., invoice, payment, vendor, bank). This behavior is often associated with email account compromise and data exfiltration or persistence strategies.
Detects network connection events involving a specific known malicious IP address (5.230.71.51) identified as participating in unauthorized Intune enrollment or Entra ID device registration processes.
Detects network connection events involving a specific known malicious IP address (5.230.71.51) identified as participating in unauthorized Intune enrollment or Entra ID device registration processes.
Detects suspicious OAuth device code authorization requests matching the GhostCode phishing kit's pattern. The rule identifies the use of a known Microsoft Authentication Broker App ID (29d9ed98-a469-4536-ade2-f981bc1d605e) coupled with the 'python-requests' user agent, which are characteristic indicators of the phishing backend server attempting to authorize malicious requests.
Detects OAuth 2.0 device authorization grant requests utilizing the Microsoft Authentication Broker application ID (29d9ed98-a469-4536-ade2-f981bc1d605e) with sensitive scopes like 'https://graph.microsoft.com/.default'. This specific application ID is frequently impersonated by phishing kits (e.g., GhostCode) to facilitate token theft via device code flow abuse, where adversaries trick users into authenticating to a legitimate-looking but attacker-controlled flow.
Detects login attempts to source code repositories and developer tooling (GitHub, GitLab, Bitbucket, Azure DevOps, Slack, Visual Studio Code) originating from unmanaged or non-compliant devices, excluding traffic originating from known corporate network ranges.
Detects pull requests created in GitHub repositories by entities labeled as 'Bot', 'App', or 'integration', or containing the term 'codex', specifically targeting repositories where such entities have not performed these actions in the previous 30 days. This baseline approach identifies potentially hijacked or unauthorized automation accounts performing activities outside of their standard repository scope.
Detects pull requests created in GitHub repositories by entities labeled as 'Bot', 'App', or 'integration', or containing the term 'codex', specifically targeting repositories where such entities have not performed these actions in the previous 30 days. This baseline approach identifies potentially hijacked or unauthorized automation accounts performing activities outside of their standard repository scope.
Detects instances where a user grants OAuth application permissions to GitHub or Slack shortly (within 30 minutes) after signing into a low-trust application (Discourse or OpenAI Community), suggesting a potential session hijacking or trusted-relationship abuse scenario where an attacker leverages an existing SSO session to authorize malicious applications.
Page 50 of 135