Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects high-volume or multi-mailbox activity in Exchange Online, indicative of automated mailbox collection or unauthorized bulk data access via Graph or REST APIs. The rule monitors for a threshold of operations across multiple mailboxes or high event counts originating from specific API clients.
This rule detects potentially malicious, automated enumeration of Microsoft Graph API endpoints. It monitors for high volumes of requests (>= 8 within a 15-minute window) that utilize multiple OData pagination, filtering, and search parameters such as $top, $skip, $skiptoken, $count, /delta, and /search. Such activity is often indicative of automated reconnaissance, data scraping, or unauthorized bulk enumeration of cloud directory resources.
Detects individual access events to sensitive Microsoft Graph control-plane endpoints, including directory roles, role management, authentication methods, applications, service principals, and OAuth permissions. This rule is designed to be paired with a broader correlation rule to identify potential reconnaissance or persistence activities involving high-privilege configuration changes.
This rule detects successful sign-in attempts to Azure AD (Entra ID) using the Device Code authentication protocol. Device Code flow allows users to sign in to input-constrained devices by using a browser on another device. While legitimate for smart TVs, IoT devices, or CLI tools, this flow is frequently abused by attackers to perform phishing or bypass MFA by tricking users into authorizing an application.
This rule detects suspicious cloud user activity by identifying a single user account engaging in diverse, multi-stage actions (Authentication, MFA updates, Reconnaissance, and Exfiltration) originating from a high number of distinct source IP addresses. This behavioral pattern is indicative of a compromised account where an adversary is rotating IPs while performing a coordinated, multi-stage attack sequence.
Detects anomalous activity in Microsoft Graph API logs where a single identity (user or application) performs a high volume of requests across multiple sensitive administrative categories, such as directory role management, authentication method modification, application or service principal changes, and OAuth consent operations. This pattern is indicative of potential unauthorized reconnaissance, privilege escalation, or persistence attempts within an Azure/Microsoft 365 environment.
Detects sign-in activity to the 'Office Home' portal from an unmanaged, non-compliant device, followed by authentication to sensitive cloud services like SharePoint Online, OneDrive, or Microsoft Graph. This pattern often indicates a potential session hijacking or post-compromise activity where an attacker uses an unmanaged device to access enterprise data via cloud application discovery.
Detects a multi-stage cloud attack sequence involving a sign-in anomaly, modification of user authentication methods (e.g., registering an attacker-controlled device), reconnaissance using Microsoft Graph API, and subsequent abnormal data access/download, typically observed in Storm-3121 and Storm-3032 activities.
Detects anomalous, high-frequency access to multiple distinct Microsoft Graph API endpoints (e.g., users, groups, applications) by a single user within a short timeframe, which is indicative of tenant-wide reconnaissance following identity compromise.
Detects anomalous, systematic enumeration of multiple Microsoft Graph API resource categories (e.g., users, groups, applications, sites) by a single identity, IP, or application within a short time window. This activity often indicates an adversary performing discovery or reconnaissance against the M365 tenant environment.
Detects anomalous sign-in behavior following a successful device code authentication. The rule identifies instances where a successful device code login is immediately followed by a sign-in session using a different IP address or device name for the same account, indicating potential session theft or adversary-in-the-middle phishing activity.
Detects process creation events containing command-line arguments indicative of an OAuth 2.0 device code flow, commonly used in consent phishing or device code phishing attacks to hijack account access via a malicious OAuth application registration.
Detects a suspicious sequence of events where a user initiates a device code authorization flow, immediately followed by a Microsoft Authentication Broker sign-in using the 'sso_reload=true' parameter. This pattern is indicative of an attacker hijacking the device code authorization process to gain unauthorized access to a user's session.
This rule detects suspicious Azure AD sign-in activity originating from a single user account that utilizes the 'deviceCode' authentication protocol while simultaneously exhibiting activity from multiple distinct and highly specific User Agent strings (Python requests library and Microsoft Outlook 16.0.17425). This pattern is indicative of potential token theft or automated credential harvesting where a legitimate OAuth flow is subverted to gain persistent access.
Detects rapid, sequential identity-validation API calls (such as GetCallerIdentity, GetSessionToken, or AssumeRole) performed across a large number of distinct AWS access keys from a single source within a short time window. This pattern is indicative of automated tooling validating a harvested corpus of AWS access keys to identify active credentials.
Detects rapid, sequential identity-validation API calls (such as GetCallerIdentity, GetSessionToken, or AssumeRole) performed across a large number of distinct AWS access keys from a single source within a short time window. This pattern is indicative of automated tooling validating a harvested corpus of AWS access keys to identify active credentials.
Detects unauthorized attempts to manipulate cgroup files (e.g., cgroup.procs) within Kubernetes pods using kubectl exec/attach sessions. This technique is often associated with SPIRE attestation spoofing or container escape attempts where an attacker attempts to influence process management or isolation constraints from within the container via the Kubernetes API.
Detects instances where a single proxy service API key or account is used from an abnormally high number of distinct IP addresses within a short timeframe. This behavior is indicative of credential theft and unauthorized sharing or exploitation of proxy credentials by third-party actors.
Detects instances where a single proxy service API key or account is used from an abnormally high number of distinct IP addresses within a short timeframe. This behavior is indicative of credential theft and unauthorized sharing or exploitation of proxy credentials by third-party actors.
Detects instances where a single proxy service API key or account is used from an abnormally high number of distinct IP addresses within a short timeframe. This behavior is indicative of credential theft and unauthorized sharing or exploitation of proxy credentials by third-party actors.
Detects instances where a single proxy service API key or account is used from an abnormally high number of distinct IP addresses within a short timeframe. This behavior is indicative of credential theft and unauthorized sharing or exploitation of proxy credentials by third-party actors.
Page 53 of 135