Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects a sequence of potentially malicious local command execution (via PowerShell, cmd, or mshta) that mirrors the 'ClickFix' social engineering pattern, followed by an OAuth application consent grant or device-code authorization by the same user within a short timeframe. This behavior is indicative of an adversary attempting to bypass MFA by tricking a user into authorizing a malicious application after establishing local execution on their endpoint.
Detects high-risk GitHub events indicating data or asset exposure, such as creating public repositories with specific naming conventions, changing private repositories to public, or creating new gists, which could indicate exfiltration of sensitive assets or information.
Detects the creation or exposure of public repositories, releases, or gists under a personal GitHub account that utilize naming conventions associated with the 'PixelLeak' workaround. This technique allows adversaries to make previously private screenshots, recordings, or internal assets publicly accessible by hosting them in public personal repositories or releases.
Detects Azure AD / M365 audit log events associated with OAuth2 permission grants or application consent
where a high-privilege delegated scope (e.g. Mail.Read, Mail.ReadWrite, Directory.ReadWrite.All, offline_access)
is granted to an application. This technique has been publicly attributed to APT29 (Cozy Bear / Midnight Blizzard)
for maintaining persistent access to M365 mailboxes and directory data via malicious or unverified OAuth
applications, consistent with MITRE ATT&CK T1098.001 (Additional Cloud Credentials) and T1550.001 (Use Alternate
Authentication Material: Application Access Token).
where a high-privilege delegated scope (e.g. Mail.Read, Mail.ReadWrite, Directory.ReadWrite.All, offline_access)
is granted to an application. This technique has been publicly attributed to APT29 (Cozy Bear / Midnight Blizzard)
for maintaining persistent access to M365 mailboxes and directory data via malicious or unverified OAuth
applications, consistent with MITRE ATT&CK T1098.001 (Additional Cloud Credentials) and T1550.001 (Use Alternate
Authentication Material: Application Access Token).
Detects recurring Microsoft Graph mailbox activity featuring 'command_req_' or 'command_res_' substrings within message subjects or filter queries. This pattern is indicative of attackers using email-based infrastructure for Command and Control (C2) communication, characterized by periodic polling of mailbox items.
Detects anomalous, high-volume file download or export activity originating from a single identity across multiple downstream cloud applications or tenants within a one-hour window. This behavior is indicative of a compromised shared service provider, MSP, or clearinghouse account being leveraged to exfiltrate data from multiple client environments simultaneously. The detection excludes pre-approved service accounts and relies on a dynamic baseline comparison rather than a static threshold.
This rule hunts for indicators associated with the TrustSink technique, which involves using rogue External Authentication Methods (EAM) or malicious OIDC providers to bypass authentication or maintain persistence within a cloud environment. It monitors Azure AD sign-in and audit logs, alongside DNS and network events, for references to known malicious domains and URLs used for EAM-based attacks.
Detects the assignment of highly privileged OAuth scopes or application roles to service principals or users within Microsoft Entra ID (formerly Azure AD). This activity is often associated with consent phishing or token abuse, where an adversary attempts to gain long-term programmatic access to sensitive resources like email, files, or directory services using a malicious or compromised application.
Detects administrative IAM operations such as user, role, or access key creation performed by an identity containing 'agent' in its ARN or username. This behavior is intended to flag unauthorized privilege escalation or persistence mechanisms initiated by automated service identities that should not be modifying IAM configurations.
Detects the multi-stage Microsoft cloud identity compromise chain reported by Microsoft Security Research (September 2026): a victim completes a successful Entra ID device-code sign-in (often induced by passkey-themed device-code phishing), the same identity's authentication/security info is registered or changed (MFA/passkey persistence) within 60 minutes (deduplicated to the earliest such event per sign-in), followed within 120 minutes by a burst of at least 25 successful, delegated-context Microsoft Graph API calls (Scopes claim populated, i.e. user-delegated permissions rather than pure application/client-credential access) spanning at least 3 distinct resource paths, exhibiting reconnaissance (>=5 requests against /users, /groups, /directoryRoles, /roleManagement, /applications, /servicePrincipals, /organization) and/or collection (>=10 requests against /messages, /mailFolders, /attachments, /drive, /drives, /sites, /lists, /search) patterns. Restricting to delegated (Scopes-bearing) Graph calls and requiring resource-path breadth removes the two largest false-positive sources: service-principal/application-only automation jobs (Roles-only tokens) and single-endpoint polling tools. Pure behavioral correlation across SigninLogs, AuditLogs, and MicrosoftGraphActivityLogs - no static IOCs. Flags whether Graph activity originated from an IP different from the original device-code sign-in IP as a strong pivot/session-reuse indicator.
Detects a suspicious volume of cloud resource deletions occurring within a short 15-minute window, specifically targeting multiple storage accounts and SQL database/server instances. This behavior is indicative of a malicious actor or an automated script attempting to disrupt business operations or destroy data.
Detects anomalous large-scale data export operations in Google BigQuery (via jobs.insert or jobs.query) performed by identities (service accounts, API keys) not previously observed in the environment. This activity is indicative of credential abuse where stolen third-party analytics or monitoring service tokens are utilized for illicit data exfiltration, a behavior consistent with tactics employed by threat actors such as ShinyHunters.
Detects unauthorized abuse of the OAuth 2.0 device authorization grant flow in Salesforce environments, commonly used by threat actors like ShinyHunters (UNC6240) to gain programmatic access. Attackers register malicious connected apps to impersonate legitimate tools, then use social engineering (vishing) to trick victims into approving device codes. This rule flags token issuance from non-allowlisted connected apps using the device_code grant type.
Detects anomalous high-volume API querying patterns against an AI model, characterized by an abnormally high number of distinct input hashes and query frequency compared to the population baseline for that model. This pattern is consistent with model extraction or stealing attacks aimed at reconstructing a proxy model.
Detects anomalous AWS Bedrock model invocation patterns where a single identity accesses models across three or more distinct AWS regions within a short timeframe. This behavior is indicative of quota evasion, where attackers bypass per-region rate limits to maximize throughput when leveraging compromised credentials for unauthorized LLM use.
Detects a suspicious sequence where a user completes a device-code authentication flow followed shortly by consenting to high-risk OAuth permissions. This pattern is characteristic of consent phishing and device-code phishing attacks, where an attacker leverages these methods to gain persistent access to a user's cloud resources via malicious application tokens.
Detects the creation of a new Entra ID application followed closely by high-privilege permission grants or consent. This is a common technique used by attackers to establish persistent access to cloud resources, such as mailboxes or sensitive data, via OAuth application backdoors.
Detects potential consent phishing attacks by identifying newly registered multi-tenant Azure AD applications that receive OAuth consent from end-users within a short timeframe (10 minutes) of application registration. The rule specifically flags consents requesting high-risk delegated scopes (e.g., Mail.Read, Mail.Send, Files.ReadWrite.All, offline_access) where the application has not been verified by a trusted publisher.
Detects the granting of elevated mailbox permissions (FullAccess, SendAs, SendOnBehalf, or broad folder access) by an OAuth application or service principal. This behavior is indicative of a compromise where an actor uses an App-only context to establish persistence and stage internal spearphishing, bypassing standard administrative monitoring controls.
This rule detects when an OAuth application is granted sensitive Exchange Online permissions, such as 'full_access_as_app', 'Mail.Read', 'Mail.ReadWrite', or 'Mail.Send'. Granting these permissions allows an application to access mailboxes across the tenant without requiring a signed-in user context, which is a common persistence and data exfiltration technique used in Business Email Compromise (BEC) and espionage campaigns.
Detects modifications to Microsoft Entra ID (formerly Azure AD) cross-tenant access settings where a new partner is added or inbound trust settings (such as MFA or device compliance) are enabled for an external tenant. This activity may indicate an attempt to establish a persistent backdoor or facilitate initial access into the environment via a compromised or malicious external identity provider.
Page 6 of 135