Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
This rule detects the creation or modification of inbox rules in Office 365 that involve email forwarding or redirection to external domains. It calculates a risk score based on whether the action occurred outside of typical business hours (08:00-18:00 local time/weekends) and whether the user is performing this action from a previously unseen IP address, which may indicate a compromised account attempting to exfiltrate or redirect emails.
This rule detects potentially malicious reconnaissance or enumeration activity by identifying a high volume of Microsoft Graph API requests (GET requests) to sensitive directory endpoints (users, groups, directoryRoles, servicePrincipals) from a single application identity (AppId) and IP address within a short time window.
Detects anomalous device code authentication sessions originating from non-corporate IP addresses using common command-line user agents, which are immediately followed by a device registration event by the same user. This pattern is indicative of OAuth device code phishing, where an attacker tricks a user into authorizing a malicious application to access their account.
Detects anomalous non-interactive OAuth token requests against Microsoft Graph that claim multi-factor authentication (MFA) satisfaction from unmanaged devices. This behavior is indicative of Adversary-in-the-Middle (AiTM) token replay attacks, where captured session tokens are reused by an attacker to bypass authentication controls, consistent with tactics used by threat actors like Storm-2755 (Payroll Pirate).
Detects when a user or service principal is assigned the 'Owner' or 'Contributor' role at the Subscription scope in Azure. This activity is often associated with privilege escalation and persistent access techniques.
This rule detects an unusually high volume (10 or more within an hour) of successful access control or role-related operations initiated by a single caller in Azure Activity logs. Such activity could indicate an adversary attempting to enumerate permissions, escalate privileges, or modify access to resources within an Azure environment.
Detects OAuth consent grants or permission additions in Microsoft Entra ID (Azure AD) audit logs that occur in conjunction with device login flow artifacts. This pattern is indicative of 'ConsentFix' or device code phishing attacks, where users are manipulated into authorizing malicious applications, potentially bypassing MFA requirements by using the device code flow.
Detects high-volume data access or exfiltration from Azure/Office 365 cloud environments via common scripting/automation user-agents. The rule monitors API requests to users, mail, drive, or files endpoints by non-standard clients (e.g., python, curl, Go) from previously unseen locations, calculating a risk score based on the number of endpoints accessed and the total data volume.
Detects the deployment of container images in AWS ECS or EC2 via RunInstances or RegisterTaskDefinition from registries other than Amazon Elastic Container Registry (ECR) or public ECR. This rule identifies potentially unauthorized or untrusted container sources, which could indicate an adversary attempting to deploy malicious images for persistence or exploitation.
This rule detects potential unauthorized access and environment variable disclosure attempts against the Flowise API, specifically targeting the MCP (Model Context Protocol) endpoints. It monitors for path traversal-like patterns using case variants (e.g., /api/v1/env), unauthorized access to configuration endpoints, and the exposure of sensitive data like API keys, database URLs, and passwords in API responses or request headers.
Detects when a single user principal name (UPN) performs two or more Azure AD admin role assignments within an hour. This could indicate an attempt to escalate privileges or establish persistence by assigning administrative roles to multiple accounts or to the same account multiple times.
Detects potentially malicious or anomalous queries within Microsoft 365 Copilot interactions. The rule monitors for patterns indicating attempts at data exfiltration (e.g., HTML/image embedding, image search parameters), unauthorized information extraction (e.g., email or title extraction), or targeting of sensitive authentication-related information (e.g., OTP or MFA codes).
Detects anomalous activity where an identity performs a sequence of reconnaissance-related AWS API calls (e.g., listing roles, policies, or describing instances) followed shortly (within 10 minutes) by deployment actions like RunInstances or CreateCluster. This behavior is indicative of an attacker who has gained access to an identity and is surveying the environment before provisioning malicious infrastructure.
Detects instances where a user account modifies sensitive payroll or banking information (e.g., direct deposit details) shortly after performing a sign-in from an unmanaged device or suspicious context. This behavior is indicative of an Adversary-in-the-Middle (AiTM) token replay attack targeting HR SaaS applications like Workday to perform financial fraud.
Detects OAuth application consent grants or modifications where the application is granted sensitive permissions including Mail.Read, Directory.Read.All, or User.Read.All. These permissions can be abused by attackers to exfiltrate email data or map the organization's directory.
Detects instances where a user grants an OAuth application sensitive permissions, which could indicate an illicit consent grant attack where an adversary lures a user into authorizing a malicious application to access their email, files, or directory data.
Detects successful OAuth device code authentication flows targeted at sensitive Microsoft cloud resources (Exchange Online, SharePoint, Teams, Graph) originating from unmanaged or non-compliant devices. This pattern is often indicative of consent phishing or device code phishing attacks where an adversary obtains a device token to gain long-term unauthorized access to user data.
This rule detects anomalous Azure AD sign-in behavior where a single user account authenticates from two or more distinct subnets (class C) within a 10-minute window. It specifically focuses on non-interactive logins or token issuance (e.g., refresh tokens) that are successful (resultType 0) and ignores service principal activity, which may indicate account compromise, session hijacking, or automated credential misuse.
This rule detects suspicious activity related to Azure Active Directory service principals. It specifically looks for a service principal performing multiple (5 or more within an hour) 'Add service principal', 'Add owner to application', or 'Add permission grant' operations. This pattern could indicate an attacker attempting to escalate privileges or establish persistence within an Azure AD environment by manipulating service principals and application permissions.
Detects instances where a user or service principal is assigned to high-privilege roles (e.g., Global Administrator, Owner) without utilizing the Microsoft Entra Privileged Identity Management (PIM) service. This is indicated by the absence of 'PIM' in the LoggedByService field for a successful 'Add member to role' operation, which could signify an attempt to bypass established access controls and gain unauthorized elevated persistence.
Detects Microsoft Graph API requests that perform bulk enumeration of email messages across multiple folders. The rule specifically identifies API queries that request sender (From) and recipient (To, CC, BCC) fields, a behavior consistent with mailbox address harvesting or reconnaissance by an Address Extractor module.
Page 77 of 135