Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects systematic enumeration of application registrations, owners, credentials, and permissions through Microsoft Graph. This rule identifies suspicious activity where a user or application makes a high volume of GET requests to various Microsoft Graph API endpoints related to application registrations within a short time frame (15 minutes). The specific endpoints monitored include those for listing applications, owners, password credentials, key credentials, and required resource access. A threshold of 40 requests within a 15-minute window triggers the alert, indicating potential reconnaissance or inventory collection by an adversary.
This rule detects an unusually high volume of operations related to GitHub Enterprise repositories, such as adding users, creating teams, pushing to repositories, or changing permissions, within a short timeframe. This could indicate a compromised account or automated malicious activity targeting source code repositories.
Detects Tycoon 2FA operator recon assessing mailbox forwarding rules, auto-replies, and timezones. This KQL query identifies actions related to 'mailboxSettings' within 'Microsoft Graph' events, which can indicate an adversary enumerating user mailbox configurations.
This rule detects potential OAuth token abuse by correlating credential consent grants with subsequent unusual cloud access patterns from different geographic locations. It looks for activities like adding a service principal, adding OAuth2 permission grants, or consenting to an application, followed by access to specific cloud applications (Salesforce, Drift, Slack, Microsoft 365, Workday) from an IP address that does not match the IP address from which the consent was granted. The rule aggregates these events and triggers if there are at least 4 related events within a 6-hour window.
Detects access to Kubernetes secret objects containing sensitive configuration data
This rule looks for sensitive-looking values appearing in a publicly visible Claude workflow summary on GitHub. Public summaries can be indexed and copied quickly. Revoke any exposed credentials and restrict summary visibility. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Detects bursts of Microsoft Graph API calls hitting multiple distinct reconnaissance endpoints within a 60-second window. This behavior can indicate an adversary performing rapid enumeration or discovery within a Microsoft 365 environment.
Detects Google Workspace OAuth authorizations requesting the Chrome native client ID, which has been observed to be used by threat actors like Tycoon 2FA to mint tokens for illicit access.
Detects deployment of the VMAccess extension via Azure Management plane, which can be abused by attackers to create local backdoor administrators on Azure Virtual Machines.
Detects Graph API queries targeting getResourceTenants, identifying lateral movement preparation. This activity can be indicative of an adversary attempting to enumerate tenant relationships within Microsoft Graph to understand the environment and potentially identify targets for further compromise or lateral movement.
Detects extraction of Azure Storage account keys (ListKeys) used to facilitate programmatic, static-auth data exfiltration.
Detects bulk Azure AD group membership enumeration via Graph API
Detects an unusually high volume of successful operations related to Azure App Services originating from a single caller within a one-hour window. This could indicate automated activity, reconnaissance, or a misconfigured application.
This rule detects the successful execution of the 'Run Command' action on Azure virtual machines outside of defined business hours (8 AM to 6 PM). Run Command allows the execution of arbitrary scripts on a VM, which can be leveraged for administrative tasks but also by attackers for post-exploitation activities, persistence, or lateral movement. Monitoring these operations during off-hours may indicate unauthorized use or anomalous administrative activity.
This rule detects potential cloud resource hijacking (e.g., cryptojacking) by monitoring for a sudden spike in the deployment of Azure virtual machines by a single user. It triggers if a user creates five or more virtual machines in a 10-minute window, specifically looking for deployments in regions where the user has not recently created VMs, or deployments utilizing high-compute SKUs commonly targeted for cryptocurrency mining.
This rule detects an unusually high volume of operations related to GitHub Enterprise repositories, such as adding users, creating teams, pushing to repositories, or changing permissions, within a short timeframe. This could indicate a compromised account or automated malicious activity targeting source code repositories.
This rule detects suspicious activity involving the creation or update of managed identities and the assignment of highly privileged roles (Contributor, Owner, User Access Administrator) to them. It specifically looks for multiple such assignments within a one-hour window to managed identities associated with automation, runbook, or function resources, indicating potential privilege escalation or malicious access.
This rule detects when a user successfully grants five or more OAuth2 permissions within a five-minute window, specifically looking for sensitive scopes such as 'Mail.Read', 'Calendar.Read', 'User.Read.All', or 'Directory.Read.All'. This behavior can indicate an adversary attempting to gain broad access to an organization's data through a compromised application or user account.
Detects rogue device registration with default naming conventions commonly used by threat actors (DESKTOP-[0-9A-F]{6,8}). This pattern is often observed in device code phishing attacks where adversaries register new devices with generic names to maintain persistence or access.
Identifies Python-based automated Graph API queries searching the directory based on name patterns and role attributes. This rule correlates sign-in logs with Microsoft Graph CloudAppEvents to detect suspicious activity originating from Python scripts interacting with the Microsoft Graph API.
Detects specific URI patterns used by Storm-2949 to enumerate users, indicating automated directory reconnaissance. The rule specifically looks for Microsoft Graph API calls that include both '$select=displayName,userPrincipalName,jobTitle' and '$top=50' in the RawEventData, which are indicators of user enumeration.
Page 93 of 135