Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
38 detections
Filters
Last updated
All Time
Detection languages
22
5
5
3
2
Contributors
7
5
5
4
3
Categories
27
12
9
7
7
Platforms
31
15
6
2
1
Products / Services
18
16
7
4
4
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
CVEs
2
IDS Classtypes
2
IDS Protocols
2
Detects ROPC (Resource Owner Password Credentials) token requests to Microsoft Graph using specific client IDs associated with Microsoft To-Do or Intune Company Portal. This activity could indicate an attempt to bypass MFA via hidden Conditional Access policy exclusions, as described in CVE-2025-0309.
Detects low-and-slow password spraying activity against Entra ID by identifying a single source IP generating authentication failures (AADSTS50126) across multiple distinct accounts within a short window. This technique is used to obtain valid credentials for subsequent Microsoft Graph token abuse via hidden Conditional Access policy exclusions (CVE-2025-0309).
This rule detects potential Conditional Access bypass attempts where a Primary Refresh Token (PRT) is exchanged for an Azure Active Directory (AAD) Graph token. The detection specifically looks for successful sign-ins to 'Windows Azure Active Directory' or 'Microsoft Graph' resources from devices marked as 'compliant' but with 'Unknown' ownership or no prior device registration history in Audit Logs. This could indicate an adversary using a compromised PRT on an unregistered or untrusted device to gain access to resources that should be protected by Conditional Access policies.
This rule detects attempts to bypass Conditional Access policies by exchanging a Primary Refresh Token (PRT) for an Azure Active Directory (AAD) Graph token on a device that is either of 'Unknown' ownership or lacks a check-in history, despite being marked as compliant. This behavior could indicate an adversary attempting to gain unauthorized access to resources by leveraging a compromised PRT on an unmanaged or suspicious device, circumventing Conditional Access controls.
This rule detects Nested App Authentication (NAA) broker abuse, specifically when the Azure Portal silently acquires Microsoft Graph tokens for privileged first-party nested applications. It correlates these silent token acquisitions with a preceding interactive Azure Portal sign-in from the same user and IP address within a 30-minute window, indicating a potential AiTM (Adversary-in-the-Middle) kill chain indicator. The rule identifies known vulnerable nested application IDs and looks for 'refreshToken' or 'broker' as the incoming token type during the Graph token acquisition.
This rule detects Nested App Authentication (NAA) broker abuse, specifically when the Azure Portal silently acquires Microsoft Graph tokens for privileged first-party nested applications. It correlates these silent token acquisitions with a preceding interactive Azure Portal sign-in from the same user and IP address within a 30-minute window, indicating a potential AiTM (Adversary-in-the-Middle) kill chain indicator. The rule identifies known vulnerable nested application IDs and looks for 'refreshToken' or 'broker' as the incoming token type during the Graph token acquisition.
This rule detects the sideloading of 'UnityPlayer.dll' by 'BrowserViewUtility.exe' in conjunction with network communication to a 'windows.net' domain. This activity is indicative of the 'Dragon Weave' campaign, specifically the 'RustCloak' malware, which uses DLL sideloading for execution and Azure cloud for C2.
Detects Graph API queries targeting getResourceTenants, identifying lateral movement preparation. This activity can be indicative of an adversary attempting to enumerate tenant relationships within Microsoft Graph to understand the environment and potentially identify targets for further compromise or lateral movement.
Identifies Python-based automated Graph API queries searching the directory based on name patterns and role attributes. This rule correlates sign-in logs with Microsoft Graph CloudAppEvents to detect suspicious activity originating from Python scripts interacting with the Microsoft Graph API.
This rule detects suspicious administrative activities in Azure AD, Microsoft Graph, SharePoint, Exchange, or Teams when performed by accounts that are not explicitly identified as 'admin' or 'service' accounts. It looks for a combination of at least 5 operations and 2 unique operation types within a 2-hour window, targeting group, application, or service principal related resources. This could indicate an attacker using compromised non-privileged accounts to perform administrative actions or escalate privileges.
Detects access to Azure portal for cloud service dashboard discovery
This rule detects attempts to use cloud services (specifically AWS SSM or Azure Management) for internal lateral movement. It triggers when HTTP requests are made to 'ssm.amazonaws.com' or 'management.azure.com' with the URI containing 'SendCommand'. A threshold of 5 such events from the same source within 30 seconds is set to reduce false positives.
This rule identifies successful device code authentications using the Microsoft Authentication Broker application (AppId '29d9ed98-a469-4536-ade2-f981bc1d605e') targeting Microsoft Graph (ResourceIdentity '00000003-0000-0000-c000-000000000000'). It specifically looks for these authentications originating from untrusted network locations. This activity is highly anomalous and can indicate an attacker generating Primary Refresh Tokens (PRTs) via device code phishing.
This rule detects network traffic where an HTTP request is made to 'ssm.amazonaws.com' with the URI containing 'StartSession'. This combination indicates the initiation of an AWS Systems Manager (SSM) Session Manager session, which can be used for legitimate remote administration but also for lateral movement by attackers.
Detects successful device code flow sign-ins to the Microsoft Authentication Broker application targeting the Microsoft Graph resource, specifically when the sign-in does not originate from a trusted named location. This activity can indicate a device code phishing attempt where an attacker tricks a user into authenticating a malicious application.
Detects post-install execution of the TeamPCP-compromised Microsoft durabletask package
(v1.4.1–1.4.3, May 2026). The worm drops rope.pyz/managed.pyz, marks infection via
~/.cache/.sys-update-check, persists as pgsql-monitor.service, and then propagates via AWS SSM
and kubectl exec.
(v1.4.1–1.4.3, May 2026). The worm drops rope.pyz/managed.pyz, marks infection via
~/.cache/.sys-update-check, persists as pgsql-monitor.service, and then propagates via AWS SSM
and kubectl exec.
Detects potentially suspicious events involving "GetSigninToken".
An adversary using the "aws_consoler" tool can leverage this console API to create temporary federated credential that help obfuscate which AWS credential is compromised (the original access key) and enables the adversary to pivot from the AWS CLI to console sessions without the need for MFA using the new access key issued in this request.
An adversary using the "aws_consoler" tool can leverage this console API to create temporary federated credential that help obfuscate which AWS credential is compromised (the original access key) and enables the adversary to pivot from the AWS CLI to console sessions without the need for MFA using the new access key issued in this request.
KQL Query from file: M365 Connector for Claude Detection
This rule detects potential GraphRunner activity in Azure environments by identifying suspicious authentication attempts to Microsoft Graph using the 'deviceCode' authentication protocol, combined with specific user agent strings associated with the GraphRunner tool. It categorizes detections into high confidence (both device code and suspicious user agent), device code authentication only, or suspicious user agent only.
Detects successful sign-ins to the Microsoft Intune Company Portal (AppId '9ba1a5c7-f17a-4de9-a1f1-6178c8d51223') where Conditional Access Policies (CAP) have failed. This indicates an attempt to bypass device compliance requirements, potentially allowing access from non-compliant or unmanaged devices.
Detects potentially suspicious events involving "GetSigninToken" in AWS. An adversary using the "aws_consoler" tool can leverage this console API to create temporary federated credentials, which can help obfuscate the compromised AWS credential (the original access key) and enable pivoting from the AWS CLI to console sessions without requiring MFA, using the newly issued access key.
Page 1 of 2