Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
38 detections
Filters
Last updated
All Time
Detection languages
22
5
5
3
2
Contributors
7
5
5
4
3
Categories
27
12
9
7
7
Platforms
31
15
6
2
1
Products / Services
18
16
7
4
4
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
2
IDS Classtypes
2
IDS Protocols
2
KQL Query from file: GraphRunner Recon Detection & Response
KQL Query from file: Nation State Actors via Microsoft Graph
KQL Query
KQL Query
KQL Query from file: OAuth app using the OD file picker permission
KQL Query
'This detection identifies high-severity alerts across various Microsoft security products, including Microsoft Defender XDR and Microsoft Entra ID, and correlates them with instances of Google Cloud VM creation. It focuses on instances where VMs were created within a short timeframe of high-severity alerts, potentially indicating suspicious activity.'
This detection identifies when a new packaged application has been added, updated, or deleted within Microsoft Intune. This functionality, while legitimate for software deployment, can be abused by adversaries to deploy malicious payloads to Intune-managed devices.
This detection identifies when a new Microsoft Intune device health script has been added, updated, or deleted. Intune device remediation scripts can be used by administrators for remote device management, but this functionality can also be abused for SYSTEM-level code execution and lateral movement to Intune-managed devices.
This detection identifies when an administrator manually triggers device management configuration policy sync events, on-demand remediation scripts, or remotely restarts devices within Microsoft Intune. While this functionality can be used legitimately to expedite policy delivery, it can also be abused by an attacker to quickly deploy malicious payloads or disrupt systems.
The analytic detects cloud provisioning activities originating from previously unseen regions. It leverages cloud infrastructure logs to identify events where resources are started or created, and cross-references these with a baseline of known regions. This activity is significant as it may indicate unauthorized access or misuse of cloud resources from unfamiliar locations. If confirmed malicious, this could lead to unauthorized resource creation, potential data exfiltration, or further compromise of cloud infrastructure.
The following analytic identifies a spike in the number of AWS Security Hub alerts for an EC2 instance within a 4-hour interval. It leverages AWS Security Hub findings data, calculating the average and standard deviation of alerts to detect anomalies. This activity is significant for a SOC as a sudden increase in alerts may indicate potential security incidents or misconfigurations requiring immediate attention. If confirmed malicious, this could signify an ongoing attack, leading to unauthorized access, data exfiltration, or disruption of services on the affected EC2 instance.
This rule detects persistent login activity to the Azure AD PowerShell application. Specifically, it looks for successful user logins to the application identified by the product object ID '1b730954-1685-4b74-9bfd-dac224a7b894' (which corresponds to Azure AD PowerShell) by the same user ID over a 24-hour period. The rule is designed to flag continuous access to this administrative tool, which is not considered a security best practice and warrants further investigation.
Continual logins to Azure AD PowerShell app are not a security best practice, if this is observed, additional investigation is needed
This rule identifies API requests made to the Microsoft Graph API to access user mailboxes and retrieve a specified number of messages. It specifically looks for GET requests to the `/v1.0/users/*/mailFolders/*/messages?$top=` endpoint with a successful HTTP 200 response. This activity could indicate an attacker attempting to exfiltrate emails from a compromised mailbox.
This rule identifies when the HTTP DELETE method is used within the Microsoft Graph API. This can indicate administrative activities such as deleting users, groups, or other resources. The rule specifically looks for network HTTP events where the product event type is 'Microsoft Graph Activity' and the HTTP method is 'DELETE'. It excludes IP addresses within a specific Azure CIDR range (20.151.0.0/16) to reduce noise from internal Azure operations. Further tuning can be applied to target specific API endpoints or user agents.
This rule detects requests to the Microsoft Graph API's '/v1.0/users' endpoint with a GET method and a successful 200 response code. This API call is used to enumerate users within an Azure Active Directory environment. The rule is designed to identify potential reconnaissance activities where an attacker might be collecting a listing of users. It notes that this can be a 'chatty' API call, meaning it might generate a high volume of legitimate traffic.
Page 2 of 2