Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
94 detections
Filters
Last updated
All Time
Detection languages
52
10
9
8
8
Contributors
18
14
10
9
6
Categories
73
38
15
15
14
Platforms
53
31
21
13
6
Products / Services
45
21
16
14
10
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
2
IDS Classtypes
3
1
IDS Protocols
4
Detects bulk AWS or Azure API command execution via CLI tools
Detects attempts to modify or delete Microsoft Graph API conditional access policies. This could indicate an adversary attempting to weaken security controls to facilitate unauthorized access or persistence.
Detects low-and-slow password spraying activity against Entra ID by identifying a single source IP generating authentication failures (AADSTS50126) across multiple distinct accounts within a short window. This technique is used to obtain valid credentials for subsequent Microsoft Graph token abuse via hidden Conditional Access policy exclusions (CVE-2025-0309).
This rule detects attempts to modify or delete Conditional Access Policies within Microsoft Azure Active Directory (now Microsoft Entra ID) via the Microsoft Graph API. Adversaries may alter or remove these policies to bypass security controls, maintain persistence, or facilitate unauthorized access to resources. The detection specifically looks for network events targeting 'graph.microsoft.com' that involve 'conditionalAccessPolicies' and use 'PATCH' (modification) or 'DELETE' (removal) HTTP methods.
Detects successful (HTTP 200) requests to ServiceNow API endpoints (/api/now/) that lack proper authentication, such as requests by the 'guest' user or requests missing authorization headers or session tokens.
Detects potential exploitation of unauthenticated ServiceNow Scripted REST Resources by identifying a pattern where external IP addresses first receive 4xx (authentication required) responses when querying /api/ paths, followed by 200 OK responses for the same paths, indicating a successful authentication bypass.
Identifies python-requests User-Agent authenticating into Office/Graph applications, indicative of Kali365 backend egress.
Detects suspicious app installations, custom app creation, and bot additions within Microsoft Teams. This rule flags activities such as sideloaded app installations (which bypass Teams store vetting and can be used for persistence), custom app creation outside of typical development teams (potentially indicating C2 bots or data exfiltration apps), and the addition of bots, especially when combined with suspicious keywords in the app name. These actions can be indicative of an adversary establishing persistence or gaining unauthorized access and control within the Teams environment.
Detects disabling of Conditional Access policies via Graph API
Detects bursts of Microsoft Graph API calls hitting multiple distinct reconnaissance endpoints within a 60-second window. This behavior can indicate an adversary performing rapid enumeration or discovery within a Microsoft 365 environment.
Detects bulk Azure AD group membership enumeration via Graph API
Targets API request content containing shell separators together with command interpreters or transfer utilities. The UDM rule retains principal and target context for correlation.
Detects bulk Azure AD user account enumeration via Graph API
Targets API request content containing shell separators together with command interpreters or transfer utilities. The UDM rule retains principal and target context for correlation.
Detects bulk Azure AD group membership enumeration via Graph API
This rule detects events generated by Microsoft Defender for Endpoint's Attack Surface Reduction (ASR) rules in either Audit or Block mode.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
Detects cloud resources created in rarely used geographic regions for evasion
This rule identifies suspicious activity within Microsoft Intune by focusing on sensitive operations, broad assignments, and actions performed by API actors (Service Principals) without an associated human User Principal Name (UPN). It specifically looks for operations like creating, adding, assigning, or updating DeviceManagementScripts, DeviceShellScripts, Win32LobApp, DeviceConfiguration, DeviceCompliancePolicy, EndpointSecurity, SecurityBaseline, ConfigurationPolicies, or GroupPolicyConfigurations. The rule also flags broad assignments targeting 'All Devices', 'All Users', 'allDevices', or 'allLicensedUsers'. The primary goal is to detect potential abuse of over-permissioned Graph API applications by attackers to bypass MFA and deploy malicious Mobile Device Management (MDM) commands or configurations.
This rule detects HTTP POST requests to the Google Cloud Platform (GCP) Compute Engine API (compute.googleapis.com). It specifically looks for a high volume of these requests (20 within 10 seconds from the same source IP), which could indicate automated activity or potential command execution attempts within GCP. The rule is designed to identify suspicious interactions with the GCP API that might be related to execution tactics.
This rule detects potential AWS CLI API command execution by monitoring HTTP traffic for connections to 'amazonaws.com' and the presence of 'Action=' in the URI. It uses a threshold of 30 occurrences within 10 seconds from a single source IP to reduce false positives, indicating a high volume of API calls typical of automated scripts or tools.
Detects the successful creation or update of an Azure API Management Service. This activity could indicate legitimate administrative actions or, if unexpected, potential unauthorized access or privilege escalation within the Azure environment. Monitoring these events can help identify suspicious configuration changes or resource provisioning by malicious actors.
Page 2 of 5