Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,088 detections
Filters
Last updated
All Time
Detection languages
619
191
113
86
47
Contributors
302
211
112
88
54
Categories
481
416
353
192
164
Platforms
726
348
216
136
57
Products / Services
518
292
197
124
88
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,088
CVEs
5
5
5
5
4
IDS Classtypes
3
2
1
1
IDS Protocols
3
Detects Microsoft 365 token replay from the Huntress token spray and replay campaign. Alerts on sign-ins from an IP new to the account (not seen on 3 or more distinct days in the 14d baseline) that match one of three behaviors: a scripted client (node or bare Mozilla/5.0 user agent with Office or Authentication Broker client IDs), Device Registration Service access (Medium-High only when corroborated by a campaign IP, scripted user agent or session IP hop, otherwise Low), or one session moving across IPs within 60 minutes. Rows are raised to High when the same new IP hits 3 or more baseline accounts in the window (token spray pattern) or matches a campaign IOC. Low Signal rows are dropped when AlertOnly = true. Does not cover MFA changes, device registration events or inbox rules.
Hunting query for the ConnectWise Cloud Backup (SkyKick) application credential abuse reported in October 2026. It returns three signals, sorted by a Priority column. First, sign-ins by the seven ConnectWise and SkyKick application IDs from a public IP address. ConnectWise states the Cloud Backup app normally signs in from Azure private IPv6 addresses. Second, service principals that sign in from a public IP address in a country not seen in their 14-day baseline. This signal evaluates apps with at least 20 prior sign-ins. Third, Entra audit events initiated by applications. These include an application adding itself or another non-user identity to a directory role, an application adding or changing credentials for the first time in the baseline window and any credential change by an application named ConnectWise or SkyKick. Role additions with an unidentified target appear with Review priority. Audit events initiated by applications carry no source IP, so the IP indicator applies to the sign-in signals only. Routine credential changes by Azure services can still appear with Review priority. The query follows the Microsoft Defender advanced hunting schemas and runs without errors in Advanced Hunting. The audit signal was exercised against live Entra audit events in a Microsoft 365 tenant. Indicator columns are short-lived and used for enrichment only.
Audit query that finds enabled OAuth apps in Microsoft Entra ID holding permissions an attacker would want: reading or sending mail, accessing files and sites, planting credentials on other apps, assigning roles, or changing Conditional Access. App-only permissions (the app signs in as itself, with no user and no MFA) are split from delegated ones. High-privilege delegated grants are flagged only for external apps with no verified publisher, the typical consent-phishing shape. Output is one row per app with a plain-language ReviewReason, publisher, origin, admin consent, activity (Inactive 90d+ is the easiest to disable) and “(in use)” markers on permissions the app actually exercises, so a review team can decide to keep, reduce or disable.
This is an inventory of what apps can do, not a change detector. A verified publisher does not mean safe, as the ConnectWise/SkyKick credential abuse showed. Pair it with audit-log hunting for new secrets and role assignments. Requires OAuthAppInfo (app governance in Defender for Cloud Apps).
This is an inventory of what apps can do, not a change detector. A verified publisher does not mean safe, as the ConnectWise/SkyKick credential abuse showed. Pair it with audit-log hunting for new secrets and role assignments. Requires OAuthAppInfo (app governance in Defender for Cloud Apps).
Hunting query for the ConnectWise Cloud Backup (SkyKick) application credential abuse reported in October 2026. It returns three signals, sorted by a Priority column. First, sign-ins by the seven ConnectWise and SkyKick application IDs from a public IP address. ConnectWise states the Cloud Backup app normally signs in from Azure private IPv6 addresses. Second, service principals that sign in from a public IP address in a country not seen in their 14-day baseline. This signal evaluates apps with at least 20 prior sign-ins. Third, Entra audit events initiated by applications. These include an application adding itself or another non-user identity to a directory role, an application adding or changing credentials for the first time in the baseline window and any credential change by an application named ConnectWise or SkyKick. Role additions with an unidentified target appear with Review priority. Audit events initiated by applications carry no source IP, so the IP indicator applies to the sign-in signals only. Routine credential changes by Azure services can still appear with Review priority. The query follows the Microsoft Defender advanced hunting schemas and runs without errors in Advanced Hunting. The audit signal was exercised against live Entra audit events in a Microsoft 365 tenant. Indicator columns are short-lived and used for enrichment only.
Detects Microsoft Entra ID sign-ins to specific third-party applications related to Updraft (TeamUpdraft, UpdraftCentral, UpdraftVault, UpdraftClone, UpdraftPlus) with anomalous characteristics such as multi-IP access, distinct countries, or failed-then-successful access attempts, indicating possible credential compromise or misuse.
Audit query that finds enabled OAuth apps in Microsoft Entra ID holding permissions an attacker would want: reading or sending mail, accessing files and sites, planting credentials on other apps, assigning roles, or changing Conditional Access. App-only permissions (the app signs in as itself, with no user and no MFA) are split from delegated ones. High-privilege delegated grants are flagged only for external apps with no verified publisher, the typical consent-phishing shape. Output is one row per app with a plain-language ReviewReason, publisher, origin, admin consent, activity (Inactive 90d+ is the easiest to disable) and “(in use)” markers on permissions the app actually exercises, so a review team can decide to keep, reduce or disable.
This is an inventory of what apps can do, not a change detector. A verified publisher does not mean safe, as the ConnectWise/SkyKick credential abuse showed. Pair it with audit-log hunting for new secrets and role assignments. Requires OAuthAppInfo (app governance in Defender for Cloud Apps).
This is an inventory of what apps can do, not a change detector. A verified publisher does not mean safe, as the ConnectWise/SkyKick credential abuse showed. Pair it with audit-log hunting for new secrets and role assignments. Requires OAuthAppInfo (app governance in Defender for Cloud Apps).
Detects sign-ins and cloud app events associated with specific compromised vendor application IDs, application names, or a known malicious IP address across Microsoft Entra ID and CloudAppEvents logs.
Detects Entra sign-ins from infrastructure tied to the ConnectWise Cloud Backup (SkyKick) credential abuse: 144.172.64[.]128 (Huntress), plus 144.172.64[.]99 and 144.172.64[.]60 (ConnectWise advisory, Oct 18). Covers service principal sign-ins and user sign-ins, which captures the Oct 13-14 password spray. A success means a token was issued, so treat it as an incident. Failures still show targeting.
Flags service principal sign-ins by the ConnectWise/SkyKick app IDs from a public address or a Python/curl client. Per Huntress, the vendor apps normally egress from Azure private IPv6 (fd...) and call Graph with the kiota-dotnet SDK. Both conditions together are the strongest signal. This survives IP rotation. Baseline your tenant first, since a legitimate public egress would show here.
Box Shield Suspicious Location Access
Cortex XDR
Surfaces Box Shield suspicious location alerts with geographic context and accessed content details. Detects access from unusual or excluded geographic locations indicating potential compromised accounts or credential theft.
Browser sign-ins and MFA prompts with medium or high sign-in risk from devices that have no Entra device identity and are not managed or compliant. Hunting query, not an alert.
Detects the creation of application-specific passwords followed by their initial use from unknown or new IP addresses using legacy authentication clients, which may indicate account compromise or persistence establishment.
Detects a potential app-only tenant-takeover sequence associated with Storm-3119 (YAM Store), where a single service principal performs an administrative password reset, a license assignment, and a privileged role grant within a one-hour window.
Detects non-interactive service principal sign-ins originating from an IP address and location never seen for that specific principal over a prior 30-day baseline period, approximating potential misuse of stolen cloud credentials exposed via environment variables.
Detects Azure AD service principal sign-ins utilizing suspicious scripting-related user agents such as curl, python-requests, Wget, or Postman, which may indicate automated scripting, custom tooling, or potential abuse of cloud service accounts.
Detects a single application or service principal performing a password reset, a license assignment, and a privileged role grant within a one-hour window. This sequence matches Storm-3119 admin-panel abuse of a compromised tenant client secret through an app-only flow in Microsoft 365 or Entra ID.
Detects successful non-interactive sign-ins by Entra ID service principals from an IP address and location never seen in the prior 14 days, helping to identify potentially compromised application credentials used from unfamiliar locations.
Detects service principal sign-ins involving known compromised application IDs associated with the ConnectWise cloud backup and management supply-chain attack.
Detects successful Azure Active Directory (Entra ID) sign-ins using the device code flow where the originating device is neither registered nor trusted (managed or compliant), which may indicate suspicious authentication attempts or token abuse.
Detects a Slack login from a source address without prior history for that account.
A compromised Slack account gives an attacker the organisation's informal channel —
where credentials, links and internal detail are shared far more freely than in
email — and is an effective base for internal phishing.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=authentication where sourcename='SLACK' and action='LOGIN'
| groupby user, srcip, authproto, reason
A compromised Slack account gives an attacker the organisation's informal channel —
where credentials, links and internal detail are shared far more freely than in
email — and is an effective base for internal phishing.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=authentication where sourcename='SLACK' and action='LOGIN'
| groupby user, srcip, authproto, reason
Detects and monitors sign-in events for specific high-privilege or sensitive accounts, such as break-glass accounts, within Microsoft Entra ID.
Page 1 of 52