Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,088 detections
Filters
Last updated
All Time
Detection languages
619
191
113
86
47
Contributors
302
211
112
88
54
Categories
481
416
353
192
164
Platforms
726
348
216
136
57
Products / Services
518
292
197
124
88
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,088
CVEs
5
5
5
5
4
IDS Classtypes
3
2
1
1
IDS Protocols
3
Detects which privileged users have signed in recently, how often, from how many IPs/apps, what authentication methods they used, and whether any password-only sign-ins occurred?
Detects when the administrative user is enabled for an Azure Container Registry (ACR). Enabling this account provides a static username and password, which may bypass more secure authentication methods like Azure Active Directory-based access and increase the risk of credential exposure.
This rule detects potential OAuth Device Code Flow phishing attacks where users are directed to malicious lure pages on romnor[.]ca to enter a Microsoft device code. It also alerts on authentication activity associated with a specific malicious OAuth client ID (d3590ed6-52b3-4102-aeff-aad2292ab01c) known to be used by a phishing backend to poll and claim OAuth tokens.
Detects 'docker login' commands targeting an Azure Container Registry (.azurecr.io) that explicitly include username and password flags in the command line string. This behavior may indicate credential usage for registry authentication.
Detects when the administrative user account for an Azure Container Registry (ACR) is enabled. Enabling the admin user creates a static username and password for registry access, which may bypass modern identity-based access controls like Microsoft Entra ID (formerly Azure AD) and increase the risk of credential-based attacks.
Detects anomalous, automated data exfiltration cycles in Microsoft 365 environments consistent with the Helix threat group. The rule identifies a pattern of successful sign-ins followed within 6 hours by new MFA registration, suspicious SharePoint enumeration, and a high-frequency, non-human-paced burst of file downloads.
This rule serves as an investigation framework for Microsoft Entra ID sign-in events. It enables security analysts to filter, normalize, and inspect user authentication activities, including sign-in types (interactive/non-interactive), device management status, user risk levels, and conditional access status. The query is designed for incident response and forensic analysis rather than automated alerting.
Detects outbound network connections to identified infrastructure associated with 'Pink' (CL-CRI-1147) passkey-enrollment vishing campaigns. These operators use phone-based social engineering to direct victims to phishing domains that relay credentials and MFA tokens in real-time to register attacker-controlled passkeys. The rule monitors for specific DNS query patterns containing passkey-related keywords and known malicious IP addresses used by the threat group.
Detects a sign-in failure with error code 50199 (indicating a device-code interrupt/waiting state) followed immediately by a successful sign-in from the same source IP address. This pattern is characteristic of device-code phishing attacks, where an attacker intercepts a device code and completes the authentication process on behalf of the victim.
This rule detects authentication attempts in Azure AD Sign-in Logs where the User Agent identifies the request as originating from the Python Requests library (version 2.32.3). This pattern is often indicative of Resource Owner Password Credentials (ROPC) flows, which are frequently abused by threat actors to perform credential stuffing or automated authentication bypassing multi-factor authentication (MFA) requirements in cloud environments.
Detects the creation or modification of tokens for an Azure Container Registry (ACR). This activity may indicate an administrator managing registry access, or an adversary creating long-lived credentials for persistence within the container environment.
Detects Azure CLI operations creating or modifying an Azure Container Registry (ACR) Task with an attached managed identity, where the task definition references Key Vault secrets. This pattern is used to abuse ACR Task automation and its managed identity to exfiltrate Key Vault secrets.
Detects the use of 'docker login' commands targeting an Azure Container Registry (.azurecr.io) that include a password passed as a plaintext argument via the '-p' or '--password' flags. This practice exposes credentials in process command-line arguments, which may be visible to other users on the system or logged by security tools.
Detects modifications to enable the admin account for an Azure Container Registry (ACR), or queries to check the status of this setting. Enabling the admin account provides a static username/password combination that can be used for authentication, which may represent an security risk or account manipulation if not authorized.
Detects an authentication event using the OAuth 2.0 Device Code grant flow, immediately followed by rapid access to multiple high-value cloud resources. This pattern is characteristic of consent phishing or device code phishing, where an adversary tricks a user into authorizing a malicious application, subsequently using that application's access token to programmatically enumerate or exfiltrate data from various services.
This rule detects successful sign-in events originating from IP addresses that have previously demonstrated a password-spraying pattern (multiple failed sign-ins across distinct accounts within a two-hour window). To reduce noise, it excludes successful logins originating from 'known' Autonomous System Numbers (ASNs) where at least 10 distinct users have historically authenticated successfully. The detection further filters for sessions lacking managed device identifiers and allows for manual exclusion of specific applications, IP addresses, or geographic locations.
Detects Entra ID users with active medium-to-high identity risk events who perform Microsoft Copilot actions in cloud applications while simultaneously exhibiting impossible travel indicators — successful sign-ins from multiple geographic locations using unmanaged (non-registered) devices within a one-hour window. This triple-signal correlation (identity risk + impossible travel on unmanaged device + Copilot usage) is a strong indicator of account compromise where an adversary has taken over a legitimate identity and is leveraging AI-powered tools to accelerate reconnaissance, data access, or exfiltration against Microsoft 365 resources.
Detects successful authentication events in Azure SigninLogs that utilize the Device Code OAuth flow. Attackers may leverage this flow in phishing campaigns or to bypass MFA by tricking users into authorizing malicious devices, which can lead to subsequent token theft.
Detects failed authentication attempts using the BAV2ROPC user agent (Azure CLI / legacy OAuth2 ROPC token requests) in Microsoft 365 Unified Audit Logs. BAV2ROPC bypasses MFA by authenticating directly to the /token endpoint. Error codes 50053 (account lockout), 50126 (invalid credentials), and 50034 (user not found) are characteristic of password spraying activity. Observed in the LSHIY LLC password spray campaign (June 2026).
This rule detects successful Azure AD sign-in events (ResultType 0) that occur following a series of repeated failed sign-in attempts (ResultType 50126) from the same user account. The activity is specifically scoped to the LSHIY IPv6 address range and utilizes Azure CLI or similar mobile/desktop client applications, which is a strong indicator of an automated password spraying or credential stuffing attack followed by a successful compromise.
Detects non-interactive sign-ins to Azure CLI using the 'python-requests' User-Agent by non-administrative users. This pattern is associated with the LSHIY password spray campaign, which exploits the OAuth ROPC flow for credential abuse against Microsoft 365.
Page 30 of 52