Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,088 detections
Filters
Last updated
All Time
Detection languages
619
191
113
86
47
Contributors
302
211
112
88
54
Categories
481
416
353
192
164
Platforms
726
348
216
136
57
Products / Services
518
292
197
124
88
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,088
CVEs
5
5
5
5
4
IDS Classtypes
3
2
1
1
IDS Protocols
3
Detects Entra ID guest (B2B) users performing a sign-in from a previously unseen IP address or country (observed over the last 30 days), followed within a 4-hour window by sensitive file operations in SharePoint, OneDrive, or Teams (e.g., file downloads, exports, or sensitivity label changes). This pattern is indicative of potential account takeover or unauthorized access to sensitive corporate data.
This rule identifies potential account compromise by detecting successful logins to at least two different SaaS applications monitored by Microsoft Cloud App Security (MCAS) within a 2-hour window, originating from geolocations separated by more than 500 kilometers. This behavior is indicative of credential sharing or account hijacking where an adversary accesses multiple cloud services rapidly from geographically distant locations.
Detects a sequence of events where an actor deletes a Google Cloud Storage bucket and then immediately recreates it, a pattern consistent with bucket hijacking intended to manipulate resource access or bypass security controls on data streams.
Detects successful sign-ins by accounts that appear to be Azure AD Connect synchronization service accounts (e.g., 'MSOL_', 'Sync_', 'AADConnect') but are not initiating from the expected Microsoft Azure Active Directory Connect application. This may indicate an adversary attempting to use these highly privileged service accounts for unauthorized access or lateral movement.
Detects successful sign-ins by accounts that appear to be Azure AD Connect synchronization service accounts (e.g., 'MSOL_', 'Sync_', 'AADConnect') but are not initiating from the expected Microsoft Azure Active Directory Connect application. This may indicate an adversary attempting to use these highly privileged service accounts for unauthorized access or lateral movement.
Detects successful authentications where a Temporary Access Pass (TAP) was used as the primary authentication method. TAPs bypass standard password and MFA requirements, and their usage outside of expected scenarios (like onboarding or account recovery) could indicate an adversary bypassing authentication mechanisms.
Detects modifications or publication of Azure Automation runbooks by users or service principals other than known, pre-approved automation service principals. This activity may indicate an unauthorized user or compromised service principal attempting to inject malicious code into automation workflows.
This rule detects successful administrative actions related to the creation, deletion, or modification of Azure Management Groups, Subscriptions, and resources within them. Such actions can indicate unauthorized structural changes to the environment, potential privilege escalation, or attempts to modify tenant-level governance.
This rule detects successful administrative actions related to the creation, deletion, or modification of Azure Management Groups, Subscriptions, and resources within them. Such actions can indicate unauthorized structural changes to the environment, potential privilege escalation, or attempts to modify tenant-level governance.
Detects a browser session that contacts an EvilTokens Device Code phishing endpoint (/api/device/status/) and then immediately navigates to onedrive.live.com, indicating the attacker backend returned status:completed and the kit executed window.location.replace to redirect the victim to OneDrive after token capture. This sequence suggests a successful device code phishing attack where the victim's credentials or tokens have been captured, and they are then redirected to a legitimate service to avoid suspicion.
Detects access to App Service Kudu deployment or command endpoints by an identity not normally associated with deployment operations.
Detects access to Azure App Service Kudu deployment or command endpoints by an identity not normally associated with deployment operations. This could indicate an attacker using compromised credentials to interact with the application's underlying infrastructure.
Detects rapid non-interactive sign-ins utilizing refresh tokens from known VPS hosting providers. This rule identifies a high volume of successful non-interactive sign-ins (more than 20 within a 10-minute window) from a single user and IP address, indicating potential abuse of refresh tokens, possibly from a compromised cloud VPS.
This rule detects potential automated credential stuffing attempts followed by successful authentication and subsequent access to sensitive/privileged APIs within Azure/Entra ID environments. It correlates multiple failed login attempts for service-oriented account names (e.g., svc, api, bot) with a successful login from the same user shortly thereafter, followed by privileged API operations (e.g., KeyVault secret access, user management) within a short time window.
Identifies successful device code authentication flows where the client application is masquerading as a Microsoft Office client. This technique is commonly used by Phishing-as-a-Service (PhaaS) kits like EvilTokens for account takeover, by tricking users into authenticating a malicious application through a device code flow.
Detects authentication events originating from Microsoft Authentication Broker or OfficeHome using Node.js associated user agents, which are indicative of the Tycoon 2FA kit relay infrastructure. This activity suggests an Adversary-in-the-Middle (AiTM) attack attempting to bypass multi-factor authentication.
Monitors for device code authentication via uncommon Family of Client IDs (FOCI) applications. This rule identifies successful device code authentications where the application ID (AppId) has been observed fewer than 5 times, indicating potentially rare or newly introduced applications. This could be indicative of an adversary attempting to use a malicious application for device code phishing.
Detects bursts of Google Workspace device registrations for a single user in a short window, specifically when 3 or more devices are registered within a 1-minute interval for the same account.
Detects hard deletion of mailbox data to remove forensic email evidence
Detects hard deletion of mailbox data to remove forensic email evidence
Detects access to the Intune admin portal from devices that are not marked as compliant or lack a device ID. This may indicate potential credential theft, session replay from unmanaged infrastructure, or AiTM phishing proxies bypassing basic MFA.
Page 35 of 52