Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,088 detections
Filters
Last updated
All Time
Detection languages
619
191
113
86
47
Contributors
302
211
112
88
54
Categories
481
416
353
192
164
Platforms
726
348
216
136
57
Products / Services
518
292
197
124
88
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,088
CVEs
5
5
5
5
4
IDS Classtypes
3
2
1
1
IDS Protocols
3
Detects the creation of a new Global Administrator or Company Administrator account in Microsoft Entra ID (formerly Azure Active Directory). Adversaries may escalate privileges from compromised MDM administration roles (like Intune) to Entra ID Global Admin to cement full control over the tenant.
Detects when the same SessionId is used to sign in from more than one location across interactive and non-interactive sign-ins.
The detection looks for Entra ID sign-in events where both the source country and user agent string are new for the authenticating account(e.g., neither value has been seen during the 14-day training window (days 14–2 prior to now)). This can be changed easily in the let variable
The double signal requirement is intentional. A new country alone is relatively common (VPN usage, business travel, Microsoft service IPs), and a new user agent alone is low signal (browser updates, new devices). Requiring both to be new on the same sign-in increases fidelity, while still capturing the pattern typically associated with credential compromise or account takeover.
Sign-in events are collapsed to a single row per user per country, with EventStartTime and EventEndTime showing the first and last sign-in seen within the defined detection window.
A dynamic risk score is applied on top of the core detection to drive alert severity so you can set noise for your environment to 'informational' and reduce SOC alert fatigue.
Set the `HighRiskCountries` array to suit your risk profile
The double signal requirement is intentional. A new country alone is relatively common (VPN usage, business travel, Microsoft service IPs), and a new user agent alone is low signal (browser updates, new devices). Requiring both to be new on the same sign-in increases fidelity, while still capturing the pattern typically associated with credential compromise or account takeover.
Sign-in events are collapsed to a single row per user per country, with EventStartTime and EventEndTime showing the first and last sign-in seen within the defined detection window.
A dynamic risk score is applied on top of the core detection to drive alert severity so you can set noise for your environment to 'informational' and reduce SOC alert fatigue.
Set the `HighRiskCountries` array to suit your risk profile
Flags Intune assignments to “All Devices” or “All Users,” which attackers may abuse for mass deployment.
This rule detects a high volume of successful sign-in attempts to Exchange Online from a single IP address where the UserPrincipalName ends with '@' (indicating an anonymous or malformed UPN) and Conditional Access was not applied. This pattern can be indicative of anonymous SMTP relay abuse, often used for spamming or phishing campaigns.
Detects creation of Intune device management scripts, a potential privilege abuse vector.
Detects suspicious Azure PIM role activation requests for temporary elevated access
Detects creation of Intune device management scripts, a potential privilege abuse vector.
Detects modification of hybrid identity federation configuration for authentication bypass
This rule detects a high volume of successful sign-in attempts to Exchange Online from a single IP address where the UserPrincipalName ends with '@' (indicating an anonymous or malformed UPN) and Conditional Access was not applied. This pattern can be indicative of anonymous SMTP relay abuse, often used for spamming or phishing campaigns.
Identifies a risky sign-in to a known O365 landing page followed shortly by the creation of an inbox rule that deletes messages or moves them to junk/trash. This pattern frequently indicates account compromise (e.g., BEC or AiTM) attempting to hide malicious activity.
This rule detects suspicious Azure AD sign-in activity where a user successfully signs in from multiple unusual cities within a 24-hour period. It specifically looks for sign-ins that are not from a trusted network and are not from a compliant device, aggregating successful sign-ins by UserPrincipalName and IpAddress, and flagging if there are 5 or more distinct cities.
Detects named pipe activity with remote access enabled, initiated by JsonVMAccessExtension.exe running as SYSTEM. This may indicate abuse of the Azure VM Access Extension for unauthorized remote access.
Detects successful Microsoft Entra ID sign-ins where the user agent indicates a Node.js-based HTTP client (e.g., node, axios, undici, node-fetch). Tycoon 2FA and other AiTM phishing kits heavily leverage these backend automated tools for token relay and renewal immediately following MFA interception.
Detects named pipe activity with remote access enabled, initiated by JsonVMAccessExtension.exe running as SYSTEM. This may indicate abuse of the Azure VM Access Extension for unauthorized remote access.
This rule detects potential credential abuse of service principals or applications by identifying an unusual number of activities from a single service principal or application across multiple distinct IP addresses within a one-hour window. It specifically monitors sign-in logs for applications like 'Azure CLI', 'GitHub', or 'CustomApp' where the user type is 'ServicePrincipal' or 'Application'. A threshold of more than 10 activities and more than 2 distinct IP addresses within an hour triggers an alert.
This rule detects a suspicious sequence of events in Okta that could indicate a help-desk social engineering attack or account takeover. Specifically, it looks for a user's password being reset, followed by the enrollment of a new MFA factor or device for that same user, all occurring within a short time frame (1 hour) and potentially from distinct session IDs or device hashes. This pattern suggests an attacker has gained initial access (e.g., via social engineering the help desk) and is immediately attempting to establish persistence by enrolling their own MFA device.
This rule detects suspicious device enrollment attempts via Microsoft Intune Company Portal from a country not previously observed in a user's 7-day sign-in history. It identifies two primary patterns: sustained successful sign-ins from a new country, indicating a potential active session and successful device enrollment (High Severity), or Conditional Access Policy (CAP) blocked attempts from a new country, suggesting an attacker probing with stolen credentials (Medium Severity). The detection aims to identify identity theft leading to unauthorized device enrollment.
This rule detects suspicious Azure AD sign-in activity where a user successfully signs in from multiple unusual cities within a 24-hour period. It specifically looks for sign-ins that are not from a trusted network and are not from a compliant device, aggregating successful sign-ins by UserPrincipalName and IpAddress, and flagging if there are 5 or more distinct cities.
This rule detects the creation of new service principals or the assignment of new role assignments to existing service principals in Azure Active Directory. It specifically looks for assignments that grant high-privilege roles such as "Contributor", "Owner", or "Global Admin". The rule aggregates these changes by target and time, highlighting instances where multiple changes or distinct initiators are involved.
This rule detects potential credential abuse of service principals or applications by identifying an unusual number of activities from a single service principal or application across multiple distinct IP addresses within a one-hour window. It specifically monitors sign-in logs for applications like 'Azure CLI', 'GitHub', or 'CustomApp' where the user type is 'ServicePrincipal' or 'Application'. A threshold of more than 10 activities and more than 2 distinct IP addresses within an hour triggers an alert.
Page 36 of 52