Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
132 detections
Filters
Last updated
All Time
Detection languages
78
19
19
8
4
Contributors
36
27
25
9
6
Categories
107
68
19
12
11
Platforms
105
56
36
12
4
Products / Services
59
34
29
16
9
MITRE Techniques
18,108
15,616
12,573
8,385
6,206
CVEs
3
IDS Classtypes
2
IDS Protocols
2
Detects a suspicious pattern often associated with Storm-3168 (JADEPUFFER) activity: prolonged, high-volume Azure resource enumeration by one service principal, followed shortly by a second service principal performing rapid, multi-subscription enumeration from the same source IP address.
Detects a suspicious pattern often associated with Storm-3168 (JADEPUFFER) activity: prolonged, high-volume Azure resource enumeration by one service principal, followed shortly by a second service principal performing rapid, multi-subscription enumeration from the same source IP address.
Detects a suspicious pattern often associated with Storm-3168 (JADEPUFFER) activity: prolonged, high-volume Azure resource enumeration by one service principal, followed shortly by a second service principal performing rapid, multi-subscription enumeration from the same source IP address.
Detects high-volume, diverse administrative and discovery activities in cloud environments, including SharePoint site enumeration, Azure AD user/identity discovery, and suspicious access to mail items via specific client applications, potentially indicating post-compromise reconnaissance or data harvesting.
Detects anomalous, high-velocity enumeration of IAM entities and cloud infrastructure resources by a single principal within a 5-minute window. This behavior is consistent with automated reconnaissance performed by agentic AI or scripted tools, often used to map cloud environments prior to exploitation.
This rule detects potentially malicious Microsoft Graph API activity, such as the enumeration of directory roles, groups, applications, or service principals. It identifies patterns indicative of token theft or unauthorized access by flagging scripted clients (non-browser agents) or accounts showing anomalous behavior (multiple IPs/agents) performing rapid or repetitive enumeration queries.
Detects anomalous, high-velocity enumeration of IAM entities and cloud infrastructure resources by a single principal within a 5-minute window. This behavior is consistent with automated reconnaissance performed by agentic AI or scripted tools, often used to map cloud environments prior to exploitation.
Detects high-privileged Entra ID accounts successfully reaching the verification stage of the Self-Service Password Reset (SSPR) process. While SSPR is automatically enabled for administrative accounts, this activity is anomalous and potentially indicates an attacker focusing on discovered privileged accounts after performing broader enumeration.
Detects anomalous, high-volume account enumeration against the Microsoft Self-Service Password Reset (SSPR) endpoint from a single source IP. The rule identifies a pattern of mixed response codes, specifically interleaving '50034' (Account does not exist) with successful or other outcomes, which indicates the use of automated tools to validate the existence of corporate accounts via response differentiation.
This rule detects potentially suspicious reconnaissance activity against the Microsoft Graph API. It monitors for high volumes of diverse requests originating from a single account within a 30-minute window, specifically targeting multiple distinct object types such as users, groups, sites, and applications. Such behavior is indicative of an adversary attempting to enumerate or map the target cloud environment.
Detects high-volume or sequential Microsoft Graph API requests targeting sensitive directory, mailbox, application, and site endpoints. This behavior is consistent with reconnaissance activity where an adversary enumerates users, groups, service principals, and accessible resources within a compromised cloud tenant.
Detects anomalous reconnaissance activity targeting sensitive Microsoft Graph control-plane endpoints, including directory roles, MFA settings, application registrations, service principals, and OAuth consent configurations. The rule identifies high-volume access across multiple distinct sensitive endpoints within a short time frame, which is indicative of an adversary enumerating infrastructure to identify opportunities for privilege escalation, persistence, or bypass of security controls.
Detects anomalous, high-volume reconnaissance activity against multiple Microsoft Graph API endpoints (users, groups, roles, authentication methods, service principals, sites, and drives) by a single identity within a one-hour window. This behavior is indicative of post-compromise enumeration, often associated with threats like UNC6671/Storm-3121.
Detects anomalous, high-volume reconnaissance activity against multiple Microsoft Graph API endpoints (users, groups, roles, authentication methods, service principals, sites, and drives) by a single identity within a one-hour window. This behavior is indicative of post-compromise enumeration, often associated with threats like UNC6671/Storm-3121.
Detects anomalous, high-frequency cloud management API requests across multiple sensitive paths (such as directory roles, applications, and service principals) from a single account. This pattern is indicative of automated enumeration or discovery of cloud infrastructure, permissions, and identity configurations, which is often a precursor to further exploitation.
Detects high-volume, multi-endpoint enumeration activity against the Microsoft Graph API, involving a high frequency of requests across sensitive tenant resources (users, groups, applications, roles, mailboxes, etc.). This behavior is consistent with post-compromise reconnaissance by an adversary attempting to map the environment.
Detects anomalous post-authentication reconnaissance activities against the Microsoft Graph API, specifically the enumeration of directory objects, roles, or service principals. The rule triggers when a user account performs multi-endpoint enumeration via the Graph API within 30 minutes of a successful authentication session initiated via a device code flow that was flagged with elevated risk signals. This behavior is consistent with post-compromise reconnaissance techniques such as 'EvilTokens', where an adversary attempts to map the environment after gaining access.
Detects anomalous post-authentication reconnaissance activities against the Microsoft Graph API, specifically the enumeration of directory objects, roles, or service principals. The rule triggers when a user account performs multi-endpoint enumeration via the Graph API within 30 minutes of a successful authentication session initiated via a device code flow that was flagged with elevated risk signals. This behavior is consistent with post-compromise reconnaissance techniques such as 'EvilTokens', where an adversary attempts to map the environment after gaining access.
Detects anomalous post-authentication reconnaissance activities against the Microsoft Graph API, specifically the enumeration of directory objects, roles, or service principals. The rule triggers when a user account performs multi-endpoint enumeration via the Graph API within 30 minutes of a successful authentication session initiated via a device code flow that was flagged with elevated risk signals. This behavior is consistent with post-compromise reconnaissance techniques such as 'EvilTokens', where an adversary attempts to map the environment after gaining access.
Detects anomalous privilege reconnaissance activity where an account queries Microsoft Graph API endpoints (such as directory roles or member/transitive member lists) multiple times in a short window, which may indicate a compromised account attempting to enumerate Global or Exchange Administrator role memberships.
This rule detects potential reconnaissance activity against Microsoft Graph API endpoints, indicative of an adversary enumerating tenant resources such as users, groups, applications, and directory roles. It monitors for high volumes of diverse Graph API queries originating from a single user or application identity within a short time window, which is a common behavior pattern for automated discovery tools.
Page 2 of 7