Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
132 detections
Filters
Last updated
All Time
Detection languages
78
19
19
8
4
Contributors
36
27
25
9
6
Categories
107
68
19
12
11
Platforms
105
56
36
12
4
Products / Services
59
34
29
16
9
MITRE Techniques
18,108
15,617
12,573
8,385
6,207
CVEs
3
IDS Classtypes
2
IDS Protocols
2
Detects anomalous, high-volume reconnaissance activity against multiple Microsoft Graph API endpoints (users, groups, roles, authentication methods, service principals, sites, and drives) by a single identity within a one-hour window. This behavior is indicative of post-compromise enumeration, often associated with threats like UNC6671/Storm-3121.
No description available.
Detects anomalous privilege reconnaissance activity where an account queries Microsoft Graph API endpoints (such as directory roles or member/transitive member lists) multiple times in a short window, which may indicate a compromised account attempting to enumerate Global or Exchange Administrator role memberships.
Detects anomalous privilege reconnaissance activity where an account queries Microsoft Graph API endpoints (such as directory roles or member/transitive member lists) multiple times in a short window, which may indicate a compromised account attempting to enumerate Global or Exchange Administrator role memberships.
Detects anomalous privilege reconnaissance activity where an account queries Microsoft Graph API endpoints (such as directory roles or member/transitive member lists) multiple times in a short window, which may indicate a compromised account attempting to enumerate Global or Exchange Administrator role memberships.
This rule detects potentially malicious, automated enumeration of Microsoft Graph API endpoints. It monitors for high volumes of requests (>= 8 within a 15-minute window) that utilize multiple OData pagination, filtering, and search parameters such as $top, $skip, $skiptoken, $count, /delta, and /search. Such activity is often indicative of automated reconnaissance, data scraping, or unauthorized bulk enumeration of cloud directory resources.
Detects anomalous, high-frequency access to multiple distinct Microsoft Graph API endpoints (e.g., users, groups, applications) by a single user within a short timeframe, which is indicative of tenant-wide reconnaissance following identity compromise.
No description available.
This rule detects potential reconnaissance activity within a Microsoft Entra ID (Azure AD) environment by monitoring Microsoft Graph API audit logs. It specifically flags accounts that exhibit high-frequency access to sensitive endpoints related to directory roles, role management, authentication methods, service principals, and application permissions. The detection triggers when an identity interacts with multiple distinct sensitive API paths within a 30-minute window, a pattern indicative of an adversary enumerating privileges, MFA configurations, or application consent settings for potential escalation or persistence.
Detects anomalous, high-frequency access to multiple distinct Microsoft Graph API endpoints (e.g., users, groups, applications) by a single user within a short timeframe, which is indicative of tenant-wide reconnaissance following identity compromise.
Detects anomalous reconnaissance activity targeting sensitive Microsoft Graph control-plane endpoints, including directory roles, MFA settings, application registrations, service principals, and OAuth consent configurations. The rule identifies high-volume access across multiple distinct sensitive endpoints within a short time frame, which is indicative of an adversary enumerating infrastructure to identify opportunities for privilege escalation, persistence, or bypass of security controls.
Detects anomalous, high-frequency access to multiple distinct Microsoft Graph API endpoints (e.g., users, groups, applications) by a single user within a short timeframe, which is indicative of tenant-wide reconnaissance following identity compromise.
Detects anomalous, systematic enumeration of multiple Microsoft Graph API resource categories (e.g., users, groups, applications, sites) by a single identity, IP, or application within a short time window. This activity often indicates an adversary performing discovery or reconnaissance against the M365 tenant environment.
No description available.
Detects anomalous GitLab project enumeration where an account performs an excessive number of requests to the Projects API using the 'membership=true' parameter within a one-hour window. This behavior is indicative of an attacker attempting to discover all accessible repositories associated with a compromised or over-privileged GitLab token.
Detects anomalous GitLab project enumeration where an account performs an excessive number of requests to the Projects API using the 'membership=true' parameter within a one-hour window. This behavior is indicative of an attacker attempting to discover all accessible repositories associated with a compromised or over-privileged GitLab token.
Detects high-frequency requests to various Microsoft Graph API endpoints, such as users, groups, applications, and mailboxes, within a short timeframe. This behavior is indicative of an adversary attempting to map out a target's cloud identity infrastructure and environment, often as a precursor to more focused attacks like phishing, data exfiltration, or lateral movement within M365.
Detects a single identity, application, or IP address performing Graph API requests across multiple disparate categories (e.g., tenant, directory, privilege, application, repository, mailbox) within a short window. This pattern is indicative of automated reconnaissance or tenant enumeration, commonly performed during the post-compromise phase to map the environment prior to exfiltration.
Detects anomalous GitLab project enumeration where an account performs an excessive number of requests to the Projects API using the 'membership=true' parameter within a one-hour window. This behavior is indicative of an attacker attempting to discover all accessible repositories associated with a compromised or over-privileged GitLab token.
Detects anomalous GitLab project enumeration where an account performs an excessive number of requests to the Projects API using the 'membership=true' parameter within a one-hour window. This behavior is indicative of an attacker attempting to discover all accessible repositories associated with a compromised or over-privileged GitLab token.
Detects anomalous GitLab project enumeration where an account performs an excessive number of requests to the Projects API using the 'membership=true' parameter within a one-hour window. This behavior is indicative of an attacker attempting to discover all accessible repositories associated with a compromised or over-privileged GitLab token.
Page 3 of 7