Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
132 detections
Filters
Last updated
All Time
Detection languages
78
19
19
8
4
Contributors
36
27
25
9
6
Categories
107
68
19
12
11
Platforms
105
56
36
12
4
Products / Services
59
34
29
16
9
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
CVEs
3
IDS Classtypes
2
IDS Protocols
2
Detects enumeration of Entra ID (Azure AD) users, groups, devices, and service principals using the Microsoft Graph API, specifically when performed by tools like AzureHound or Roadtx. The detection focuses on activity originating from sign-ins that bypassed MFA, potentially leveraging a hidden CA policy scope exclusion (CVE-2025-0309). The rule identifies suspicious user agents and a high volume of requests to multiple Graph API enumeration endpoints.
Detects anomalous, high-frequency account enumeration activity in cloud audit logs, specifically targeting user, group, device, and service principal listing operations. This behavior is indicative of potential reconnaissance or discovery efforts by an attacker who has compromised a user account.
Detects AzureHound or roadtx bulk enumeration of Microsoft Graph API endpoints using tokens obtained via CVE-2025-0309 CA policy bypass, characterized by high-frequency GET requests to /v1.0/users, /v1.0/groups, /v1.0/devices, /v1.0/servicePrincipals from Edge client IDs (f44b1140-bc5e-48c6-8dc0-5cf5a53c0e34 or 22098786-6e16-43cc-a27d-191a01a1e3b5) with password-only amr claim and no MFA.
Detects high-frequency enumeration of privileged roles or role assignments within Azure AD (Entra ID) by a single user or IP address within a short time window. This activity often precedes more targeted attacks aimed at compromising highly privileged identities.
Detects bulk enumeration of Microsoft Graph API endpoints (users, groups, devices, service principals) characteristic of tools like AzureHound or roadtx. The detection focuses on high-frequency GET requests originating from known Edge browser client IDs associated with CA policy bypass (CVE-2025-0309) where tokens lack MFA claims, indicating unauthorized reconnaissance in an Azure/Entra ID environment.
This rule detects enumeration of directory roles (specifically targeting privileged roles like Global Administrators) in Azure AD/Microsoft Entra ID, correlated with sign-in activity originating from IP addresses outside of defined corporate network ranges. This behavior is indicative of reconnaissance activities by an adversary who has gained initial access via a compromised identity.
Detects high-volume Microsoft Graph API and SCIM endpoint enumeration consistent with employee directory scraping, potentially by threat groups like BlackFile/Cordial Spider. This rule identifies suspicious activity based on a high count of directory queries or distinct URIs accessed within a short time frame, originating from non-Microsoft/Google/Amazon/IBM ASNs and using common scripting/API user agents.
Detects automated Microsoft Graph API requests originating from the 'axios/1.7.9' user-agent. This specific user-agent string is associated with the Payroll Pirate campaign, where threat actors (notably Storm-2755 and Storm-2657) employ scripted tools to enumerate directory information, specifically targeting HR and payroll personnel.
Detects rapid, automated enumeration of Azure AD users, groups, and directory roles via the Microsoft Graph API immediately post-compromise. This rule identifies a high volume of queries (more than 50 within a 5-minute window) originating from a single account and IP address, targeting either 'Microsoft Graph' as the application or 'SearchQueryPerformed' as the action type.
Correlates the execution of commands or Graph calls attempting to list Global Administrators or highly privileged roles within the tenant, specifically looking for 'List directory roles' actions combined with Azure AD sign-in events from non-corporate IP addresses.
Detects high-frequency enumeration of privileged roles or role assignments within Azure AD (Entra ID) by a single user or IP address within a short time window. This activity often precedes more targeted attacks aimed at compromising highly privileged identities.
Detects suspicious sequences of AWS CloudTrail API calls originating from non-console or non-service-account sources (CLI, curl, etc.). The rule flags scenarios where reconnaissance via 'GetCallerIdentity' is immediately followed by sensitive IAM modifications (CreateUser, CreateAccessKey) or privilege escalation attempts (AssumeRole), which may indicate the use of exfiltrated credentials.
Detects anomalous automated enumeration of Microsoft Graph API user objects followed by keyword-based searches for sensitive HR, finance, and payroll-related information. This pattern is characteristic of post-compromise reconnaissance activities where an attacker leverages an existing session token to identify targets for further data exfiltration.
Detects a user or application issuing a high volume of Microsoft Graph user directory requests within ten minutes, consistent with tenant reconnaissance. This rule specifically looks for GET requests to the /v1.0/users endpoint of the Microsoft Graph API, indicating an attempt to enumerate user accounts.
Detects anomalous, high-frequency account enumeration activity in cloud audit logs, specifically targeting user, group, device, and service principal listing operations. This behavior is indicative of potential reconnaissance or discovery efforts by an attacker who has compromised a user account.
Detects automated Microsoft Graph API requests indicative of the 'Payroll Pirate' campaign, specifically targeting payroll and HR personnel after initial access via AiTM session token theft. The rule identifies two malicious patterns: bulk user directory harvesting using '?$top=999' and keyword-targeted enumeration (payroll, human, compensation) using OR-chained search queries and pagination markers ($skiptoken).
Detects systematic enumeration of application registrations, owners, credentials, and permissions through Microsoft Graph. This rule identifies suspicious activity where a user or application makes a high volume of GET requests to various Microsoft Graph API endpoints related to application registrations within a short time frame (15 minutes). The specific endpoints monitored include those for listing applications, owners, password credentials, key credentials, and required resource access. A threshold of 40 requests within a 15-minute window triggers the alert, indicating potential reconnaissance or inventory collection by an adversary.
Detects bulk Azure AD group membership enumeration via Graph API
Detects CI/CD runner agents calling 'aws configure list-profiles' and connecting to a known malicious IP address (216.126.225.129), as prescribed by the Megalodon CI/CD malware.
Detects specific URI patterns used by Storm-2949 to enumerate users, indicating automated directory reconnaissance. The rule specifically looks for Microsoft Graph API calls that include both '$select=displayName,userPrincipalName,jobTitle' and '$top=50' in the RawEventData, which are indicators of user enumeration.
This rule identifies rapid, multi-category reconnaissance activity against the Microsoft Graph API. It specifically looks for bursts of 20 or more requests across 4 or more unique Graph API endpoints within a one-minute window, particularly when those requests include parameters like '$top=999', '$count=true', or target '/beta/' endpoints, which are indicative of attempts to extract maximum data or use less common API versions. This behavior is typified by threat actors like Tycoon 2FA operators.
Page 5 of 7