Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
215 detections
Filters
Last updated
All Time
Detection languages
113
32
28
17
12
Contributors
91
25
13
11
10
Categories
98
88
73
55
48
Platforms
163
83
54
18
5
Products / Services
112
95
59
34
17
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
7
3
2
IDS Classtypes
1
IDS Protocols
1
This rule detects successful administrative actions related to the creation, deletion, or modification of Azure Management Groups, Subscriptions, and resources within them. Such actions can indicate unauthorized structural changes to the environment, potential privilege escalation, or attempts to modify tenant-level governance.
This rule detects successful administrative actions related to the creation, deletion, or modification of Azure Management Groups, Subscriptions, and resources within them. Such actions can indicate unauthorized structural changes to the environment, potential privilege escalation, or attempts to modify tenant-level governance.
Correlates a successful AAD sign-in from a new IP address immediately followed by the registration of a new FIDO2 or Authenticator device, a hallmark of AiTM persistence.
Detects the Kali365 framework automatically establishing mailbox rules to delete or hide security alerts, finance emails, or replies from the phished user. The rule specifically looks for the creation or modification of inbox rules that involve actions like 'MoveToFolder', 'DeleteMessage', or 'MarkAsRead' and are applied to emails containing keywords such as 'phish', 'security', 'alert', 'finance', or 'invoice'.
Identifies Azure Active Directory (AAD) logins from new or unusual locations followed immediately by the creation of inbox rules designed to delete incoming emails. This behavior is indicative of an attacker gaining access to an email account and attempting to disrupt communication or hide their activities by automatically deleting legitimate emails.
Detects device registration attempts mapping a refresh token to the Device Registration Service (ms-drs) for persistence. This activity can be indicative of an adversary attempting to maintain access or bypass conditional access policies by registering a new device.
Identifies device registration events where the user agent indicates script or automated frameworks (like axios, node, undici, node-fetch) rather than native registration clients. This behavior is associated with adversaries like Tycoon 2FA, which establishes device-bound persistence (PRT) that survives standard session revocation, making this a critical post-compromise detection.
This rule detects suspicious activity related to Azure AD device registration. It identifies instances where a single user principal name (UPN) performs 5 or more device registrations or adds members to groups within a one-hour window, specifically targeting device resources. This could indicate an adversary attempting to register multiple devices to bypass conditional access policies or gain persistent access.
This rule detects suspicious device registration operations in a tenant by identifying device names that match known automated device code phishing kit patterns. Specifically, it looks for device names that are in the format of 'DESKTOP-' followed by 6 to 8 hexadecimal characters, which deviates from typical Windows default naming conventions. This pattern is often used by attackers to register devices for persistence or to bypass MFA.
This rule detects suspicious activity related to Azure AD device registration. It identifies instances where a single user principal name (UPN) performs 5 or more device registrations or adds members to groups within a one-hour window, specifically targeting device resources. This could indicate an adversary attempting to register multiple devices to bypass conditional access policies or gain persistent access.
This rule detects attempts to register a new device for MFA bypass persistence by monitoring HTTP POST requests to graph.microsoft.com with a URI containing 'authentication/methods'. This activity could indicate an attacker attempting to register their own device as a trusted device to bypass multi-factor authentication in an Office 365 environment.
This rule detects suspicious device enrollment attempts via Microsoft Intune Company Portal from a country not previously observed in a user's 7-day sign-in history. It identifies two primary patterns: sustained successful sign-ins from a new country, indicating a potential active session and successful device enrollment (High Severity), or Conditional Access Policy (CAP) blocked attempts from a new country, suggesting an attacker probing with stolen credentials (Medium Severity). The detection aims to identify identity theft leading to unauthorized device enrollment.
This rule detects suspicious device enrollment attempts via Microsoft Intune Company Portal from a country not previously observed in a user's 7-day sign-in history. It identifies two primary patterns: sustained successful sign-ins from a new country, indicating a potential active session and successful device enrollment (High Severity), or Conditional Access Policy (CAP) blocked attempts from a new country, suggesting an attacker probing with stolen credentials (Medium Severity). The detection aims to identify identity theft leading to unauthorized device enrollment.
This rule detects suspicious device enrollment attempts via Microsoft Intune Company Portal from a country not previously observed in a user's 7-day sign-in history. It identifies two primary patterns: sustained successful sign-ins from a new country, indicating a potential active session and successful device enrollment (High Severity), or Conditional Access Policy (CAP) blocked attempts from a new country, suggesting an attacker probing with stolen credentials (Medium Severity). The detection aims to identify identity theft leading to unauthorized device enrollment.
This rule detects two related scenarios: 1. Device Code Phishing: Correlates successful device code authentications with subsequent device registrations for the same user within a short time frame. This can indicate an attacker using a phished device code to register a new device. 2. Primary Refresh Token (PRT) Device Registration: Identifies device registrations that occur after an authentication to the Device Registration Service using a Primary Refresh Token. This pattern is indicative of an attacker minting a PRT and then using it to register or join a device, potentially bypassing conditional access policies.
This rule detects suspicious device registration activity in Microsoft 365. It correlates users who have recently visited Microsoft device login or OAuth2 device authentication URLs with subsequent device registration events in Azure AD. This could indicate an adversary attempting to register a new device to bypass MFA or gain persistent access, potentially through device code phishing.
This rule detects successful device registrations to the 'Device Registration Service' in Azure Entra. It specifically looks for sign-in events where the ResourceDisplayName is 'Device Registration Service', the ErrorCode is '0' (indicating success), and the ConditionalAccessStatus is not '1' (which typically means that conditional access did not block the authentication flow for device registration). The rule is pivotal for hunting devices registered for persistence, post-successful phishing campaign execution, where >= 1 accounts were compromised.
Detects mass device wipe, retire, or delete operations performed via Microsoft Intune, inspired by the Stryker/Handala attack. This rule combines five detection signals: static velocity threshold, bulk destructive actions from a single operator, first-time operator detection, UEBA anomaly correlation, and ML anomaly detection. Operations are categorized into Tier 1 (critical, zero baseline activity like wipe/retire) and Tier 2 (high, legitimate IT ops activity like device delete, subject to velocity and ML thresholds). Severity escalates based on the number of overlapping signals.
This rule detects suspicious activity where a new device is registered after a user browse or click on a Microsoft device login page. This could indicate an adversary attempting to register a new device to bypass multi-factor authentication or establish persistence.
This rule detects network connection events and Entra ID sign-in events originating from Iran. It aggregates these events hourly to identify potential suspicious activity from a geo-restricted or high-risk country.
Detects successful Entra ID sign-ins that exhibit characteristics of an Adversary-in-the-Middle (AiTM) session cookie hijack.
This activity is often associated with AiTM phishing kits like Tycoon2FA, where attackers replay stolen session cookies from unmanaged devices to bypass MFA.
This activity is often associated with AiTM phishing kits like Tycoon2FA, where attackers replay stolen session cookies from unmanaged devices to bypass MFA.
Page 8 of 11