Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
57 detections
Filters
Last updated
All Time
Detection languages
24
11
7
5
5
Contributors
24
10
5
3
3
Categories
30
24
13
12
9
Platforms
26
23
15
7
7
Products / Services
22
13
11
5
5
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
4
1
IDS Protocols
4
1
Detects Microsoft 365 activity (Exchange and SharePoint) initiated by known compromised service principal UUIDs associated with the ConnectWise supply-chain attack.
Detects high-volume Microsoft Graph API activity using attacker-associated user agents, such as python-requests, curl, or httpx, which may indicate automated token sweeping or data collection associated with supply-chain attacks.
Detects service principal sign-ins involving known compromised application IDs associated with the ConnectWise cloud backup and management supply-chain attack.
Detects an account joining the workspace. Slack Connect and guest access let outside
identities into an internal communication space, and an unexpected join is how an
attacker gains a listening position without touching the network perimeter at all.
Check the account type: a guest or external identity joining a channel carrying
operational or security discussion is worth immediate confirmation with the inviter.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=iam where sourcename='SLACK' and action='USER_JOINED_WORKSPACE'
| groupby user, targetuser, accounttype, workspace
identities into an internal communication space, and an unexpected join is how an
attacker gains a listening position without touching the network perimeter at all.
Check the account type: a guest or external identity joining a channel carrying
operational or security discussion is worth immediate confirmation with the inviter.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=iam where sourcename='SLACK' and action='USER_JOINED_WORKSPACE'
| groupby user, targetuser, accounttype, workspace
Detects a user being invited into an Atlassian site. Invitation is the lowest-friction
route into a documentation estate: no exploit, no credential theft, simply an account
added by someone with the rights to do so.
Compare the invited domain against the organisation's own; an external domain
invitation outside a known partner arrangement warrants confirmation.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ATLASSIAN'
and action in ('USER_INVITED', 'USER_REINVITED')
| groupby user, targetuser, domain, sitename
route into a documentation estate: no exploit, no credential theft, simply an account
added by someone with the rights to do so.
Compare the invited domain against the organisation's own; an external domain
invitation outside a known partner arrangement warrants confirmation.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ATLASSIAN'
and action in ('USER_INVITED', 'USER_REINVITED')
| groupby user, targetuser, domain, sitename
Detects an invitation into a GitHub organisation. Membership confers access to
private source and, depending on role, the ability to alter it. An unexpected
invitation is a supply chain risk: the attacker does not need to breach anything if
somebody adds them to the organisation.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=iam where sourcename='GITHUB' and action='MEMBER_INVITED'
| groupby target, role, organisationid, accesstype
private source and, depending on role, the ability to alter it. An unexpected
invitation is a supply chain risk: the attacker does not need to breach anything if
somebody adds them to the organisation.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=iam where sourcename='GITHUB' and action='MEMBER_INVITED'
| groupby target, role, organisationid, accesstype
Detects modifications to Microsoft Entra ID (formerly Azure AD) cross-tenant access settings where a new partner is added or inbound trust settings (such as MFA or device compliance) are enabled for an external tenant. This activity may indicate an attempt to establish a persistent backdoor or facilitate initial access into the environment via a compromised or malicious external identity provider.
Detects the creation or modification of Granular Delegated Administrative Privileges (GDAP) relationships, or the assignment of highly privileged (Tier 0) roles, when performed by an application identified as a partner provider or via delegated administration. This rule monitors for potential abuse of trusted partner relationships to escalate privileges or establish persistence within a tenant.
Detects instances where an administrative user grants 'AllPrincipals' OAuth consent to a multi-tenant application that is unverified or lacks a trusted publisher. This behavior is indicative of an attacker tricking a global admin into granting broad permissions (e.g., Mail.Read, Files.ReadWrite.All) to a malicious application, bypassing per-user consent restrictions.
Detects modifications to Microsoft Entra ID (formerly Azure AD) cross-tenant access settings where a new partner is added or inbound trust settings (such as MFA or device compliance) are enabled for an external tenant. This activity may indicate an attempt to establish a persistent backdoor or facilitate initial access into the environment via a compromised or malicious external identity provider.
Detects the suspicious sequence of adding a domain or changing federation settings followed rapidly by a configuration update to the federated domain. This pattern is indicative of an adversary establishing a covert federated backdoor for persistent, delegated authentication, allowing bypass of standard credential rotation mechanisms.
Detects modifications to Microsoft Entra ID (formerly Azure AD) cross-tenant access policies or B2B synchronization settings. Specifically, this rule monitors for the addition of new external partner tenants to trust lists or the relaxation of security controls such as MFA and compliant device requirements for external partner access.
This rule detects the addition of a new domain or the modification of federation settings within an Office 365/Azure Active Directory environment. It specifically monitors for operations such as 'Add domain to company', 'Add unverified domain', and 'Set federation settings on domain'. The rule filters against a known list of federated domains to identify new or unexpected federation configurations, which could indicate an adversary attempting to establish persistence or facilitate privilege escalation through trust modification.
Detects successful OAuth token grant events for specific third-party SaaS integrations (Salesloft, Drift, Gainsight) where requested scopes include broad permissions such as 'api', 'refresh_token', or 'full'. This pattern is indicative of potential consent phishing or the abuse of a compromised OAuth application to maintain persistent, high-privileged access to SaaS resources.
Detects anomalous remote access patterns on a single endpoint, specifically involving AnyDesk or TeamViewer sessions originating from multiple distinct geographical locations combined with usage by multiple distinct user accounts. This pattern is consistent with DPRK IT worker fraud (Wagemole) involving shared laptop farms.
Detects instances where an administrative user grants 'AllPrincipals' OAuth consent to a multi-tenant application that is unverified or lacks a trusted publisher. This behavior is indicative of an attacker tricking a global admin into granting broad permissions (e.g., Mail.Read, Files.ReadWrite.All) to a malicious application, bypassing per-user consent restrictions.
Detects the configuration of cross-tenant access trust policies or cross-tenant synchronization settings within an Azure tenant, specifically where inbound trust for MFA or device compliance/hybrid-join claims is explicitly enabled. This activity may indicate an adversary attempting to establish persistence or facilitate lateral movement by leveraging trusted relationships between partner organizations.
Detects modifications to Microsoft Entra ID (formerly Azure AD) cross-tenant access settings. This rule alerts on changes that allow external tenants to interact with the environment, such as enabling inbound/outbound trusts, automatic redemption, or trusting MFA claims, which can be leveraged to establish persistence or facilitate lateral movement between tenants.
Detects modifications to Microsoft Entra ID (formerly Azure AD) cross-tenant access settings. This rule alerts on changes that allow external tenants to interact with the environment, such as enabling inbound/outbound trusts, automatic redemption, or trusting MFA claims, which can be leveraged to establish persistence or facilitate lateral movement between tenants.
Detects modifications to Microsoft Entra ID (formerly Azure AD) cross-tenant access settings. This rule alerts on changes that allow external tenants to interact with the environment, such as enabling inbound/outbound trusts, automatic redemption, or trusting MFA claims, which can be leveraged to establish persistence or facilitate lateral movement between tenants.
Detects modifications to Microsoft Entra ID (formerly Azure AD) cross-tenant access settings. This rule alerts on changes that allow external tenants to interact with the environment, such as enabling inbound/outbound trusts, automatic redemption, or trusting MFA claims, which can be leveraged to establish persistence or facilitate lateral movement between tenants.
Page 1 of 3