Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
158 detections
Filters
Last updated
All Time
Detection languages
86
29
20
11
4
Contributors
36
20
17
16
15
Categories
128
67
12
11
11
Platforms
106
46
35
27
10
Products / Services
57
39
28
19
16
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
3
IDS Classtypes
1
IDS Protocols
1
Detects high-volume, multi-endpoint enumeration activity against the Microsoft Graph API, involving a high frequency of requests across sensitive tenant resources (users, groups, applications, roles, mailboxes, etc.). This behavior is consistent with post-compromise reconnaissance by an adversary attempting to map the environment.
Detects a specific credential-harvesting sequence associated with the RatHat malware. This behavior involves an initial malicious overlay drawn over a targeted application to harvest credentials, followed by a secondary fake 'install failed' overlay masquerading as Google Play within a short timeframe (1 hour), occurring when a user attempts to uninstall the malicious application.
This rule detects potential reconnaissance activity against Microsoft Graph API endpoints, indicative of an adversary enumerating tenant resources such as users, groups, applications, and directory roles. It monitors for high volumes of diverse Graph API queries originating from a single user or application identity within a short time window, which is a common behavior pattern for automated discovery tools.
Detects individual access events to sensitive Microsoft Graph control-plane endpoints, including directory roles, role management, authentication methods, applications, service principals, and OAuth permissions. This rule is designed to be paired with a broader correlation rule to identify potential reconnaissance or persistence activities involving high-privilege configuration changes.
Detects sign-in activity to the 'Office Home' portal from an unmanaged, non-compliant device, followed by authentication to sensitive cloud services like SharePoint Online, OneDrive, or Microsoft Graph. This pattern often indicates a potential session hijacking or post-compromise activity where an attacker uses an unmanaged device to access enterprise data via cloud application discovery.
This rule detects potential cloud service enumeration activity originating from a specific, potentially malicious IP address (23.234.84.102). It flags instances where this source IP performs specific API calls ('GetCallerIdentity' and 'ListTopics') without expected user-agent strings typical of legitimate AWS service traffic.
This rule detects potential cloud service enumeration activity originating from a specific, potentially malicious IP address (23.234.84.102). It flags instances where this source IP performs specific API calls ('GetCallerIdentity' and 'ListTopics') without expected user-agent strings typical of legitimate AWS service traffic.
This rule detects potential cloud service enumeration activity originating from a specific, potentially malicious IP address (23.234.84.102). It flags instances where this source IP performs specific API calls ('GetCallerIdentity' and 'ListTopics') without expected user-agent strings typical of legitimate AWS service traffic.
Detects multiple AWS API calls (Publish, GetCallerIdentity, ListTopics) originating from a specific IP address (23.234.84.102) associated with a Zapier SNS sender. This rule monitors for potentially unauthorized or anomalous API usage patterns by identifying repeated, successful, and non-error events from a known source that may indicate misuse or compromise of an integration account.
Detects multiple AWS API calls (Publish, GetCallerIdentity, ListTopics) originating from a specific IP address (23.234.84.102) associated with a Zapier SNS sender. This rule monitors for potentially unauthorized or anomalous API usage patterns by identifying repeated, successful, and non-error events from a known source that may indicate misuse or compromise of an integration account.
Detects multiple AWS API calls (Publish, GetCallerIdentity, ListTopics) originating from a specific IP address (23.234.84.102) associated with a Zapier SNS sender. This rule monitors for potentially unauthorized or anomalous API usage patterns by identifying repeated, successful, and non-error events from a known source that may indicate misuse or compromise of an integration account.
Detects multiple AWS API calls (Publish, GetCallerIdentity, ListTopics) originating from a specific IP address (23.234.84.102) associated with a Zapier SNS sender. This rule monitors for potentially unauthorized or anomalous API usage patterns by identifying repeated, successful, and non-error events from a known source that may indicate misuse or compromise of an integration account.
This rule detects anomalous interaction with the Microsoft Graph API by monitoring for high-frequency requests across multiple functional categories (e.g., tenant, directory, privilege, application, repository, mailbox) from a single identity. A large number of distinct API paths across multiple categories in a short time frame is indicative of an attacker performing reconnaissance or automated environment enumeration.
This rule detects potential reconnaissance activity within a Microsoft Entra ID (Azure AD) environment by monitoring Microsoft Graph API audit logs. It specifically flags accounts that exhibit high-frequency access to sensitive endpoints related to directory roles, role management, authentication methods, service principals, and application permissions. The detection triggers when an identity interacts with multiple distinct sensitive API paths within a 30-minute window, a pattern indicative of an adversary enumerating privileges, MFA configurations, or application consent settings for potential escalation or persistence.
Detects anomalous, high-volume enumeration of SharePoint and OneDrive resources via Microsoft Graph API by monitoring for repeated access patterns involving /sites, /drives, or /drive endpoints combined with search, directory traversal, and pagination parameters.
Detects anomalous GitLab project enumeration where an account performs an excessive number of requests to the Projects API using the 'membership=true' parameter within a one-hour window. This behavior is indicative of an attacker attempting to discover all accessible repositories associated with a compromised or over-privileged GitLab token.
Detects anomalous GitLab project enumeration where an account performs an excessive number of requests to the Projects API using the 'membership=true' parameter within a one-hour window. This behavior is indicative of an attacker attempting to discover all accessible repositories associated with a compromised or over-privileged GitLab token.
Detects high-frequency requests to various Microsoft Graph API endpoints, such as users, groups, applications, and mailboxes, within a short timeframe. This behavior is indicative of an adversary attempting to map out a target's cloud identity infrastructure and environment, often as a precursor to more focused attacks like phishing, data exfiltration, or lateral movement within M365.
Detects a single identity, application, or IP address performing Graph API requests across multiple disparate categories (e.g., tenant, directory, privilege, application, repository, mailbox) within a short window. This pattern is indicative of automated reconnaissance or tenant enumeration, commonly performed during the post-compromise phase to map the environment prior to exfiltration.
Detects anomalous GitLab project enumeration where an account performs an excessive number of requests to the Projects API using the 'membership=true' parameter within a one-hour window. This behavior is indicative of an attacker attempting to discover all accessible repositories associated with a compromised or over-privileged GitLab token.
Detects anomalous GitLab project enumeration where an account performs an excessive number of requests to the Projects API using the 'membership=true' parameter within a one-hour window. This behavior is indicative of an attacker attempting to discover all accessible repositories associated with a compromised or over-privileged GitLab token.
Page 2 of 8