Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
771 detections
Filters
Last updated
All Time
Detection languages
392
128
66
49
47
Contributors
296
150
91
39
27
Categories
388
258
255
124
110
Platforms
523
344
285
121
72
Products / Services
370
328
112
51
43
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
771
CVEs
2
1
IDS Classtypes
15
11
3
1
1
IDS Protocols
29
Detects suspicious access to Microsoft Teams application's authentication tokens and local storage, which may contain sensitive credentials. This rule specifically looks for Event ID 4663 (Object Access) where the accessed object path contains '\Microsoft\Teams\Cookies' or '\Microsoft\Teams\Local Storage\leveldb', and the accessing process is NOT the legitimate 'Teams.exe'. This indicates an attempt by an unauthorized process to steal Teams authentication tokens.
This rule detects attempts to access a Primary Refresh Token (PRT) resource within Azure. A PRT is a key artifact used for single sign-on (SSO) in Azure AD, allowing users to maintain their authenticated state across various applications and services. Unauthorized access to a PRT can enable an adversary to move laterally within an organization's Azure environment, perform credential theft, and bypass multi-factor authentication (MFA) to gain access to resources as the legitimate user. This detection specifically looks for the 'attemptedPrtAccess' risk event type reported by Azure's risk detection service.
Detects when an end user's consent to an application is blocked by Azure AD due to risk-based consent policies. This indicates that Azure AD has identified a risky application or a risky consent request, preventing the user from granting permissions to it. This can be a proactive measure against consent phishing or malicious applications attempting to gain access to user data.
This rule detects when an end user grants consent to an application in Azure Active Directory (now Microsoft Entra ID). Specifically, it triggers when the 'ConsentContext.IsAdminConsent' field is 'false', indicating that the consent was given by a regular user rather than an administrator. This activity can be a precursor to adversaries stealing application access tokens by tricking users into authorizing malicious applications.
This rule detects anomalous token characteristics, such as an unusual token lifetime or a token being used from an unfamiliar location. This indicates potential compromise or misuse of identity tokens.
This rule detects when an application is granted delegated or app role permissions within Microsoft Graph, Exchange, SharePoint, or Azure AD. This activity can indicate an adversary attempting to establish persistence or elevate privileges by giving a malicious application access to sensitive resources.
Detects when highly privileged delegated permissions are granted on behalf of all users in Azure Active Directory. This can indicate an attempt to gain broad access to resources by an application.
End User Consent
Sigma
Detects when an end user consents to an application
Detects when end user consent is blocked due to risk-based consent.
Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or Azure AD
Indicates access attempt to the PRT resource which can be used to move laterally into an organization or perform credential theft
Detects when highly privileged delegated permissions are granted on behalf of all users
Anomalous Token
Sigma
Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location.
Anonymous IP Address
Sigma
Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN.
Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.
Page 37 of 37