Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
771 detections
Filters
Last updated
All Time
Detection languages
392
128
66
49
47
Contributors
296
150
91
39
27
Categories
388
258
255
124
110
Platforms
523
344
285
121
72
Products / Services
370
328
112
51
43
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
771
CVEs
2
1
IDS Classtypes
15
11
3
1
1
IDS Protocols
29
Detects OAuth2 permission consent events where a user grants a third-party or newly registered application access to high-risk scopes (such as Mail, Files, or Directory). This technique is commonly used to establish persistence and bypass MFA by gaining access to user accounts via malicious or compromised OAuth applications.
Detects mass-phishing consent campaigns by monitoring non-admin users consenting to multi-tenant or unverified-publisher applications requesting non-basic-profile OAuth scopes. The rule aggregates multiple consent events for the same application over a 1-hour window to identify potentially malicious consent-phishing activity.
Detects OAuth application consent grants where the application requests both 'offline_access' (enabling refresh tokens for long-term access) and sensitive mailbox permission scopes (such as Mail.Read, Mail.ReadWrite, Mail.Send, or IMAP.AccessAsUser.All). This combination is indicative of consent phishing attacks designed to establish persistent, silent access to user email accounts, bypassing password resets and multi-factor authentication.
Detects a potential Primary Refresh Token (PRT) or device code phishing attack by identifying a two-step authentication sequence: first, a successful user sign-in via device code flow, followed shortly by a subsequent sign-in from a different, unmanaged, or untrusted device. This behavioral pattern often indicates an adversary using stolen device code session data to authenticate a new device session.
This rule detects the granting of sensitive, high-privilege Microsoft Graph API delegated or application permissions to an application or service principal in an Entra ID environment. Such permissions, including directory and user management or full application access, are frequently used by adversaries for persistence and privilege escalation within cloud environments.
This rule detects the granting of sensitive, high-privilege Microsoft Graph API delegated or application permissions to an application or service principal in an Entra ID environment. Such permissions, including directory and user management or full application access, are frequently used by adversaries for persistence and privilege escalation within cloud environments.
This rule detects the granting of sensitive, high-privilege Microsoft Graph API delegated or application permissions to an application or service principal in an Entra ID environment. Such permissions, including directory and user management or full application access, are frequently used by adversaries for persistence and privilege escalation within cloud environments.
Detects mass-phishing consent campaigns by monitoring non-admin users consenting to multi-tenant or unverified-publisher applications requesting non-basic-profile OAuth scopes. The rule aggregates multiple consent events for the same application over a 1-hour window to identify potentially malicious consent-phishing activity.
Detects anomalous sign-in activity for service principals (non-interactive accounts) where the same application authenticates from multiple distinct countries within a 24-hour window. This behavior often indicates the unauthorized use of compromised service principal credentials, such as client secrets or certificates, from distributed attacker-controlled infrastructure.
Detects anomalous sign-in activity for service principals (non-interactive accounts) where the same application authenticates from multiple distinct countries within a 24-hour window. This behavior often indicates the unauthorized use of compromised service principal credentials, such as client secrets or certificates, from distributed attacker-controlled infrastructure.
Detects a potential Business Email Compromise (BEC) persistence chain where a user grants an OAuth application mailbox read/write permissions, followed immediately by the creation of an inbox rule (forwarding, moving, or deleting) targeting messages containing keywords like 'invoice', 'wire', or 'payment'.
Detects a potential Business Email Compromise (BEC) persistence chain where a user grants an OAuth application mailbox read/write permissions, followed immediately by the creation of an inbox rule (forwarding, moving, or deleting) targeting messages containing keywords like 'invoice', 'wire', or 'payment'.
Detects impossible travel sign-in events where a user authenticates from geographically distant locations within a short time window. The rule specifically flags the second, suspicious event as having occurred via a non-interactive session or single-factor authentication, suggesting the use of a replayed or stale session token to bypass MFA.
Detects impossible travel sign-in events where a user authenticates from geographically distant locations within a short time window. The rule specifically flags the second, suspicious event as having occurred via a non-interactive session or single-factor authentication, suggesting the use of a replayed or stale session token to bypass MFA.
Detects a potential Business Email Compromise (BEC) persistence chain where a user grants an OAuth application mailbox read/write permissions, followed immediately by the creation of an inbox rule (forwarding, moving, or deleting) targeting messages containing keywords like 'invoice', 'wire', or 'payment'.
Detects impossible travel sign-in events where a user authenticates from geographically distant locations within a short time window. The rule specifically flags the second, suspicious event as having occurred via a non-interactive session or single-factor authentication, suggesting the use of a replayed or stale session token to bypass MFA.
Detects anomalous reuse of a single session identifier across geographically distinct locations and/or multiple federated SaaS applications within a short time frame. The detection specifically filters for non-interactive sign-in events, which is characteristic of session hijacking and token replay rather than standard user activity.
This rule correlates a risky or compromised sign-in event in Entra ID (Azure AD) with a subsequent OAuth consent grant by the same user within 60 minutes. It specifically looks for grants that request sensitive permissions such as Mail.Read, Mail.ReadWrite, Files.ReadWrite.All, or offline_access, which are commonly associated with consent phishing and persistence tactics.
This rule detects potential account compromise by identifying 'impossible travel' scenarios where successful logins for the same user occur from different geolocations within a short timeframe (less than 1 hour), specifically when at least one authentication event uses a refresh or session token rather than interactive MFA. It correlates these suspicious logins with previous endpoint infostealer detections on the same device within the last 72 hours, indicating that the token may have been stolen by malware.
Detects anomalous OAuth 2.0 device authorization grant sign-in activity within Microsoft 365. The rule identifies suspicious token redemption behavior where the initial device code request and the subsequent token redemption occur from disparate IP addresses or utilize different user-agent strings, which is indicative of EvilTokens or similar adversary-in-the-middle (AiTM) device-code phishing frameworks.
Detects high-privilege OAuth application consent grants (such as Mail.Read or Files.ReadWrite.All) occurring within four hours of a risky or anomalous user sign-in. This sequence indicates a potential compromise where an attacker uses a compromised account to authorize a malicious OAuth application for persistent access and data exfiltration.
Page 8 of 37