Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
13 detections
Filters
Last updated
All Time
Detection languages
9
2
1
1
Contributors
4
4
3
2
Categories
4
4
3
3
3
Platforms
10
6
2
2
2
Products / Services
6
6
3
2
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
1
1
IDS Protocols
1
1
Detects Azure AD sign-ins to Microsoft Teams flagged with an elevated risk state, which may indicate cloud account abuse following external Teams-based social engineering contact preceding a broader spike in malicious M365 activity.
Detects Azure AD sign-ins to Microsoft Teams flagged with an elevated risk state, which may indicate cloud account abuse following external Teams-based social engineering contact preceding a broader spike in malicious M365 activity.
Detects Azure AD sign-ins to Microsoft Teams flagged with an elevated risk state, which may indicate cloud account abuse following external Teams-based social engineering contact preceding a broader spike in malicious M365 activity.
Detects network indicators related to the BlueNoroff ClickFix Kit, specifically targeting malicious TURN relay domains (edensun.xyz) used for WebRTC-based webcam exfiltration and Command and Control (C2) traffic involving Socket.IO signals that trigger malicious UI modals.
Detects creation of cloud accounts for establishing attack infrastructure
This rule detects attempts to create new accounts on major cloud platforms (AWS, Azure, Google Cloud) by monitoring HTTP traffic for specific hostnames and the 'signup' keyword in the URI. It specifically looks for connections to 'aws.amazon.com', 'portal.azure.com', or 'console.cloud.google' with 'signup' in the URI, indicating a potential account creation activity.
KQL Query from file: CloudApp Privilege OAuth Grant
KQL Query from file: OAuth app using the OD file picker permission
KQL Query from file: Detecting Copilot Studio Bot Creation
Looks for multiple users that had their admin role removed by a single user within a certain period.
This query helps hunting for BEC - File sharing tactics - OneDrive or SharePoint
'Looks for new device registrations following a risky user account sign-in. By default the
query will use a 6 hour lookback period, this can be configured within the query.'
query will use a 6 hour lookback period, this can be configured within the query.'
This query looks for users performing file deletion activities. Spikes in file deletion observed from risky sign-in sessions are flagged here.
This applies to SharePoint and OneDrive users.
Audit event and Cloud application identifier references.
Reference - https://learn.microsoft.com/microsoft-365/compliance/audit-log-activities?view=o365-worldwide
Reference - https://learn.microsoft.com/azure/sentinel/entities-reference#cloud-application-identifiers
This applies to SharePoint and OneDrive users.
Audit event and Cloud application identifier references.
Reference - https://learn.microsoft.com/microsoft-365/compliance/audit-log-activities?view=o365-worldwide
Reference - https://learn.microsoft.com/azure/sentinel/entities-reference#cloud-application-identifiers