Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
37 detections
Filters
Last updated
All Time
Detection languages
20
9
6
1
1
Contributors
11
7
4
4
3
Categories
13
12
10
9
7
Platforms
22
19
13
7
3
Products / Services
17
11
6
4
3
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
4
2
IDS Protocols
6
This rule detects potential user enumeration attacks targeting Entra ID tenants by monitoring for failed sign-in attempts (ResultType 50034) involving common, predictable username patterns across multiple tenants within a 24-hour window. This behavior often indicates an adversary attempting to map valid usernames by exploiting error code differences or identity discovery patterns.
Detects sign-in activity in Entra ID where the application display name is blank, despite an Application ID being present, originating from known cloud service provider IP ranges (AWS or Cloudflare). This pattern is consistent with automated enumeration or discovery tools that leverage OAuth client ID spoofing or misconfigurations to identify valid tenants or users.
KQL Query from file: The Hunt for QR Phisher
Detects anomalous account enumeration attempts by monitoring Azure AD Sign-in logs for a high volume of '50034' error codes (invalid username) originating from a single IP address within a short time window. This behavior is often indicative of an adversary attempting to identify valid user accounts within the environment.
Detects Microsoft Graph API requests that perform bulk enumeration of email messages across multiple folders. The rule specifically identifies API queries that request sender (From) and recipient (To, CC, BCC) fields, a behavior consistent with mailbox address harvesting or reconnaissance by an Address Extractor module.
This rule detects potential reconnaissance activity in Microsoft 365 environments by monitoring Graph API requests. It specifically looks for large-scale user enumeration patterns or queries containing keywords associated with HR, payroll, or sensitive financial information, often indicative of an adversary attempting to identify high-value targets. The detection focuses on both standard 'List' operations and specific URI patterns used for bulk data extraction.
Detects anomalous account enumeration attempts by monitoring Azure AD Sign-in logs for a high volume of '50034' error codes (invalid username) originating from a single IP address within a short time window. This behavior is often indicative of an adversary attempting to identify valid user accounts within the environment.
Detects bulk Azure AD user account enumeration via Graph API
This rule detects potential email directory enumeration attempts by monitoring HTTP requests. It triggers when a client sends 10 or more HTTP requests within 30 seconds to the server, where each request URI contains both an '@' symbol and '.com'. This pattern is indicative of an attacker trying to guess valid email addresses on a domain.
This rule detects potential email address harvesting via web scraping by identifying a high volume of HTTP GET requests to URIs containing the word "contact" within a short timeframe from a single source IP address. The threshold is set to 30 requests within 30 seconds, indicating automated or rapid access attempts often associated with scraping activities.
KQL Query from file: The Hunt for QR Phisher
KQL Query
KQL Query from file: Phishing campaigns leveraging Microsoft Forms
Detects the use of the "Get-ADComputer" cmdlet in order to identify systems which are configured for unconstrained delegation.
This analytic detects an unusual number of Kerberos Ticket Granting Ticket (TGT) requests for non-existing users from a single source endpoint. It leverages Windows Event ID 4768 and identifies anomalies using the 3-sigma statistical rule. This behavior is significant as it may indicate an adversary performing a user enumeration attack against Active Directory. If confirmed malicious, the attacker could validate a list of usernames, potentially leading to further attacks such as brute force or credential stuffing, compromising the security of the environment.
Page 2 of 2