Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,253 detections
Filters
Last updated
All Time
Detection languages
1,543
1,191
352
288
225
Contributors
792
520
494
349
298
Categories
1,711
1,489
400
382
376
Platforms
3,052
528
334
314
254
Products / Services
779
648
634
283
238
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
4,253
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
This YARA rule detects the MiyaRAT backdoor by identifying specific byte patterns associated with its functionalities. The rule looks for distinct code sequences related to obtaining disk information, gathering operating system details, and taking screenshots. The presence of all these patterns within a single executable indicates the presence of MiyaRAT.
This rule detects the enumeration of members within groups in Microsoft Entra ID (formerly Azure AD) via the Microsoft Graph API. Specifically, it looks for GET requests to the `/v1.0/groups/*/members` endpoint, which is indicative of an attempt to list group members. The rule's description notes that it is based on the behavior of the GraphRunner tool's `Get-SecurityGroups` function, suggesting it targets a specific method of enumeration.
This rule detects attempts to retrieve the Microsoft Graph authorization policy, specifically targeting the `/policies/authorizationPolicy` endpoint. This policy contains sensitive information about who can create applications, invite guest users, and other critical settings within Entra ID (formerly Azure AD). Such requests are typically made by administrators for review or modification, and unexpected calls to this endpoint could indicate reconnaissance or unauthorized access attempts. The rule filters for successful GET requests (HTTP 200) and excludes known Azure IP ranges to reduce false positives.
This rule detects the enumeration of applications and service principals within Microsoft Entra ID (formerly Azure AD) via the Microsoft Graph API. Specifically, it looks for two sequential GET requests: one to the `/v1.0/applications` endpoint and another to the `/v1.0/servicePrincipals(appId='<GUID>')/appRoleAssignedTo` endpoint. This activity is indicative of tools like GraphRunner's Invoke-DumpApps function, which collects information about applications, external applications, and users who have consented to permissions within those applications. The rule correlates these events by IP address and session ID within a 5-minute window.
This rule identifies enumeration of user inboxes within an Entra ID tenant via the Microsoft Graph API. It specifically looks for multiple GET requests to the `/v1.0/users/*/mailFolders/Inbox/messages` endpoint from a single IP address and session within a 5-minute window. The detection is based on the behavior of tools like Invoke-GraphOpenInboxFinder in GraphRunner, but is applicable to any tool performing similar inbox scanning. The rule provides outcomes detailing the number of scanned users, successful accesses (HTTP 200), forbidden accesses (HTTP 403), and not found inboxes (HTTP 404).
This rule detects the use of the GraphRunner tool's Invoke-GraphRecon command to enumerate permissions and conditional access data within the Microsoft Graph API. It specifically looks for a sequence of three API calls: 'estimateAccess', '/me', and 'policies/authorizationPolicy' originating from the same IP address and within a 5-minute window. This activity is indicative of an attacker or red teamer performing reconnaissance on an Azure AD environment.
Detects when mail items are accessed via API through an Entra ID application that is not explicitly approved. This rule specifically looks for 'MailItemsAccessed' events in Office 365 where the accessing application's ClientAppId does not match known legitimate Microsoft applications like Exchange Online, Substrate Context Service, or Microsoft Office. This could indicate unauthorized access to mailboxes by a suspicious application.
This rule detects API requests to the Microsoft Graph search/query endpoint. This endpoint can be used by adversaries to enumerate items such as SharePoint site URLs, which is a common technique used by tools like GraphRunner's Get-SharePointSiteURLs function. The detection specifically looks for successful POST requests to 'https://graph.microsoft.com/v1.0/search/query'.
This rule detects requests to the Microsoft Graph API endpoint for listing applications (https://graph.microsoft.com/v1.0/applications). This activity can be indicative of reconnaissance by an attacker attempting to enumerate applications within an Entra ID (Azure AD) environment. The rule specifically looks for successful GET requests (HTTP 200 response code) to this endpoint.
This rule detects calls to the undocumented 'Estimate Access' API in Microsoft Graph. This API is used by tools like GraphRunner for reconnaissance purposes, specifically to determine what actions a user can perform. While not inherently malicious, its use can indicate an adversary attempting to enumerate permissions or discover accessible resources within an Azure environment. The rule filters for successful POST requests to the specific beta endpoint and excludes certain Microsoft IP ranges to reduce false positives.
This rule detects the enumeration of both users and group members within an Entra ID (formerly Azure Active Directory) tenant via the Microsoft Graph API. It specifically looks for two distinct HTTP GET requests originating from the same IP address and within a 15-minute window: one targeting the `/v1.0/users` endpoint and another targeting the `/v1.0/groups/*/members` endpoint. This activity is often associated with reconnaissance efforts, such as those performed by tools like GraphRunner, to map out an organization's user and group structure.
This rule detects attempts to enumerate updatable groups within Microsoft Entra ID (formerly Azure Active Directory) using the Microsoft Graph API. Specifically, it looks for a combination of a GET request to the `/v1.0/groups` endpoint and a POST request to the `/beta/roleManagement/directory/estimateAccess` endpoint within a 5-minute window from the same IP address and session. This activity is indicative of tools like GraphRunner's `Get-UpdatableGroups` function, which adversaries might use to identify groups they can modify for privilege escalation or persistence.
This rule detects requests to the Microsoft Graph API's '/v1.0/users' endpoint with a GET method and a successful 200 response code. This API call is used to enumerate users within an Azure Active Directory environment. The rule is designed to identify potential reconnaissance activities where an attacker might be collecting a listing of users. It notes that this can be a 'chatty' API call, meaning it might generate a high volume of legitimate traffic.
Detects the execution of Notepad to open a file that has the string "password" which may indicate unauthorized access to credentials or suspicious activity.
Detects command line patterns associated with the use of Pnscan for sending and receiving binary data across the network.
This behavior has been identified in a Linux malware campaign targeting Docker, Apache Hadoop, Redis, and Confluence and was previously used by the threat actor known as TeamTNT
This behavior has been identified in a Linux malware campaign targeting Docker, Apache Hadoop, Redis, and Confluence and was previously used by the threat actor known as TeamTNT
Detects usage of SoftPerfect's "netscan.exe". An application for scanning networks.
It is actively used in-the-wild by threat actors to inspect and understand the network architecture of a victim.
It is actively used in-the-wild by threat actors to inspect and understand the network architecture of a victim.
Detects the execution of AADInternals PowerShell cmdlets. AADInternals is a tool used for administering Azure AD and Office 365, which can be abused by threat actors for various attacks including reconnaissance, credential access, and impact within Azure AD or Office 365 environments. The rule specifically looks for the unique "-AADInt" string prefix in cmdlet names.
Detects the execution of NimScan, a port scanning utility. This rule identifies NimScan based on its executable name ('NimScan.exe') and specific IMPHASH values associated with different versions of the tool. Adversaries have been observed using this utility to scan for open ports on remote hosts within compromised environments.
Estimate Access is an undocumented API in MS Graph and is used in the following GraphRunner functions Get-UpdatableGroups, Get-DynamicGroups and Invoke-GraphRecon. Although not inherently malicious, it does submit an action and then determines if the user can perform it
This detects actions intended to identify updatable groups in Entra ID. GraphRunner contains a function called Get-UpdatableGroups but other tools may as well.
The authorization policy of Entra ID (User Settings) contains information about who can create applications, invite guest users and more. It's not something that is generally modified or reviewed except by administrators so it's worth knowing who may be requesting this endpoint.
Page 179 of 203