Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,866 detections
Filters
Last updated
All Time
Detection languages
2,525
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,934
7,265
6,535
3,866
3,645
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects removal of registered authentication methods shortly after a password reset, a sequence that can prevent the legitimate user from recovering the account. This rule specifically looks for successful 'Delete user authentication method' or 'Remove authentication method' operations in AuditLogs.
Detects a single identity rapidly reading a large number of distinct secrets from an Azure Key Vault within a short timeframe (10 minutes). This behavior is indicative of automated secret harvesting, potentially by an attacker who has compromised an identity with access to the Key Vault. The rule specifically looks for at least 25 reads and 10 distinct secrets accessed by the same identity and IP address within the time window.
This rule detects potential data exfiltration attempts or sensitive information disclosure through Microsoft Copilot Enterprise Search. It specifically looks for 'URLClick' actions from 'Microsoft Copilot Enterprise Search' where the raw event data contains a 'q=' parameter (indicating a query) and also contains keywords like 'extract', 'embed', or 'img'. This combination suggests that a user might be attempting to extract or embed content, potentially sensitive, via a Copilot search query, which could lead to data leakage.
Detects systematic enumeration of application registrations, owners, credentials, and permissions through Microsoft Graph. This rule identifies suspicious activity where a user or application makes a high volume of GET requests to various Microsoft Graph API endpoints related to application registrations within a short time frame (15 minutes). The specific endpoints monitored include those for listing applications, owners, password credentials, key credentials, and required resource access. A threshold of 40 requests within a 15-minute window triggers the alert, indicating potential reconnaissance or inventory collection by an adversary.
Detects outbound web requests to Bing's 'Search by Image' endpoint where the embedded image URL points to a non-Microsoft domain. This mechanism is used in the SearchLeak attack (CVE-2026-42824) to bypass CSP and exfiltrate data from Microsoft 365 Copilot.
Detects an SSPR (Self-Service Password Reset) event immediately followed by the registration of a new Microsoft Authenticator method for the same user. This sequence of events can indicate an attacker has compromised an identity, performed a password reset, and is attempting to establish a new MFA method for persistent access.
This rule identifies a suspicious sequence of events: a successful device code authentication immediately followed (within one hour) by a device registration event (PRT upgrade) for the same user. This pattern is indicative of a device code phishing attack where an attacker tricks a user into authenticating a device code, then registers their own device to gain persistent access.
Detects successful sign-ins utilizing the device code flow, which is frequently abused in Adversary-in-the-Middle (AiTM) phishing attacks. This rule specifically looks for successful authentication events where the 'AuthenticationProtocol' is 'deviceCode'.
Detects the execution of known ransomware-related executables ('servertool.exe', 'encrypt.exe') when their command line arguments indicate interaction with cloud storage services such as OneDrive, SharePoint, GoogleDrive, Dropbox, or iCloud. This behavior is indicative of ransomware attempting to encrypt or exfiltrate data from cloud environments.
Identifies Azure Active Directory (AAD) logins from new or unusual locations followed immediately by the creation of inbox rules designed to delete incoming emails. This behavior is indicative of an attacker gaining access to an email account and attempting to disrupt communication or hide their activities by automatically deleting legitimate emails.
Tracks AAD/Exchange logs showing mail routed through an external tenant specifically to bypass internal domain spoofing filters via trusted connectors. This rule identifies emails where the sender's domain matches the internal company domain, but the email was routed through an external Office 365 connector and did not originate from a trusted internal IP address, indicating a potential cross-tenant spoofing attempt.
Identifies the threat actor modifying Azure AD Cross-Tenant Access Policies to allow B2B collaboration with external attacker-controlled tenants.
Detects a successful multifactor authentication followed within minutes by another successful sign-in for the same account from a different IP address and user agent. This pattern can indicate an adversary has bypassed MFA, potentially through techniques like AiTM phishing, and is attempting to use the compromised session.
Detects device registration attempts mapping a refresh token to the Device Registration Service (ms-drs) for persistence. This activity can be indicative of an adversary attempting to maintain access or bypass conditional access policies by registering a new device.
This rule detects potential OAuth token abuse by correlating credential consent grants with subsequent unusual cloud access patterns from different geographic locations. It looks for activities like adding a service principal, adding OAuth2 permission grants, or consenting to an application, followed by access to specific cloud applications (Salesforce, Drift, Slack, Microsoft 365, Workday) from an IP address that does not match the IP address from which the consent was granted. The rule aggregates these events and triggers if there are at least 4 related events within a 6-hour window.
Detects when a guest user (identified by '#EXT#' in their UPN) is assigned a sensitive role like 'Agent ID Administrator' or 'AgentAdministrator' in Entra ID. It also detects when any user, including guest users, performs modifications related to 'Agent' blueprints. This rule aims to identify potential privilege escalation or unauthorized administrative actions by external users within an Azure Active Directory environment.
Identifies device registration events where the user agent indicates script or automated frameworks (like axios, node, undici, node-fetch) rather than native registration clients. This behavior is associated with adversaries like Tycoon 2FA, which establishes device-bound persistence (PRT) that survives standard session revocation, making this a critical post-compromise detection.
Detects the creation, modification, or renaming of a JSP file within the 'PSEMHUB.war' directory. This activity can indicate the deployment of a web shell or other malicious code within the PeopleSoft PSEMHUB web application, often associated with server compromise.
Detects Microsoft 365 sign-ins using the device code grant flow from an unusual location or a previously unseen/unmanaged device. This behavior is consistent with OAuth phishing abuse, specifically 'device code phishing' where an adversary tricks a user into entering a code/credentials on a malicious authorization page to obtain a device token.
Detects Microsoft Authentication Broker (MAB) accessing enterprise applications outside of the expected first-party subset. This could indicate an attempt to bypass multi-factor authentication (MFA) or gain unauthorized access to resources.
Detects successful user authentications originating from known EvilToken infrastructure hosted on HZ Hosting. This activity is indicative of potential credential compromise or phishing attacks leveraging this specific infrastructure.
Page 119 of 185