Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,926
7,251
6,535
3,864
3,632
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects successful Entra ID authentication events where the user login originated from an anonymized or malicious IP address, or exhibited unfamiliar features, despite successfully completing multi-factor authentication (MFA). This pattern is consistent with adversary-in-the-middle (AiTM) phishing attacks, where a proxy service is used to intercept and bypass MFA controls.
This rule detects the creation or modification of mailbox rules (forwarding, redirection, or deletion) that occurs within two hours of a sign-in event flagged as high-risk, specifically those indicative of AiTM or token-replay attacks. It further filters for rules involving sensitive keywords, suggesting an attempt to intercept or hide specific categories of emails post-compromise.
This rule identifies potential phishing attempts by correlating email delivery events with known suspicious sender addresses and URLs containing typosquatting domains impersonating legitimate organizations.
Detects anomalous OAuth application consent activity by identifying a surge in unique users granting permissions to a single OAuth application within a short timeframe. This behavior is indicative of consent phishing campaigns where attackers lure users to grant application access to malicious apps, effectively stealing application access tokens and gaining persistent access to resources without requiring the victim's password.
Detects when high-privilege application permissions (e.g., Directory.ReadWrite.All, Application.ReadWrite.All) are granted to a service principal via admin consent. This behavior can be used by attackers to gain persistent, stealthy administrative access to a Microsoft Entra ID tenant.
Detects anomalous use of an OAuth2/OIDC refresh token or Primary Refresh Token (PRT) where the originating device, IP, ASN, or country differs from the initial interactive sign-in within a short timeframe. This behavior is a strong indicator of adversary-in-the-middle (AiTM) attacks, such as Evilginx or Modlishka, where session cookies and tokens are stolen to bypass MFA.
This rule detects when a user or admin grants consent to an unverified OAuth application that simultaneously requests sensitive delegated permissions across multiple categories (Mail, Files, Directory, and Contacts). This pattern is a strong indicator of consent phishing attacks, where adversaries trick users into granting broad permissions to a malicious application to harvest sensitive data or gain persistent access to a Microsoft 365 environment.
Detects instances where an administrator or user grants an application consent with highly sensitive permissions in Azure AD (Microsoft Entra ID). This activity is often associated with OAuth application phishing, where an adversary lures a user into granting excessive permissions to a malicious application, potentially leading to long-term persistence or unauthorized access to directory data and conditional access policies.
Detects instances where a non-administrative user grants OAuth application permissions that include high-risk delegated scopes. This activity is a primary indicator of illicit consent grant phishing attacks, where an adversary lures users into authorizing malicious applications to access sensitive data (such as emails or files) without administrator approval.
Detects modifications to Microsoft Entra ID (formerly Azure AD) cross-tenant access settings where a new partner is added or inbound trust settings (such as MFA or device compliance) are enabled for an external tenant. This activity may indicate an attempt to establish a persistent backdoor or facilitate initial access into the environment via a compromised or malicious external identity provider.
Detects OAuth application consent events where an application is granted a combination of 'offline_access' (allowing refresh token issuance) and email-read permissions. This pattern is commonly used by adversaries to establish persistent, long-term access to user mailboxes for data exfiltration or Business Email Compromise (BEC) activities, surviving password changes until the consent is explicitly revoked.
Detects the suspicious sequence of adding a domain or changing federation settings followed rapidly by a configuration update to the federated domain. This pattern is indicative of an adversary establishing a covert federated backdoor for persistent, delegated authentication, allowing bypass of standard credential rotation mechanisms.
This rule detects administrative changes to Conditional Access (CA) policies in Entra ID (Azure AD), specifically monitoring for the disabling of policies, transitioning them to report-only mode, or the removal of critical security grant controls such as MFA or Compliant Device requirements. It also alerts on the outright deletion of any CA policy, which could indicate an adversary attempting to bypass security controls or maintain persistent access.
Detects instances where a user has consented to an OAuth application that requests high-privilege Microsoft Graph scopes (Directory.Read.All, User.Read.All, Mail.Read). This pattern is indicative of consent phishing attacks where adversaries trick users into granting applications excessive permissions, bypassing administrative consent workflows when tenant configurations allow user-level consent.
Detects the assignment of high-privilege application permissions (e.g., Mail.ReadWrite, full_access_as_app, Files.ReadWrite.All, Sites.FullControl.All) to a service principal. This pattern is indicative of an attacker who has compromised an Application Administrator account and is attempting to establish long-term, unattended access to cloud resources such as mailboxes and SharePoint sites via OAuth client-credential flows.
Detects the addition of a new federated domain or a modification to an existing domain's authentication settings to Federated, where the domain was not previously verified within a standard verification window. This technique is often used by adversaries to establish persistence and perform self-issued token forgery (e.g., SAML/JWT) by trusting an attacker-controlled identity provider.
Detects the addition of a new federated domain or a modification to an existing domain's authentication settings to Federated, where the domain was not previously verified within a standard verification window. This technique is often used by adversaries to establish persistence and perform self-issued token forgery (e.g., SAML/JWT) by trusting an attacker-controlled identity provider.
Detects when a Service Principal is assigned to a highly privileged administrative role in Azure Active Directory (Entra ID). This activity can be an indicator of an adversary establishing persistence or escalating privileges by leveraging non-human identities.
This rule detects unscheduled modifications to federation, application, or service principal credentials, including ADFS token-signing certificates, in both Azure AD (via O365 management activity logs) and local Windows environments (via Security Event Logs). It filters these events against a known rotation schedule to highlight suspicious, non-routine changes that may indicate persistence establishment or identity provider tampering.
This rule detects the addition of a new domain or the modification of federation settings within an Office 365/Azure Active Directory environment. It specifically monitors for operations such as 'Add domain to company', 'Add unverified domain', and 'Set federation settings on domain'. The rule filters against a known list of federated domains to identify new or unexpected federation configurations, which could indicate an adversary attempting to establish persistence or facilitate privilege escalation through trust modification.
This rule detects when new credentials (secrets or certificates) are added to an Azure Active Directory Service Principal. It flags this activity as suspicious if it occurs outside of typical business hours or if it exhibits signs of 'rapid re-keying', where multiple credentials are added to the same service principal within a 24-hour window. This behavior is a common indicator of persistence maintenance or credential rotation to support unauthorized access.
Page 12 of 150