Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,866 detections
Filters
Last updated
All Time
Detection languages
2,525
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,934
7,265
6,535
3,866
3,645
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects successful user authentications originating from known malicious IP addresses associated with EvilToken infrastructure hosted on Railway.com. This indicates potential compromise via phishing or other credential theft methods.
This rule detects when a user successfully grants five or more OAuth2 permissions within a five-minute window, specifically looking for sensitive scopes such as 'Mail.Read', 'Calendar.Read', 'User.Read.All', or 'Directory.Read.All'. This behavior can indicate an adversary attempting to gain broad access to an organization's data through a compromised application or user account.
This rule detects potential MFA bypass attempts by identifying multiple successful sign-ins from the same user within an hour where Conditional Access policies were not applied, and no MFA method was used. This could indicate an adversary circumventing security controls to gain unauthorized access.
Detects rogue device registration with default naming conventions commonly used by threat actors (DESKTOP-[0-9A-F]{6,8}). This pattern is often observed in device code phishing attacks where adversaries register new devices with generic names to maintain persistence or access.
Identifies Python-based automated Graph API queries searching the directory based on name patterns and role attributes. This rule correlates sign-in logs with Microsoft Graph CloudAppEvents to detect suspicious activity originating from Python scripts interacting with the Microsoft Graph API.
Detects specific URI patterns used by Storm-2949 to enumerate users, indicating automated directory reconnaissance. The rule specifically looks for Microsoft Graph API calls that include both '$select=displayName,userPrincipalName,jobTitle' and '$top=50' in the RawEventData, which are indicators of user enumeration.
Detects a user interrupt error (50199) followed by a successful authentication within 5 minutes, a pattern observed in device code phishing attacks. This rule specifically looks for sign-in logs where both error code 0 (success) and 50199 (user interrupt) occur for the same user and correlation ID within a 5-minute window.
Detects rapid non-interactive sign-ins utilizing refresh tokens from known VPS hosting providers. This rule identifies a high volume of successful non-interactive sign-ins (more than 20 within a 10-minute window) from a single user and IP address, indicating potential abuse of refresh tokens, possibly from a compromised cloud VPS.
This rule detects the successful execution of the 'Run Command' action on Azure virtual machines outside of defined business hours (8 AM to 6 PM). Run Command allows the execution of arbitrary scripts on a VM, which can be leveraged for administrative tasks but also by attackers for post-exploitation activities, persistence, or lateral movement. Monitoring these operations during off-hours may indicate unauthorized use or anomalous administrative activity.
This rule detects potential automated credential stuffing attempts followed by successful authentication and subsequent access to sensitive/privileged APIs within Azure/Entra ID environments. It correlates multiple failed login attempts for service-oriented account names (e.g., svc, api, bot) with a successful login from the same user shortly thereafter, followed by privileged API operations (e.g., KeyVault secret access, user management) within a short time window.
Detects the creation of a new deviceManagementScript or deviceShellScript object in Intune, indicating a PowerShell (Windows) or Shell (macOS/Linux) script has been uploaded to the Intune management platform. This is considered a high-fidelity indicator of script-based abuse as these scripts execute as SYSTEM on targeted endpoints and leave minimal forensic traces. The rule also identifies script creation initiated by service principals that might bypass human-UPN-based monitoring.
Identifies successful device code authentication flows where the client application is masquerading as a Microsoft Office client. This technique is commonly used by Phishing-as-a-Service (PhaaS) kits like EvilTokens for account takeover, by tricking users into authenticating a malicious application through a device code flow.
Detects unauthorized GlobalProtect VPN logins from known malicious IPs.
Detects one-way C2 communication via data drops to cloud storage services
Detects registration of potentially malicious OAuth applications in Azure AD
This rule identifies rapid, multi-category reconnaissance activity against the Microsoft Graph API. It specifically looks for bursts of 20 or more requests across 4 or more unique Graph API endpoints within a one-minute window, particularly when those requests include parameters like '$top=999', '$count=true', or target '/beta/' endpoints, which are indicative of attempts to extract maximum data or use less common API versions. This behavior is typified by threat actors like Tycoon 2FA operators.
This rule detects suspicious administrative activities in Azure AD, Microsoft Graph, SharePoint, Exchange, or Teams when performed by accounts that are not explicitly identified as 'admin' or 'service' accounts. It looks for a combination of at least 5 operations and 2 unique operation types within a 2-hour window, targeting group, application, or service principal related resources. This could indicate an attacker using compromised non-privileged accounts to perform administrative actions or escalate privileges.
Detects automated API calls listing secrets via GitHub Actions with high pagination, indicating a script enumerating organizational secrets.
Detects authentication events originating from Microsoft Authentication Broker or OfficeHome using Node.js associated user agents, which are indicative of the Tycoon 2FA kit relay infrastructure. This activity suggests an Adversary-in-the-Middle (AiTM) attack attempting to bypass multi-factor authentication.
Detects a spike in successful operations related to Azure Storage Account Keys by a single caller within a one-hour window. This could indicate an adversary attempting to enumerate, access, or exfiltrate storage account keys, or a legitimate user performing multiple key management activities.
Detects suspicious device access patterns and multiple failed authentication attempts from unmanaged devices and outside the corporate network, combined with Azure AD Identity Protection risk states. This rule identifies potential credential access attempts or account compromise.
Page 121 of 185