Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,866 detections
Filters
Last updated
All Time
Detection languages
2,525
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,934
7,265
6,535
3,866
3,645
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects OAuth application registration or permission grant via Graph API
Detects bulk Azure AD user account enumeration via Graph API
This rule detects network connections to Azure infrastructure (azurewebsites.net) that utilize specific API paths associated with the MiniJunk C2 framework. The paths include '/api/app/check', '/api/app/update', and '/api/app/comment', which are indicative of command and control beaconing activity.
Flags outbound HTTPS traffic to a specific Azure Blob Storage path ('note1ggbbhggdwa1.blob.core.windows.net/note/ats/') when initiated by 'RuntimeBroker_update.exe'. This pattern is indicative of a dead-drop command and control (C2) mechanism, potentially associated with the 'Operation Dragon Weave' campaign.
Monitors for device code authentication via uncommon Family of Client IDs (FOCI) applications. This rule identifies successful device code authentications where the application ID (AppId) has been observed fewer than 5 times, indicating potentially rare or newly introduced applications. This could be indicative of an adversary attempting to use a malicious application for device code phishing.
This rule detects successful sign-ins using OAuth from residential IP addresses. It joins `SigninLogs` with `IdentityLogonEvents` to correlate successful OAuth authentications with user logon events. The intent is to identify potentially suspicious access, possibly indicating credential abuse or unauthorized access attempts from non-corporate or unexpected locations.
This rule detects potential data exfiltration attempts or sensitive information disclosure through Microsoft Copilot Enterprise Search. It specifically looks for 'URLClick' actions from 'Microsoft Copilot Enterprise Search' where the raw event data contains a 'q=' parameter (indicating a query) and also contains keywords like 'extract', 'embed', or 'img'. This combination suggests that a user might be attempting to extract or embed content, potentially sensitive, via a Copilot search query, which could lead to data leakage.
Detects a sender transmitting many attachment-bearing messages or a large aggregate attachment volume to external recipients within thirty minutes. This could indicate data exfiltration or a compromised account being used to send spam or malware.
Detects suspicious device access patterns and multiple failed authentication attempts from unmanaged devices and outside the corporate network, combined with Azure AD Identity Protection risk states. This rule identifies potential credential access attempts or account compromise.
This rule detects network connections to AzureWebsites (specifically '.azurewebsites.net') where the URI path matches patterns used by the Nimbus Manticore implant for command and control polling or initialization. The patterns include '/agent/poll?token=' or '/agent/init' or '/agent/result'. This indicates potential communication with a Manticore implant hosted on an Azure web app.
Detects deletion of MFA configurations to enable authentication bypass
Detects OAuth application registration or permission grant via Graph API
This rule detects potential credential exposure by identifying HTTP requests to IIS servers (W3CIISLog) that contain keywords like 'password' or 'token' in the URI query string, with a successful status code (200). This could indicate sensitive information being passed insecurely.
This rule detects suspicious sign-in attempts to Azure AD where Conditional Access policies were not applied, the sign-in was successful, and the user agent string indicates a bot, crawler, headless browser, or common scripting tools like curl, wget, or python. It specifically looks for multiple such logins or logins from multiple unique devices within a 5-minute window for the same user and risk detail.
This rule detects potential password spraying attacks against Microsoft Entra ID (formerly Azure Active Directory). It identifies a high number of failed sign-in attempts from a single source IP address targeting multiple unique user accounts within a short timeframe, specifically looking for 'Invalid password' or 'invalid credentials' failure reasons. The thresholds are set to 20 or more failures and 10 or more unique users within a 5-minute window.
Detects inbound email delivered from external Microsoft 365 tenants (@*.onmicrosoft.com) which may be attempting to impersonate legitimate senders. Threat actors register disposable or lookalike M365 tenants to abuse Microsoft's native SPF/DKIM authentication and bypass email security controls.
Detects suspicious activity involving the upload of multiple unique packages to common CI/CD package repositories (like npmjs, pypi, Artifactory, Nexus, Maven) from a single device within a short timeframe. This could indicate a compromised build server or developer account attempting to inject malicious dependencies into the software supply chain.
This rule detects potential device code phishing attempts by correlating URL click events with sign-in logs using the 'deviceCode' authentication protocol. It specifically looks for successful or failed sign-ins (result types 0, 50074, 50076, 500121) that occur after a user clicks on a URL.
Detects creation of cloud accounts for establishing attack infrastructure
Detects forged Golden SAML tokens used for identity federation bypass
Detects access to Azure portal for cloud service dashboard discovery
Page 122 of 185