Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,865 detections
Filters
Last updated
All Time
Detection languages
2,524
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,934
7,265
6,535
3,865
3,645
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects assignment of highly privileged directory roles in Azure AD, including
Global Administrator and Privileged Role Administrator.
Global Administrator and Privileged Role Administrator.
Detects suspicious activity involving multiple password resets for different users initiated by a single user within a one-hour timeframe in Azure AD. This could indicate an attacker attempting to gain control over multiple accounts.
Detects inbound emails originating from 'azure-noreply@microsoft.com' with subjects that typically indicate financial transactions (e.g., 'Invoice Paid', 'Payment Reference') or system alerts (e.g., 'MemorySpike', 'DiskFull'). This pattern could be indicative of phishing attempts leveraging a seemingly legitimate sender to trick recipients.
This rule identifies potential network scanning or high-volume communication by detecting a large number of connections (50 or more) between a single source IP and a single destination IP within a 5-minute time window. It aggregates connection details such as total connections, sent bytes, and received bytes from the CommonSecurityLog.
This rule detects when an 'Agent ID Administrator' role adds an owner to a service principal in Azure Active Directory. This activity could indicate an attempt to escalate privileges or maintain persistence within the Azure environment by granting control over service principals to potentially unauthorized entities.
Flags Intune assignments to “All Devices” or “All Users,” which attackers may abuse for mass deployment.
This rule detects suspicious multi-factor authentication (MFA) behavior by identifying MFA denials that occur from an unknown IP address or with an unusual authentication method for a given user. It establishes a baseline of known IP addresses and usual authentication methods for each user over a 30-day period. Alerts are generated for recent MFA denials (within the last hour) if they involve a high-risk denial detail (e.g., too many invalid codes, user blocked) combined with an unknown IP or unusual authentication method, or if they involve any other denial reason combined with both an unknown IP and an unusual authentication method. This helps to identify potential MFA fatigue attacks or attempts to bypass MFA.
This rule detects when a user account assigns a 'Global Administrator' or 'Owner' role from multiple distinct IP addresses within a one-hour window. This behavior can indicate a compromised account being used to escalate privileges or establish persistence from different locations.
This rule detects the creation of new service principals or the assignment of new role assignments to existing service principals in Azure Active Directory. It specifically looks for assignments that grant high-privilege roles such as "Contributor", "Owner", or "Global Admin". The rule aggregates these changes by target and time, highlighting instances where multiple changes or distinct initiators are involved.
This rule detects anomalous mass device wipe or deletion activity in Microsoft Intune by comparing current activity against an actor's historical behavior. It identifies four patterns: first-time wipers with high volume, known actors statistically far above their norm (Z-score), thin-history actors exceeding their personal peak, and time-compressed bursts of wipes. The rule calculates a severity based on the volume and rate of wipes.
This rule detects suspicious device enrollment attempts via Microsoft Intune Company Portal from a country not previously observed in a user's 7-day sign-in history. It identifies two primary patterns: sustained successful sign-ins from a new country, indicating a potential active session and successful device enrollment (High Severity), or Conditional Access Policy (CAP) blocked attempts from a new country, suggesting an attacker probing with stolen credentials (Medium Severity). The detection aims to identify identity theft leading to unauthorized device enrollment.
Detects sign-in or Microsoft Graph API activity using user-agent strings characteristic of ROADtools and similar Python-based identity-attack tooling. The rule generalizes beyond ROADtools to catch AzureHound, MicroBurst, MFASweep, GraphRunner, and similar identity attack frameworks by looking for scripting user-agents (python, requests, urllib, curl) which signal non-browser, non-app authentication that is inherently suspicious for Entra ID admin operations.
This rule detects when a device wipe or delete operation is performed via Microsoft Intune. It specifically looks for 'wipe ManagedDevice' or 'Delete ManagedDevice' operations in Intune audit logs within the last 24 hours. The rule is designed to be correlated with other alerts by filtering on a specific ActorUPN, indicating a potential malicious mass device wipe attack.
Detects successful Microsoft Entra ID sign-ins originating from geographically distant locations within a short time period where the calculated travel speed exceeds realistic human travel limits (>900 km/h). The detection correlates consecutive sign-ins for the same user and identifies potential account compromise by validating device identifiers and trust attributes. Alerts are generated when a user authenticates from different countries, exceeds configured distance and speed thresholds, and uses a different or unknown device.
Detects installation or update of a VSCode extension from an unapproved publisher by monitoring for vsce-sign.exe signature verification events in DeviceProcessEvents. VSCode invokes vsce-sign.exe once per extension install or auto-update to verify the extension's marketplace signature before extraction. The full extension slug is passed as the --package argument, making this a reliable, install-time signal that fires for all extension types regardless of whether the extension has a background process or language server.
Extensions are evaluated against an approved publisher list maintained as an embedded datatable. Publishers are matched on the prefix before the first . in the extension slug (e.g., ms-python from ms-python.python), allowing publisher-level approval rather than per-extension management.
This detection was developed in response to the TeamPCP supply chain campaign (May 2026), in which malicious VSCode extensions were distributed via fake GitHub issue notifications targeting developers.
Extensions are evaluated against an approved publisher list maintained as an embedded datatable. Publishers are matched on the prefix before the first . in the extension slug (e.g., ms-python from ms-python.python), allowing publisher-level approval rather than per-extension management.
This detection was developed in response to the TeamPCP supply chain campaign (May 2026), in which malicious VSCode extensions were distributed via fake GitHub issue notifications targeting developers.
This rule detects a high volume (50 or more) of failed authenticated SMTP login attempts to Office 365 Exchange Online from a single IP address within a 24-hour period. The failures are specifically for error codes 50126 (invalid username or password) or 50053 (account locked). This pattern is indicative of a brute-force or password-guessing attack against Exchange Online accounts.
This rule detects a highly suspicious sequence of events in Microsoft Entra ID (formerly Azure AD) audit logs: a self-service password reset, followed by the registration of new security information, and then the deletion of existing security information, all performed by the same user within a short time window. This pattern is indicative of an attacker taking over an account, resetting the password, establishing their own MFA/security info, and then removing the legitimate user's security info to lock them out. This behavior has been observed in campaigns like Storm-2949.
Identifies potentially malicious client-side redirects or forced OAuth flows initiating from the Outlook Web Access (OWA) interface, characterized by 302 statuses and redirect parameters. This activity may indicate post-exploitation actions related to CVE-2026-42897.
This rule detects suspicious sign-in activity for a specific user principal name (UPN) within the last 7 days, immediately preceding a device wipe event. It focuses on identifying the actor's initial access or activity before initiating a mass device wipe.
This rule detects the assignment of highly privileged roles such as 'Global Administrator', 'Intune Administrator', or 'Cloud Device Administrator' within Azure Active Directory. This activity is often a precursor to significant malicious actions, including mass device wipes, as highlighted by the referenced threat intelligence. Monitoring these assignments helps identify potential privilege escalation or unauthorized administrative access.
This rule detects the use of Azure Managed Identity tokens originating from non-Azure IP spaces. This scenario is indicative of token theft, likely via the Instance Metadata Service (IMDS) endpoint (169.254.169.254), followed by an external replay of the stolen token from an attacker's infrastructure. Legitimate Managed Identity calls are expected to originate from Azure infrastructure IPs. The rule filters out legitimate Microsoft/Azure ASNs and RFC1918 private IP ranges to reduce false positives. It also categorizes the potential attack stage based on the operation name, including Key Vault access, Storage access, VM Code Execution, Privilege Escalation, and Directory Enumeration.
Page 132 of 185