Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,931
7,261
6,535
3,864
3,642
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects instances where a non-administrative user grants OAuth application permissions that include high-risk delegated scopes. This activity is a primary indicator of illicit consent grant phishing attacks, where an adversary lures users into authorizing malicious applications to access sensitive data (such as emails or files) without administrator approval.
Detects potential refresh token replay attacks, such as those facilitated by Adversary-in-the-Middle (AiTM) proxy phishing, by identifying consecutive non-interactive sign-in events for the same user from geographically distant locations within a short time frame that precludes physical travel.
Detects anomalous sign-in behavior using the OAuth 2.0 device code authorization flow. The rule identifies sign-ins from previously unseen geographic locations or IP ranges (ASN) for a specific user, or detects a potential tenant-wide phishing campaign where multiple users are performing device-code authentications in a short timeframe, which is characteristic of 'device code phishing' (a form of OAuth consent phishing).
Detects anomalous sign-in behavior using the OAuth 2.0 device code authorization flow. The rule identifies sign-ins from previously unseen geographic locations or IP ranges (ASN) for a specific user, or detects a potential tenant-wide phishing campaign where multiple users are performing device-code authentications in a short timeframe, which is characteristic of 'device code phishing' (a form of OAuth consent phishing).
Detects sign-in activity using refresh tokens from device details (deviceId, browser, OS) that have not been previously observed for the user. This pattern is indicative of session token theft, often associated with Adversary-in-the-Middle (AiTM) phishing kits where attackers replay stolen session or refresh tokens to bypass multi-factor authentication.
Detects OAuth application consent events where an application is granted a combination of 'offline_access' (allowing refresh token issuance) and email-read permissions. This pattern is commonly used by adversaries to establish persistent, long-term access to user mailboxes for data exfiltration or Business Email Compromise (BEC) activities, surviving password changes until the consent is explicitly revoked.
Detects modifications to Microsoft Entra ID (formerly Azure AD) cross-tenant access policies or B2B synchronization settings. Specifically, this rule monitors for the addition of new external partner tenants to trust lists or the relaxation of security controls such as MFA and compliant device requirements for external partner access.
Detects instances where a user has consented to an OAuth application that requests high-privilege Microsoft Graph scopes (Directory.Read.All, User.Read.All, Mail.Read). This pattern is indicative of consent phishing attacks where adversaries trick users into granting applications excessive permissions, bypassing administrative consent workflows when tenant configurations allow user-level consent.
Detects modifications to Microsoft Entra ID (formerly Azure AD) Conditional Access policies that lower security posture. This includes disabling policies, switching them to report-only mode, removing Multi-Factor Authentication (MFA) or grant control requirements, or expanding exclusion lists to exempt users, groups, or locations from security controls. Such modifications are often indicative of an adversary attempting to maintain persistent access or bypass MFA requirements.
Detects mass-phishing consent campaigns by monitoring non-admin users consenting to multi-tenant or unverified-publisher applications requesting non-basic-profile OAuth scopes. The rule aggregates multiple consent events for the same application over a 1-hour window to identify potentially malicious consent-phishing activity.
Detects OAuth2 permission consent events where a user grants a third-party or newly registered application access to high-risk scopes (such as Mail, Files, or Directory). This technique is commonly used to establish persistence and bypass MFA by gaining access to user accounts via malicious or compromised OAuth applications.
Detects modifications to Microsoft Entra ID (formerly Azure AD) Conditional Access policies that lower security posture. This includes disabling policies, switching them to report-only mode, removing Multi-Factor Authentication (MFA) or grant control requirements, or expanding exclusion lists to exempt users, groups, or locations from security controls. Such modifications are often indicative of an adversary attempting to maintain persistent access or bypass MFA requirements.
This rule detects the reuse of the same user's refresh token from two different countries within a 15-minute window. This behavior is a strong indicator of token theft or session hijacking, commonly associated with AiTM phishing, infostealer malware, or session cookie extraction, where an adversary uses stolen credentials from a remote location.
Detects OAuth2 permission consent events where a user grants a third-party or newly registered application access to high-risk scopes (such as Mail, Files, or Directory). This technique is commonly used to establish persistence and bypass MFA by gaining access to user accounts via malicious or compromised OAuth applications.
Detects the addition of suspicious redirect URIs, such as those containing wildcards, non-HTTPS protocols, or known URL-shortening services, to an OAuth application registration. Such configurations can be exploited by attackers to perform OAuth authorization code or token interception (e.g., through adversary-controlled endpoints).
This rule detects administrative changes that weaken cloud identity security, specifically the disabling of Entra ID Security Defaults, per-user MFA enforcement, or tenant-wide authentication-methods policies. These actions remove critical second-factor authentication requirements, significantly increasing the risk of unauthorized access via password-spraying or credential-stuffing attacks.
Detects potential Adversary-in-the-Middle (AiTM) phishing attacks by identifying a correlation between URL clicks (Safe Links) and subsequent rapid successful sign-ins by the same user. Additionally, the rule flags instances where multiple distinct users authenticate via the same IP address within a one-hour window, identifying potential infrastructure fan-out typical of proxy-based phishing kits.
This rule correlates events across the end-to-end kill chain of an enterprise intrusion, specifically tracking the progression from initial endpoint-based infostealer activity (credential access), through anomalous or non-interactive sign-in activity, into privilege escalation or mailbox delegation within the cloud environment, and finally to mass data exfiltration or mail access. It detects accounts involved in at least three distinct stages of this progression within a 72-hour window.
Detects usage of legacy and inherently less secure authentication protocols (such as IMAP, POP3, SMTP, or Basic Authentication) within Microsoft Entra ID (Azure AD) sign-in activity. These protocols often bypass modern multi-factor authentication (MFA) requirements and are commonly exploited in credential stuffing and password spraying attacks.
Detects instances where a user account that has been flagged as risky (e.g., unfamiliar features, impossible travel, or malicious IP activity) performs a modification or registration of multi-factor authentication (MFA) security information within a short timeframe (30 minutes). This behavior is highly indicative of an adversary attempting to establish persistence or bypass authentication controls after a credential compromise.
This rule correlates a risky or compromised sign-in event in Entra ID (Azure AD) with a subsequent OAuth consent grant by the same user within 60 minutes. It specifically looks for grants that request sensitive permissions such as Mail.Read, Mail.ReadWrite, Files.ReadWrite.All, or offline_access, which are commonly associated with consent phishing and persistence tactics.
Page 14 of 142