Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,864 detections
Filters
Last updated
All Time
Detection languages
2,523
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,448
1,199
1,091
792
575
Platforms
39,926
7,251
6,535
3,864
3,632
Products / Services
1,755
1,449
1,120
438
406
MITRE Techniques
1,888
1,391
913
814
726
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects attempts to delete Azure resource locks protecting Site Recovery or Backup services, followed by credential retrieval (ListKeys) within a one-hour window. This sequence pattern is a strong indicator of an adversary attempting to disable backup protection before potentially destroying data or exfiltrating keys.
Detects a suspicious pattern often associated with Storm-3168 (JADEPUFFER) activity: prolonged, high-volume Azure resource enumeration by one service principal, followed shortly by a second service principal performing rapid, multi-subscription enumeration from the same source IP address.
This rule correlates multiple telemetry sources to detect a sophisticated cloud identity compromise chain. It identifies suspicious MFA-satisfied logins (potentially via Adversary-in-the-Middle) followed by the granting of high-risk OAuth application consents, the creation of persistent mailbox rules for hiding or forwarding communications, and finally mass data access or exfiltration from the user's account.
Detects instances where a user account experiences a high volume of failed MFA attempts (MFA push fatigue) within a short window, which is subsequently followed by a successful authentication. This behavior is indicative of an attacker attempting to wear down a user into approving an MFA request for an unauthorized access attempt.
Detects successful Entra ID authentication events where the user login originated from an anonymized or malicious IP address, or exhibited unfamiliar features, despite successfully completing multi-factor authentication (MFA). This pattern is consistent with adversary-in-the-middle (AiTM) phishing attacks, where a proxy service is used to intercept and bypass MFA controls.
Detects anomalous, unauthorized access to machine learning model artifacts (e.g., .onnx, .pt, .h5) within object storage or model registries. The rule identifies suspicious patterns including high-volume file reads by non-ML team identities, lack of multi-factor authentication, or access from geolocations outside approved operating regions, indicative of potential model exfiltration or intellectual property theft.
Detects suspicious HTTP requests directed at SharePoint applications containing a malformed Register directive. The rule identifies attempts to leverage the 'publishingribbon' Tagprefix combined with unauthorized namespaces (e.g., System.Xaml, System.Windows.Data) to bypass the EditingPageParser.InitializeRegisterTable safelist check, a common technique for SharePoint remote code execution.
Detects anomalous OAuth application consent activity by identifying a surge in unique users granting permissions to a single OAuth application within a short timeframe. This behavior is indicative of consent phishing campaigns where attackers lure users to grant application access to malicious apps, effectively stealing application access tokens and gaining persistent access to resources without requiring the victim's password.
Detects when high-privilege application permissions (e.g., Directory.ReadWrite.All, Application.ReadWrite.All) are granted to a service principal via admin consent. This behavior can be used by attackers to gain persistent, stealthy administrative access to a Microsoft Entra ID tenant.
Detects anomalous use of an OAuth2/OIDC refresh token or Primary Refresh Token (PRT) where the originating device, IP, ASN, or country differs from the initial interactive sign-in within a short timeframe. This behavior is a strong indicator of adversary-in-the-middle (AiTM) attacks, such as Evilginx or Modlishka, where session cookies and tokens are stolen to bypass MFA.
This rule detects when a user registers or adds a new device in Entra ID within a short timeframe (two hours) of experiencing a risky sign-in or a password reset. It specifically flags registrations involving potentially unmanaged, non-compliant, or unusually trusted devices, which may indicate an attempt to establish persistent access or bypass Conditional Access policies.
This rule detects when a user or admin grants consent to an unverified OAuth application that simultaneously requests sensitive delegated permissions across multiple categories (Mail, Files, Directory, and Contacts). This pattern is a strong indicator of consent phishing attacks, where adversaries trick users into granting broad permissions to a malicious application to harvest sensitive data or gain persistent access to a Microsoft 365 environment.
Detects the registration of a new MFA authentication method on an Entra ID account from an unrecognized IP or device, occurring in close temporal proximity to a password reset or a risky sign-in event. This behavior is indicative of an adversary establishing persistence via self-service MFA registration after compromising user credentials.
Detects the addition of service principal credentials by a user who is not explicitly listed as an owner of the application. This activity is monitored to identify potential persistence or privilege escalation attempts where an unauthorized account adds its own authentication method to an existing cloud application or service principal.
Detects instances where an administrator or user grants an application consent with highly sensitive permissions in Azure AD (Microsoft Entra ID). This activity is often associated with OAuth application phishing, where an adversary lures a user into granting excessive permissions to a malicious application, potentially leading to long-term persistence or unauthorized access to directory data and conditional access policies.
This rule detects when a non-privileged user adds a new owner to an Azure AD Application or Service Principal, followed by a suspicious modification (such as adding credentials or permissions) to that same application within 30 minutes. This behavior is indicative of an adversary attempting to gain persistent, elevated access to an application's service principal to manipulate its configuration or permissions.
This rule detects when a non-privileged user adds a new owner to an Azure AD Application or Service Principal, followed by a suspicious modification (such as adding credentials or permissions) to that same application within 30 minutes. This behavior is indicative of an adversary attempting to gain persistent, elevated access to an application's service principal to manipulate its configuration or permissions.
Detects instances where a non-administrative user grants OAuth application permissions that include high-risk delegated scopes. This activity is a primary indicator of illicit consent grant phishing attacks, where an adversary lures users into authorizing malicious applications to access sensitive data (such as emails or files) without administrator approval.
Detects the addition of new service principal credentials (passwords or certificates) to Azure AD applications occurring outside of typical business hours. This behavior may indicate an attacker attempting to establish persistence or maintain unauthorized access to cloud resources through an existing application identity.
Detects potential refresh token replay attacks, such as those facilitated by Adversary-in-the-Middle (AiTM) proxy phishing, by identifying consecutive non-interactive sign-in events for the same user from geographically distant locations within a short time frame that precludes physical travel.
Detects anomalous sign-in behavior using the OAuth 2.0 device code authorization flow. The rule identifies sign-ins from previously unseen geographic locations or IP ranges (ASN) for a specific user, or detects a potential tenant-wide phishing campaign where multiple users are performing device-code authentications in a short timeframe, which is characteristic of 'device code phishing' (a form of OAuth consent phishing).
Page 15 of 184