Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,864 detections
Filters
Last updated
All Time
Detection languages
2,523
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,448
1,199
1,091
792
575
Platforms
39,926
7,251
6,535
3,864
3,632
Products / Services
1,755
1,449
1,120
438
406
MITRE Techniques
1,888
1,391
913
814
726
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Identify the use of the GraphRunner recon command Invoke-GraphRecon with the permission enum flag set, providing allowed actions and conditional access data for the current user.
Identify the enumeration of members within groups in Entra ID. This is based on GraphRunner Get-SecurityGroups function behavior so modifications may be needed for other scenarios
This detects when the groups endpoint is called in the Graph API. GraphRunner contains a function called Get-DynamicGroups but other tools may as well.
Identify when mailboxes are being accessed with requests for N number of messages
Identify the use of the user API call to collect a listing of users. This can be chatty due to other commands calling this single API.
Detects when a user is added to a group in Office 365.
Detects when a group GUID in Office 365 has more users added to it by the same user than a defined thresold.
Detects when a user is removed from a group in Office 365.
Detect mail items accessed via API through an unapproved Entra ID application.
Detects when a user is removed from a group in Microsoft Teams.
Application creation can be legitimate but aren't frequently created. Validating application creation may be appropriate to ensure rogue apps aren't being created.
Delete Entra ID application. This is a soft delete, can still be recovered.
Deletion of Entra ID application with no recovery of the application.
Entra ID application was restored. This implies a soft delete was performed at some point but less than 30 days ago.
Adding permissions to an application is expected, however if excessive permissions are changed at one time over a defined threshold, it may be worth validating.
Detects when a group is deleted.
GraphRunner contains a function that forges UA strings. The UA strings below are found in that function. Can be used for other UA strings if desired
Identify the use of the application API call to collect a listing of applications in Entra ID. This can be chatty due to other commands calling this single API.
Identify a 400 bad request to the groups endpoint in the MS Graph API. GraphRunner's Invoke-SecurityGroupCloner function will trigger this if it fails to duplicate a group.
Identify a successful group creation. Triggered through the use of GraphRunner's Invoke-SecurityGroupCloner function.
This detects when the search/query endpoint is called which can be used for enumeration of items like SharePoint site URLs. GraphRunner contains a function called Get-SharePointSiteURLs but other tools may as well.
Page 179 of 184