Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,864 detections
Filters
Last updated
All Time
Detection languages
2,523
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,448
1,199
1,091
792
575
Platforms
39,931
7,261
6,535
3,864
3,642
Products / Services
1,755
1,449
1,120
438
406
MITRE Techniques
1,888
1,391
913
814
726
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects instances where a user or administrator grants consent to an OAuth application in Azure AD requesting highly sensitive delegated or application permissions, such as Mail.Read, Mail.ReadWrite, offline_access, or directory-wide read/write scopes. Attackers often use these consents to maintain persistent, silent access to a user's mailbox and cloud resources even after primary session tokens are revoked.
Detects a sequence of events where a user performs a risky or anomalous login to Azure AD, such as from an anonymous network or an non-compliant device, followed shortly after by the registration of a new MFA method or security information. This behavior is indicative of an attacker who has compromised credentials and is attempting to establish persistence or bypass authentication controls by enrolling their own MFA device.
Detects a suspicious sequence of events where a user performs a device-code authentication flow from a previously unseen application, followed within a two-hour window by sensitive account activities such as OAuth application consent/registration or mailbox-related administrative operations. This behavior is characteristic of passkey-phishing campaigns designed to steal access tokens and achieve persistence or data access via malicious OAuth applications.
Detects the assignment of high-privilege Entra ID directory roles (e.g., Global Administrator) to identities that either have a recent risky sign-in history or were created within the last 48 hours. This pattern is indicative of privilege escalation following account compromise or the creation of backdoored accounts by an attacker. Assignments including change management tracking tags are excluded to reduce noise.
This rule detects potentially malicious OAuth application consent grants where a user authorizes an application with high-privilege scopes (such as mail or directory access). The detection flags consent grants for applications that are either unverified by the publisher or newly created within the last 30 days, and correlates these events with suspicious sign-in activity (high/medium risk or failures) for the same user within a two-hour window.
Detects a hybrid identity attack sequence where an anomalous or high-risk cloud sign-in (e.g., AD FS, Azure AD Connect) is followed within 24 hours by suspicious on-premise Active Directory activity, specifically DCSync replication requests or Kerberoasting (high volume of TGS requests). This pattern is indicative of an attacker leveraging stolen cloud session tokens to pivot into on-premise infrastructure.
Detects the assignment of high-privilege roles to cloud user accounts in Entra ID, AWS, or GCP when that assignment is preceded by anomalous sign-in behavior (high-risk or failed authentication) within 24 hours, or when the account appears to be dormant (no activity in 90+ days) prior to the privilege assignment.
This rule detects potential unauthorized access to Azure Key Vault secrets by correlating AI agent process execution on an endpoint with subsequent Key Vault API activity by the same user account. It tracks common AI coding/assistant tools running locally on a device and triggers an alert if the same identity accesses cloud-plane Key Vault operations within 5 minutes. Additionally, it identifies anomalous bulk secret enumeration patterns in Key Vault audit logs to detect potential automated exfiltration.
This rule detects a password-spraying attack pattern directed at privileged or manager-titled accounts. It monitors for multiple failed sign-in attempts from a single source IP address against a large volume of distinct user accounts identified as managers or senior staff. The detection logic filters for low-frequency attempts per account, which is indicative of a distributed spray attack designed to evade account lockout thresholds while focusing on high-value targets.
Detects successful authentication events for accounts that have been dormant for at least 90 days, correlated with suspicious activity markers such as recent failed sign-in attempts, access from an unfamiliar geographic location or ASN, or a complete absence of historical sign-in activity.
Detects the 'auto-exfil' pattern associated with the TeamFiltration tool. The rule identifies a sequence of SharePoint Online file access immediately followed by a Microsoft Graph token request from the SharePoint Online Web Client Extensibility app. To reduce noise, it mandates a very short time delta between events (<= 60 seconds) combined with either the use of an IP address/ASN not previously seen for the account in the last 14 days, or a preceding failed sign-in attempt for the account.
Detects the 'auto-exfil' pattern associated with the TeamFiltration tool. The rule identifies a sequence of SharePoint Online file access immediately followed by a Microsoft Graph token request from the SharePoint Online Web Client Extensibility app. To reduce noise, it mandates a very short time delta between events (<= 60 seconds) combined with either the use of an IP address/ASN not previously seen for the account in the last 14 days, or a preceding failed sign-in attempt for the account.
Detects unauthorized processes attempting to access the cloud instance metadata service (169.254.169.254). Adversaries frequently target this endpoint to extract sensitive instance information, such as IAM credentials or configuration data, typically as part of post-exploitation discovery or SSRF-based attacks.
Monitors Azure AuditLogs for application consent events that grant high-privilege Microsoft Graph API scopes, such as Mail.Read, Files.ReadWrite.All, or Directory.ReadWrite.All. This activity is a common indicator of illicit consent grant phishing attacks, where adversaries trick users into granting permissions to a malicious OAuth application to gain persistent, unauthorized access to sensitive data without requiring direct user credentials or MFA.
Monitors Azure AuditLogs for application consent events that grant high-privilege Microsoft Graph API scopes, such as Mail.Read, Files.ReadWrite.All, or Directory.ReadWrite.All. This activity is a common indicator of illicit consent grant phishing attacks, where adversaries trick users into granting permissions to a malicious OAuth application to gain persistent, unauthorized access to sensitive data without requiring direct user credentials or MFA.
Detects anomalous sign-in behavior, including impossible travel (geo-velocity) and non-interactive authentication without MFA, specifically targeting patterns indicative of Adversary-in-the-Middle (AiTM) session token theft.
Detects high-risk domain account activity, specifically identifying either impossible-travel authentication patterns in cloud logs or rapid, multi-host interactive authentication fan-out within one hour. These detections are further correlated with subsequent RDP or WinRM session establishment, indicating potential lateral movement or compromise of legitimate accounts.
Detects OAuth2 authorization code flow attempts in Entra ID (Azure AD) sign-in logs where the redirect URI is external to the Microsoft ecosystem, followed by an immediate token issuance event to that same suspicious endpoint. This behavior is indicative of 'ClickFix' or 'ConsentFix' phishing attacks, where users are manipulated into copying an authorization code from a legitimate Microsoft sign-in prompt and pasting it into an attacker-controlled application.
Detects anomalous sign-in behavior where the same Entra ID session or refresh token is reused from two geographically distant IP addresses within a short timeframe. This activity is correlated with a prior suspicious OAuth consent-grant or device-code authentication event on the same account, which is a common indicator of an 'EvilTokens' style session-token replay attack.
Detects potential consent phishing attempts by identifying when a user grants high-risk, persistent-access OAuth scopes (such as Mail or Files) to a new third-party application. The rule specifically excludes known first-party Microsoft apps and utilizes a lookback period to avoid alerting on applications that have already been consented to within the tenant, reducing noise from routine enterprise app usage.
Detects potential consent phishing attempts by identifying when a user grants high-risk, persistent-access OAuth scopes (such as Mail or Files) to a new third-party application. The rule specifically excludes known first-party Microsoft apps and utilizes a lookback period to avoid alerting on applications that have already been consented to within the tenant, reducing noise from routine enterprise app usage.
Page 19 of 184