Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,926
7,251
6,535
3,864
3,632
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects a potential Business Email Compromise (BEC) persistence chain where a user grants an OAuth application mail-read or mail-write permissions, followed by the creation of a malicious inbox rule designed to forward, move, or delete sensitive email threads. This combination enables persistent exfiltration and stealth, bypassing password resets as the OAuth token remains active.
This rule detects modifications to domain federation settings in Azure Active Directory (Microsoft Entra ID), specifically when a domain is set to federated or when critical federation URLs (IssuerUri, ActiveLogOnUri, MetadataExchangeUri) are changed. Such modifications can indicate an attempt to establish malicious domain federation, allowing an adversary to authenticate as any user within the tenant.
This rule detects modifications to domain federation settings in Azure Active Directory (Microsoft Entra ID), specifically when a domain is set to federated or when critical federation URLs (IssuerUri, ActiveLogOnUri, MetadataExchangeUri) are changed. Such modifications can indicate an attempt to establish malicious domain federation, allowing an adversary to authenticate as any user within the tenant.
Detects unauthorized or suspicious modifications to Azure Active Directory (Azure AD) Conditional Access Policies. This includes deleting a policy, disabling an enabled policy, narrowing the scope of users or groups targeted by a policy, or removing MFA requirements from existing policies.
Detects instances where a user grants consent to an Azure AD application with highly sensitive permissions (such as ReadWrite access to Directory, Roles, or Applications). This pattern is commonly used in OAuth consent phishing attacks to maintain persistence or escalate privileges by authorizing a malicious application to act on behalf of the user or the entire directory.
This rule detects modifications to multi-factor authentication (MFA) settings performed by privileged users (e.g., Global Admins) from IP addresses not previously associated with their account. The rule tracks actions such as registering new security information, changing default MFA methods, or deleting authentication methods. High-risk indicators like an unknown IP address for a privileged account are flagged for further investigation.
This rule detects modifications to multi-factor authentication (MFA) settings performed by privileged users (e.g., Global Admins) from IP addresses not previously associated with their account. The rule tracks actions such as registering new security information, changing default MFA methods, or deleting authentication methods. High-risk indicators like an unknown IP address for a privileged account are flagged for further investigation.
Detects impossible travel activity for Azure AD accounts by calculating the speed between consecutive sign-in events using the Haversine formula. The rule correlates sign-ins sharing the same SessionId or DeviceId and identifies instances where the calculated travel speed exceeds 900 km/h over a distance greater than 300 km. It includes filtering to exclude known corporate VPN egress points to reduce noise.
Detects impossible travel activity for Azure AD accounts by calculating the speed between consecutive sign-in events using the Haversine formula. The rule correlates sign-ins sharing the same SessionId or DeviceId and identifies instances where the calculated travel speed exceeds 900 km/h over a distance greater than 300 km. It includes filtering to exclude known corporate VPN egress points to reduce noise.
This rule monitors Azure AD and Office 365 non-interactive sign-in logs to identify anomalous spikes in activity from previously unseen applications or devices. It uses a 30-day baseline to determine if a sign-in pair (User/App/Device) is known. It further flags sign-ins from unrecognized locations (ASN/Country), flagging them with higher severity. This behavior is often indicative of automated credential abuse or token exploitation.
Detects OAuth application consent events in Azure Active Directory where the application is from an unverified publisher, requests high-risk scopes (specifically offline_access plus at least two others like Mail, Files, Contacts, or Directory), and potentially indicates a mass-campaign if multiple users consent to the same application.
Detects the reactivation of a Microsoft Entra ID (Azure AD) service principal that has been inactive for 90 or more days, specifically flagging those that perform privileged Graph API operations after their return. This rule helps identify potentially compromised or stale service principals being leveraged by adversaries for persistent access.
This rule monitors Office 365 management logs for device registration or join events in Azure Active Directory where the resulting device state is flagged as both non-compliant and unmanaged, despite having a 'Workplace' or 'AzureAd' trust type. It further aggregates these events by user to identify potential suspicious patterns, such as bulk registrations or rapid activity within a 30-minute window, which may indicate account compromise or unauthorized device enrollment.
Detects the reactivation of a Microsoft Entra ID (Azure AD) service principal that has been inactive for 90 or more days, specifically flagging those that perform privileged Graph API operations after their return. This rule helps identify potentially compromised or stale service principals being leveraged by adversaries for persistent access.
Detects modifications to Microsoft 365 tenant configurations that weaken security posture, specifically the disabling of Security Defaults or the re-enabling of legacy/basic authentication methods (e.g., POP, IMAP, ActiveSync).
Detects modifications to an Azure Active Directory application where a new Redirect URI is added, particularly when the URI points to localhost, a raw IP address, or a non-corporate domain. The rule additionally correlates this change with recent OAuth grant activities to identify potential adversary attempts to hijack tokens or maintain persistent access via malicious application configurations.
Detects instances where a user grants an OAuth application consent to high-risk scopes (such as mail reading, file access, or directory reading) without administrator oversight. This behavior is a common indicator of OAuth abuse where an attacker lures a user into granting excessive permissions to a malicious application, providing the attacker persistent access to the user's data.
This rule detects the granting of sensitive, high-privilege Microsoft Graph API delegated or application permissions to an application or service principal in an Entra ID environment. Such permissions, including directory and user management or full application access, are frequently used by adversaries for persistence and privilege escalation within cloud environments.
Detects mass-phishing consent campaigns by monitoring non-admin users consenting to multi-tenant or unverified-publisher applications requesting non-basic-profile OAuth scopes. The rule aggregates multiple consent events for the same application over a 1-hour window to identify potentially malicious consent-phishing activity.
Detects mass-phishing consent campaigns by monitoring non-admin users consenting to multi-tenant or unverified-publisher applications requesting non-basic-profile OAuth scopes. The rule aggregates multiple consent events for the same application over a 1-hour window to identify potentially malicious consent-phishing activity.
Detects OAuth2 permission consent events where a user grants a third-party or newly registered application access to high-risk scopes (such as Mail, Files, or Directory). This technique is commonly used to establish persistence and bypass MFA by gaining access to user accounts via malicious or compromised OAuth applications.
Page 20 of 150