Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,932
7,263
6,535
3,864
3,643
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects high-volume, rapid enumeration of core Microsoft Graph directory endpoints (users, groups, applications, and servicePrincipals) by a single identity or session. This behavior is indicative of reconnaissance tools such as AADInternals, ROADtools, or TokenTactic being used to map out a cloud environment's directory structure.
Detects the addition or modification of federated identity credentials within Microsoft Entra ID (Azure AD). Adversaries may add these credentials to service principals or applications to achieve persistent access and potentially bypass traditional password-based authentication mechanisms.
Detects tenant-level enablement of Microsoft Teams external/federated access or addition of an unfamiliar external domain shortly before a spike in inbound Teams calls to helpdesk/IT-support-tagged users — models CrowdStrike's 2026 Financial Services Threat Landscape Report on 'Mutant Spider,' the most active threat to financial services, whose primary technique is voice phishing over Microsoft Teams impersonating internal IT.
This rule monitors Salesforce lead creation events for potential prompt-injection payloads. It identifies submissions containing common AI manipulation instructions, HTML tags, or suspicious outbound URLs, which could be used to hijack internal user sessions or execute malicious content within the Salesforce environment.
This rule detects internal users submitting potentially sensitive data to public generative AI applications (e.g., ChatGPT, Claude, Gemini) where Microsoft Purview DLP or a comparable inspection service has triggered a policy match. It correlates cloud application outbound signals with content inspection logs to identify high-risk exfiltration events while excluding sanctioned enterprise-licensed AI instances.
Detects instances where a user account registers a new Multi-Factor Authentication (MFA) method (such as TOTP or Authenticator app) shortly (within 30 minutes) after a high-risk or potentially anomalous sign-in event. This pattern is commonly associated with adversary-in-the-middle (AiTM) phishing attacks where an attacker captures an authenticated session and uses it to enroll a secondary, attacker-controlled MFA device for persistent account access.
Detects evidence of account persistence and potential mailbox manipulation following an anomalous sign-in event in Google Workspace. The rule identifies suspicious post-compromise activity such as the addition of new MFA methods, new OAuth application grants, or mailbox forwarding/inbox rules, which are consistent with the reuse of captured authenticated sessions.
Detects anomalous activity where a successful device-code authentication is immediately followed by rapid multi-device registration or Intune enrollment. This pattern is consistent with GhostCode-style attacks involving Primary Refresh Token (PRT) theft and rogue device registration to bypass conditional access policies.
Detects anomalous authentication patterns in Microsoft 365 logs characterized by rapid login attempts from a high number of distinct IP addresses and autonomous systems (ASNs) within a short timeframe. This behavior is indicative of Adversary-in-the-Middle (AiTM) attacks involving session-token theft and replay, where the adversary uses rotating residential proxy infrastructure to bypass location-based conditional access policies.
Detects anomalous post-authentication reconnaissance activities against the Microsoft Graph API, specifically the enumeration of directory objects, roles, or service principals. The rule triggers when a user account performs multi-endpoint enumeration via the Graph API within 30 minutes of a successful authentication session initiated via a device code flow that was flagged with elevated risk signals. This behavior is consistent with post-compromise reconnaissance techniques such as 'EvilTokens', where an adversary attempts to map the environment after gaining access.
Detects the creation, update, or activation of an external Identity Provider (IdP) or federated trust configuration within the Okta environment. This activity may indicate an attempt to establish a rogue federation trust, which allows an adversary to perform cross-tenant impersonation and authenticate as any user by minting assertions signed by attacker-controlled keys.
Detects modifications to Entra ID (Azure AD) cross-tenant access settings, including inbound/outbound trust settings and B2B collaboration configurations. This activity may indicate an adversary attempting to establish persistence or facilitate unauthorized access by creating a trust relationship with an external tenant they control.
Detects modifications to Entra ID (Azure AD) cross-tenant access settings, including inbound/outbound trust settings and B2B collaboration configurations. This activity may indicate an adversary attempting to establish persistence or facilitate unauthorized access by creating a trust relationship with an external tenant they control.
This rule detects when a user or admin grants consent to an unverified OAuth application that simultaneously requests sensitive delegated permissions across multiple categories (Mail, Files, Directory, and Contacts). This pattern is a strong indicator of consent phishing attacks, where adversaries trick users into granting broad permissions to a malicious application to harvest sensitive data or gain persistent access to a Microsoft 365 environment.
Detects a mass influx of OAuth consent grant events for a single application from multiple users within a one-hour window. This behavior is indicative of a consent phishing campaign, where attackers lure users into granting excessive permissions to a malicious application to steal access tokens.
Detects the addition or update of federated identity credentials (FIC) on Entra ID applications or service principals that do not match an approved list of OIDC issuers. This technique, known as Workload Identity Federation, can be abused by adversaries for stealthy, token-less, secret-free persistence.
This rule detects when an OAuth application is granted sensitive Exchange Online permissions, such as 'full_access_as_app', 'Mail.Read', 'Mail.ReadWrite', or 'Mail.Send'. Granting these permissions allows an application to access mailboxes across the tenant without requiring a signed-in user context, which is a common persistence and data exfiltration technique used in Business Email Compromise (BEC) and espionage campaigns.
Detects modifications to Microsoft Entra ID (formerly Azure AD) Conditional Access policies that lower security posture. This includes disabling an active policy, removing users or groups from enforcement scopes, or removing MFA requirements. Such actions are typical of an adversary attempting to maintain persistent access or evade authentication controls.
Detects modifications to Microsoft Entra ID (formerly Azure AD) Conditional Access policies that lower security posture. This includes disabling an active policy, removing users or groups from enforcement scopes, or removing MFA requirements. Such actions are typical of an adversary attempting to maintain persistent access or evade authentication controls.
Detects instances where a non-administrative user grants OAuth application permissions for high-risk Microsoft Graph delegated scopes. This activity is a common indicator of 'consent phishing' campaigns, where an attacker tricks a user into authorizing a malicious application, granting persistent access to the user's data and resources via API tokens, even after password resets.
Detects OAuth application consent events where an application is granted a combination of 'offline_access' (allowing refresh token issuance) and email-read permissions. This pattern is commonly used by adversaries to establish persistent, long-term access to user mailboxes for data exfiltration or Business Email Compromise (BEC) activities, surviving password changes until the consent is explicitly revoked.
Page 20 of 142