Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
414 detections
Filters
Last updated
All Time
Detection languages
226
76
49
34
16
Contributors
129
50
43
42
35
Categories
152
125
118
106
84
Platforms
338
155
147
27
11
Products / Services
10,665
9,758
6,692
4,418
3,749
414
MITRE Techniques
254
202
134
129
109
CVEs
1
1
1
This rule detects sign-in attempts originating from IP addresses that Microsoft Entra ID Protection has identified as malicious. These IP addresses are known to be associated with attackers or compromised systems at the time of the sign-in, indicating a high-risk authentication attempt.
This rule detects user activity that Azure AD Identity Protection has flagged as 'investigationsThreatIntelligence'. This risk event type indicates that a sign-in or user behavior is unusual for the user or consistent with known attack patterns, often leveraging threat intelligence feeds to identify suspicious activity. It suggests potential compromise of user accounts or malicious sign-in attempts.
This rule detects sign-in attempts originating from a country that is considered new or infrequent for the user based on their past activity locations. This behavior can indicate a compromised account being used by an attacker from an unusual geographic location.
This rule detects anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser. This indicates a potential compromise of user credentials or an attempt to bypass authentication mechanisms.
This rule detects sign-in attempts originating from IP addresses identified as malicious by Azure AD Identity Protection, specifically when these attempts are characterized by a high failure rate. This indicates potential brute-force attacks, credential stuffing, or other unauthorized access attempts from known bad IP addresses.
This rule identifies user activity originating from an IP address that has been flagged as an anonymous proxy. Such activity can indicate an attempt to obscure the true origin of a sign-in, which is often associated with malicious intent like credential stuffing, account takeover, or bypassing geographical restrictions.
Indicates that a password spray attack has been successfully performed.
Indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns
Indicates that the user's valid credentials have been leaked.
Indicates access attempt to the PRT resource which can be used to move laterally into an organization or perform credential theft
Anomalous Token
Sigma
Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location.
Anonymous IP Address
Sigma
Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN.
Indicates sign-in from a malicious IP address based on high failure rates.
Indicates sign-in from a malicious IP address known to be malicious at time of sign-in.
Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server.
Page 20 of 20