Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,932
7,263
6,535
3,865
3,643
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects non-interactive sign-in events (including refresh-token or PRT-based authentication) where the originating device is not managed by Intune/Jamf, not marked as compliant, and lacks a registered trust type. This behavior is indicative of potential stolen session token replay or unauthorized access using intercepted artifacts.
Detects Microsoft Entra ID (formerly Azure AD) PIM or Just-In-Time role activations that occur without a proper approval workflow, are self-approved, or coincide with identified risky sign-in signals.
Detects usage of legacy and inherently less secure authentication protocols (such as IMAP, POP3, SMTP, or Basic Authentication) within Microsoft Entra ID (Azure AD) sign-in activity. These protocols often bypass modern multi-factor authentication (MFA) requirements and are commonly exploited in credential stuffing and password spraying attacks.
Detects non-interactive sign-in events (including refresh-token or PRT-based authentication) where the originating device is not managed by Intune/Jamf, not marked as compliant, and lacks a registered trust type. This behavior is indicative of potential stolen session token replay or unauthorized access using intercepted artifacts.
Detects instances where a user account that has been flagged as risky (e.g., unfamiliar features, impossible travel, or malicious IP activity) performs a modification or registration of multi-factor authentication (MFA) security information within a short timeframe (30 minutes). This behavior is highly indicative of an adversary attempting to establish persistence or bypass authentication controls after a credential compromise.
Detects anomalous authentication behavior where a single session identifier is used to access three or more distinct SaaS applications within a one-hour window. This behavior often indicates the unauthorized use of a stolen session cookie or OAuth token (Pass-the-Cookie) across multiple SSO-integrated platforms.
Detects Microsoft Entra ID (formerly Azure AD) PIM or Just-In-Time role activations that occur without a proper approval workflow, are self-approved, or coincide with identified risky sign-in signals.
This rule detects potentially compromised accounts by correlating suspicious authentication activity (such as risky sign-ins, impossible travel, or malicious OAuth/Mail-rule configurations) with a subsequent spike in SharePoint or OneDrive file access, downloads, or external link sharing within a one-hour window. This behavior is indicative of an adversary performing cloud-based data exfiltration after gaining unauthorized access to an account.
Detects high-volume file download activity in Office 365/SharePoint/OneDrive audit logs. The rule correlates download spikes with users who have recently triggered security alerts related to session hijacking, token theft, or risky sign-ins, which are indicators of a potential cloud account takeover scenario.
Detects anomalous OAuth 2.0 device authorization grant sign-in activity within Microsoft 365. The rule identifies suspicious token redemption behavior where the initial device code request and the subsequent token redemption occur from disparate IP addresses or utilize different user-agent strings, which is indicative of EvilTokens or similar adversary-in-the-middle (AiTM) device-code phishing frameworks.
Detects high-privilege OAuth application consent grants (such as Mail.Read or Files.ReadWrite.All) occurring within four hours of a risky or anomalous user sign-in. This sequence indicates a potential compromise where an attacker uses a compromised account to authorize a malicious OAuth application for persistent access and data exfiltration.
Detects instances where a user account performs non-interactive or legacy authentication (e.g., IMAP, POP3, SMTP, ActiveSync) shortly after an endpoint associated with that same user is flagged for malware or infostealer activity. This pattern is indicative of an adversary using exfiltrated credentials to maintain access to cloud services while bypassing MFA policies.
Detects a sequence of events where a user account triggers a high-risk or anomalous sign-in (e.g., token-replay, AitM, impossible travel), followed within 12 hours by that same user modifying, deleting, or narrowing the scope of Conditional Access or identity security policies. This behavior is indicative of an attacker attempting to establish persistence, strip MFA requirements, or bypass location restrictions after gaining initial cloud account access.
Detects the assignment of a highly privileged administrative or directory role to a user or service principal following a high-risk or anomalous sign-in event. This pattern is indicative of potential session hijacking where an adversary attempts to escalate privileges within a cloud environment after gaining initial access to a compromised account.
Detects bulk mailbox export or content search operations performed by an identity shortly after a high-risk sign-in event. This pattern is indicative of potential account takeover where an adversary attempts to harvest sensitive email data at scale for BEC or extortion.
Detects when a user account that has exhibited anomalous or risky sign-in behavior subsequently grants mailbox delegation, full-access, or Send-As permissions to another user (who is not the mailbox owner). This activity is indicative of a compromised account being used to establish persistence or facilitate email exfiltration and spoofing by expanding access to sensitive mailboxes.
Detects a single user identity authenticating into three or more distinct SaaS applications within a 10-minute window. This behavior is consistent with the replay of a stolen session cookie (Pass-the-Cookie) or the abuse of an active authenticated session to move laterally across a federated SaaS estate.
Detects an anomalous volume of file access or synchronization activity on cloud document platforms (Microsoft SharePoint, OneDrive, or Google Drive) that occurs following a high-severity risky sign-in event. The rule specifically flags potential exfiltration patterns such as large volumes of data transfer or numerous file accesses, especially if associated with unmanaged devices or connections to known personal/external file-sharing services.
This rule detects anomalous Privileged Identity Management (PIM) or Just-in-Time (JIT) role activation events. It identifies when a user activates a privileged role following suspicious activity such as a risky sign-in, during unusual (off-hours) time windows, or from an unfamiliar source IP address, potentially indicating session hijacking or credential abuse.
Detects sign-in events to high-privileged cloud management consoles (e.g., Azure Portal, Microsoft Entra, Intune, Okta, AWS, GCP) originating from sessions with elevated risk or anomalous characteristics. The detection monitors for factors such as the use of anonymized IP addresses, unmanaged devices, sessions marked as 'atRisk' by identity providers, or non-interactive service-based access to management APIs that deviate from standard administrative workflow patterns.
Detects anomalous, high-velocity authentication activity where a single identity accesses multiple high-value SaaS applications (such as CRM, DevOps, or admin consoles) in a short time frame, correlated with risk signals indicative of token reuse or 'pass-the-cookie' attacks.
Page 23 of 142