Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,864 detections
Filters
Last updated
All Time
Detection languages
2,523
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,448
1,199
1,091
792
575
Platforms
39,931
7,261
6,535
3,864
3,642
Products / Services
1,755
1,449
1,120
438
406
MITRE Techniques
1,888
1,391
913
814
726
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects Azure AD sign-in events where the user-agent matches common scripting or automation libraries such as python-requests. This behavior is often indicative of automated token replay attacks, where attackers attempt to leverage stolen session cookies or tokens (e.g., following AiTM phishing) via proxy infrastructure.
Detects rapid, automated-style creation of an application, associated service principal, and delegated permission grants within a 60-second window. This behavior is indicative of the TrustSink technique or similar automated adversary infrastructure setup in Microsoft Entra ID (formerly Azure AD), where an attacker establishes persistence or elevated access through newly created apps.
Detects AI agent tooling (e.g., LangChain, Copilot, Claude Code) performing read operations on databases containing sensitive data patterns, or performing suspicious bulk data enumeration. The rule monitors Azure SQL Database security audit events for suspicious application name signatures and non-schema introspective queries.
Detects anomalous activity where a successful device-code authentication is immediately followed by rapid multi-device registration or Intune enrollment. This pattern is consistent with GhostCode-style attacks involving Primary Refresh Token (PRT) theft and rogue device registration to bypass conditional access policies.
Correlates a successful OAuth device-code sign-in with a subsequent Device Registration Service event for the same user within 30 minutes, excluding known legitimate device-code applications (Azure CLI, Azure PowerShell, Visual Studio, VS Code) and requiring both events to have succeeded. The registration match is scoped strictly to the Device Registration Service resource (not the broader Microsoft Authentication Broker app, which fires on routine token refresh/broker activity unrelated to registering a new device). The correlation is further restricted to cases where the device-registration event originates from a different IP address or city than the original device-code sign-in -- the pattern expected when an attacker uses a stolen token to register their own device and mint a Primary Refresh Token, versus a legitimate user completing device enrollment from their own network shortly after a CLI/developer login.
Detects anomalous external traffic patterns indicative of automated API reconnaissance. The rule flags high-frequency requests from a single IP targeting a diverse set of API endpoints, particularly when characterized by a mixture of successful (200), unauthorized (403), or not found (404) status codes, or repeated attempts to access sensitive management/administrative API paths.
Detects anomalous post-authentication reconnaissance activities against the Microsoft Graph API, specifically the enumeration of directory objects, roles, or service principals. The rule triggers when a user account performs multi-endpoint enumeration via the Graph API within 30 minutes of a successful authentication session initiated via a device code flow that was flagged with elevated risk signals. This behavior is consistent with post-compromise reconnaissance techniques such as 'EvilTokens', where an adversary attempts to map the environment after gaining access.
Detects changes to Entra ID (Azure AD) federation settings, specifically targeting updates to trust and authentication parameters such as IssuerUri, ActiveLogOnUri, and TokenSigningCertificate. These modifications are critical indicators of potential Golden SAML attacks, where adversaries forge SAML tokens to bypass MFA and impersonate users.
Detects when high-privilege application permissions (e.g., Directory.ReadWrite.All, Application.ReadWrite.All) are granted to a service principal via admin consent. This behavior can be used by attackers to gain persistent, stealthy administrative access to a Microsoft Entra ID tenant.
Detects modifications to Entra ID (Azure AD) cross-tenant access settings, including inbound/outbound trust settings and B2B collaboration configurations. This activity may indicate an adversary attempting to establish persistence or facilitate unauthorized access by creating a trust relationship with an external tenant they control.
Detects modifications to Entra ID (Azure AD) cross-tenant access settings, including inbound/outbound trust settings and B2B collaboration configurations. This activity may indicate an adversary attempting to establish persistence or facilitate unauthorized access by creating a trust relationship with an external tenant they control.
This rule detects when a user or admin grants consent to an unverified OAuth application that simultaneously requests sensitive delegated permissions across multiple categories (Mail, Files, Directory, and Contacts). This pattern is a strong indicator of consent phishing attacks, where adversaries trick users into granting broad permissions to a malicious application to harvest sensitive data or gain persistent access to a Microsoft 365 environment.
Detects anomalous Privileged Identity Management (PIM) role activations in Entra ID that deviate from standard patterns. This includes instances where roles are activated without required approvals, for unusually long durations, or when an account activates multiple distinct roles within a short time frame, potentially indicating account takeover or abuse of standing privileges.
Detects non-interactive Microsoft Entra ID service principal or managed identity sign-in events originating from an IP address, ASN, or country that has not been historically associated with that specific service principal. This behavior may indicate the use of compromised service principal credentials or stolen access tokens from adversary-controlled infrastructure.
Detects unauthorized changes to the token-signing certificate for federated domains in Microsoft Entra ID (formerly Azure AD). This behavior is often associated with the Golden SAML attack technique, where an adversary modifies federation settings to forge authentication tokens. The rule filters for events occurring outside of standard business hours and alerts when the modification is not performed by known automation service accounts.
Detects the registration of a new multi-tenant OAuth application in an enterprise cloud environment that requests high-risk scopes (e.g., mail access or directory write permissions). This behavior is often associated with OAuth-based consent phishing or the establishment of persistent backdoors in cloud environments.
Detects the registration of a new multi-tenant OAuth application in an enterprise cloud environment that requests high-risk scopes (e.g., mail access or directory write permissions). This behavior is often associated with OAuth-based consent phishing or the establishment of persistent backdoors in cloud environments.
This rule detects when a Service Principal or Application is assigned to highly privileged directory roles within Microsoft Entra ID (formerly Azure AD). Adversaries may perform this action to achieve persistence or escalate privileges within the cloud environment by granting high-level administrative access to a compromised or adversary-controlled service principal.
Detects a mass influx of OAuth consent grant events for a single application from multiple users within a one-hour window. This behavior is indicative of a consent phishing campaign, where attackers lure users into granting excessive permissions to a malicious application to steal access tokens.
Detects the addition or update of federated identity credentials (FIC) on Entra ID applications or service principals that do not match an approved list of OIDC issuers. This technique, known as Workload Identity Federation, can be abused by adversaries for stealthy, token-less, secret-free persistence.
This rule detects when an OAuth application is granted sensitive Exchange Online permissions, such as 'full_access_as_app', 'Mail.Read', 'Mail.ReadWrite', or 'Mail.Send'. Granting these permissions allows an application to access mailboxes across the tenant without requiring a signed-in user context, which is a common persistence and data exfiltration technique used in Business Email Compromise (BEC) and espionage campaigns.
Page 24 of 184