Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,864 detections
Filters
Last updated
All Time
Detection languages
2,523
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,448
1,199
1,091
792
575
Platforms
39,931
7,261
6,535
3,864
3,642
Products / Services
1,755
1,449
1,120
438
406
MITRE Techniques
1,888
1,391
913
814
726
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
This rule detects potential account compromise by identifying 'impossible travel' scenarios where successful logins for the same user occur from different geolocations within a short timeframe (less than 1 hour), specifically when at least one authentication event uses a refresh or session token rather than interactive MFA. It correlates these suspicious logins with previous endpoint infostealer detections on the same device within the last 72 hours, indicating that the token may have been stolen by malware.
Detects instances where a risky Azure AD sign-in (e.g., token replay or confirmed compromise) is closely followed (within 24 hours) by sensitive application or service principal credential modifications by the same user account. This behavior is indicative of potential persistence establishment via account manipulation.
Detects when a user account assigned to a highly privileged directory or cloud role performs the assignment shortly after exhibiting signs of compromise, such as risky sign-ins, anomalous locations, or suspected session token reuse.
Detects Microsoft Entra ID (formerly Azure AD) PIM or Just-In-Time role activations that occur without a proper approval workflow, are self-approved, or coincide with identified risky sign-in signals.
This rule detects potentially compromised accounts by correlating suspicious authentication activity (such as risky sign-ins, impossible travel, or malicious OAuth/Mail-rule configurations) with a subsequent spike in SharePoint or OneDrive file access, downloads, or external link sharing within a one-hour window. This behavior is indicative of an adversary performing cloud-based data exfiltration after gaining unauthorized access to an account.
Detects the addition of new credentials (certificates, secrets, or keys) to Azure AD Service Principals or Applications, occurring outside of standard business hours (6 AM to 8 PM). This pattern is often indicative of an adversary establishing or maintaining persistent access to an enterprise cloud environment.
Detects the addition of new credentials (certificates, secrets, or keys) to Azure AD Service Principals or Applications, occurring outside of standard business hours (6 AM to 8 PM). This pattern is often indicative of an adversary establishing or maintaining persistent access to an enterprise cloud environment.
This rule detects when a user is assigned a highly privileged role in Azure AD (e.g., Global Administrator, Security Administrator) shortly after that user has performed a sign-in event flagged as risky. This behavior is a strong indicator of account takeover or malicious privilege escalation within the cloud environment.
Detects anomalous OAuth 2.0 device authorization grant sign-in activity within Microsoft 365. The rule identifies suspicious token redemption behavior where the initial device code request and the subsequent token redemption occur from disparate IP addresses or utilize different user-agent strings, which is indicative of EvilTokens or similar adversary-in-the-middle (AiTM) device-code phishing frameworks.
Detects high-privilege OAuth application consent grants (such as Mail.Read or Files.ReadWrite.All) occurring within four hours of a risky or anomalous user sign-in. This sequence indicates a potential compromise where an attacker uses a compromised account to authorize a malicious OAuth application for persistent access and data exfiltration.
Detects instances where a user account performs non-interactive or legacy authentication (e.g., IMAP, POP3, SMTP, ActiveSync) shortly after an endpoint associated with that same user is flagged for malware or infostealer activity. This pattern is indicative of an adversary using exfiltrated credentials to maintain access to cloud services while bypassing MFA policies.
Detects a sequence of events where a user account triggers a high-risk or anomalous sign-in (e.g., token-replay, AitM, impossible travel), followed within 12 hours by that same user modifying, deleting, or narrowing the scope of Conditional Access or identity security policies. This behavior is indicative of an attacker attempting to establish persistence, strip MFA requirements, or bypass location restrictions after gaining initial cloud account access.
Detects the assignment of a highly privileged administrative or directory role to a user or service principal following a high-risk or anomalous sign-in event. This pattern is indicative of potential session hijacking where an adversary attempts to escalate privileges within a cloud environment after gaining initial access to a compromised account.
This rule detects anomalous Privileged Identity Management (PIM) or Just-in-Time (JIT) role activation events. It identifies when a user activates a privileged role following suspicious activity such as a risky sign-in, during unusual (off-hours) time windows, or from an unfamiliar source IP address, potentially indicating session hijacking or credential abuse.
Detects sign-in events to high-privileged cloud management consoles (e.g., Azure Portal, Microsoft Entra, Intune, Okta, AWS, GCP) originating from sessions with elevated risk or anomalous characteristics. The detection monitors for factors such as the use of anonymized IP addresses, unmanaged devices, sessions marked as 'atRisk' by identity providers, or non-interactive service-based access to management APIs that deviate from standard administrative workflow patterns.
Detects anomalous, high-velocity authentication activity where a single identity accesses multiple high-value SaaS applications (such as CRM, DevOps, or admin consoles) in a short time frame, correlated with risk signals indicative of token reuse or 'pass-the-cookie' attacks.
Detects 'Add member to role' operations in Entra ID where high-privileged directory roles are assigned to a user or service principal. This pattern is often a critical indicator of privilege escalation in account compromise scenarios where an attacker attempts to elevate their own or a secondary account's permissions within the tenant.
Detects the addition of new client secrets or certificates to existing applications or service principals in Azure AD. This activity is a common method for adversaries to establish persistence in a cloud environment by ensuring they maintain MFA-exempt application-level access even if compromised user accounts or session cookies expire.
Detects anomalous authentication patterns where a user account accesses a large number of distinct SaaS/SSO resources within a short time frame from devices or IP addresses not previously associated with the user's historical baseline. This behavior is indicative of a stolen session cookie being replayed by an adversary to perform rapid lateral movement across the victim's cloud footprint.
Detects the granting of high-risk OAuth application scopes (e.g., Mail.Read, offline_access) within two hours of a risky sign-in event for the same user. This pattern is indicative of attackers establishing persistence and maintaining access to sensitive data (such as emails or files) even after potential credential resets.
Detects non-interactive sign-in events in Entra ID that occur without a preceding interactive sign-in session on the same device that successfully satisfied a multi-factor authentication (MFA) challenge. This behavior is indicative of token replay attacks or session hijacking where an adversary attempts to use harvested session cookies or tokens to access resources.
Page 31 of 184