Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,865 detections
Filters
Last updated
All Time
Detection languages
2,524
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,934
7,265
6,535
3,865
3,645
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
This rule monitors successful user sign-ins using the 'deviceCode' authentication protocol that originate from an IP address previously unseen for that specific user within the last 24 hours. The Device Code flow is commonly targeted in phishing campaigns to bypass traditional credential-based MFA, making anomalous logins using this protocol a high-signal indicator of account compromise.
Detects sign-ins to Office Home or Office365 applications from unmanaged or unknown devices, followed by an unusual amount or variety of activity within SharePoint Online or OneDrive for Business within a two-hour window. This behavior is indicative of potential unauthorized access or account compromise where an actor is using a non-corporate device to interact with sensitive cloud documents.
Detects anomalous authentication patterns in Microsoft 365 logs where a valid session is utilized across multiple distinct devices within a short timeframe (under 5 minutes) without a corresponding multi-factor authentication (MFA) challenge. This behavior is indicative of a session token replay attack, where an adversary uses a stolen session cookie to bypass MFA and access cloud services.
This rule monitors for network connections, firewall traffic, and Entra ID authentication events involving known malicious IP addresses (the 'Wall of Shame'). The rule specifically flags interactions occurring over common VPN ports, suggesting potential unauthorized access or persistence attempts via VPN services.
Detects potential device-code phishing abuse where a successful device code authentication is followed by scripted API activity using common automation user agents within a short time window (10 minutes). This behavior is indicative of an attacker who has successfully phished a user's device code and is immediately leveraging the stolen token to interact with Microsoft Graph, Azure, or Intune services.
Detects potential model weight poisoning or unauthorized integrity compromise by identifying training jobs launched by non-authorized users, model file modifications in production paths that bypass CI/CD approval gates, or integrity mismatches between deployed model artifacts and their corresponding approved training outputs.
Detects potential model weight poisoning or unauthorized integrity compromise by identifying training jobs launched by non-authorized users, model file modifications in production paths that bypass CI/CD approval gates, or integrity mismatches between deployed model artifacts and their corresponding approved training outputs.
This rule detects when a user grants OAuth application permissions for high-risk scopes (e.g., Mail, Files) to an application that was registered within the last 7 days. It correlates this event with subsequent suspicious actions performed by the same user, specifically mailbox rule modifications or file download activity, which are common indicators of post-compromise activity following OAuth consent phishing.
Detects instances where a user account modifies security information, registers a new MFA method, or resets a password shortly after a successful sign-in from a country not observed for that user within the previous 30 days. This pattern is indicative of potential account takeover where an adversary adds persistence or MFA bypass methods to a newly compromised account.
Detects MFA fatigue or push-bombing attacks where a user account experiences an abnormally high volume of MFA request denials in a short duration (10 minutes), followed by a successful authentication event. The rule specifically looks for evidence where the successful authentication potentially originates from a different IP address than the failed attempts.
Detects Azure AD sign-in events using the device code authorization flow where only single-factor authentication was performed. This pattern is indicative of potential device code phishing attacks where users are tricked into entering codes on attacker-controlled pages to grant access tokens, bypassing standard MFA requirements.
Detects a sequence of suspicious activities associated with EvilTokens-style session hijacking. This includes the identification of non-interactive sign-in events involving the redemption of a refresh token without secondary MFA, followed by the creation or modification of Exchange Online mailbox rules to facilitate unauthorized email forwarding or exfiltration.
Detects modifications to Entra ID Conditional Access or Okta authentication policies that introduce MFA exclusions, trusted network bypasses, or authentication-strength downgrades. This activity is highly indicative of an adversary attempting to maintain persistence or bypass MFA following a successful initial account compromise.
Detects high-privilege OAuth application consent grants occurring shortly after a user identity recovery event (e.g., password or MFA reset). This pattern is indicative of a help-desk social engineering attack where an adversary uses an identity reset to gain access to an account and subsequently establishes persistent access via a malicious OAuth application.
Detects a suspicious sequence of events indicating account takeover: a password reset, followed by an MFA factor re-enrollment, and concluding with a successful login from a geographically impossible location compared to recent history. This pattern often signifies a help-desk-assisted account compromise or token theft.
This rule detects potentially malicious Microsoft Graph API activity, such as the enumeration of directory roles, groups, applications, or service principals. It identifies patterns indicative of token theft or unauthorized access by flagging scripted clients (non-browser agents) or accounts showing anomalous behavior (multiple IPs/agents) performing rapid or repetitive enumeration queries.
Detects successful authentication events associated with the Azure AD Device Registration Service (resource ID 01cb2876-7ebd-4aa4-9cc9-d28bd4d359a9). This rule identifies successful registrations or sign-ins to the service, which may be leveraged by adversaries to register unauthorized devices for persistent access or to bypass conditional access policies.
This rule detects high-risk administrative operations in Azure Active Directory (such as role assignment, password resets, and account status changes) that occur within 3 hours of a user's sign-in. This pattern often indicates an account compromise followed by immediate privilege escalation or persistence establishment.
Detects specific administrative actions within Entra ID/Azure AD, including directory role assignments, password resets, and account enablement/disablement. This rule monitors for sensitive identity lifecycle and privilege management events that, if performed by unauthorized actors or in an unexpected context, could indicate account compromise, persistence, or privilege escalation.
Detects instances where the device code authentication protocol is utilized. This protocol is commonly used for headless devices, but is also frequently abused by adversaries for phishing and device code flow abuse to acquire unauthorized access tokens.
Detects anomalous sign-in patterns indicative of real-time MFA relay attacks, where a user principal authenticates successfully from multiple distinct IP addresses and geographical locations within a short time window (15 minutes), suggesting the active interception of credentials and MFA challenges by a Phishing-as-a-Service platform.
Page 52 of 185