Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
694
181
114
75
54
Contributors
328
252
122
76
71
Categories
726
700
220
196
148
Platforms
1,120
187
161
59
51
Products / Services
10,643
9,755
6,688
4,418
3,745
1,153
MITRE Techniques
699
428
360
209
197
CVEs
2
2
1
1
1
IDS Classtypes
4
3
1
1
IDS Protocols
8
This rule detects the enumeration of members within groups in Microsoft Entra ID (formerly Azure AD) via the Microsoft Graph API. Specifically, it looks for GET requests to the `/v1.0/groups/*/members` endpoint, which is indicative of an attempt to list group members. The rule's description notes that it is based on the behavior of the GraphRunner tool's `Get-SecurityGroups` function, suggesting it targets a specific method of enumeration.
This rule detects the enumeration of applications and service principals within Microsoft Entra ID (formerly Azure AD) via the Microsoft Graph API. Specifically, it looks for two sequential GET requests: one to the `/v1.0/applications` endpoint and another to the `/v1.0/servicePrincipals(appId='<GUID>')/appRoleAssignedTo` endpoint. This activity is indicative of tools like GraphRunner's Invoke-DumpApps function, which collects information about applications, external applications, and users who have consented to permissions within those applications. The rule correlates these events by IP address and session ID within a 5-minute window.
This rule identifies enumeration of user inboxes within an Entra ID tenant via the Microsoft Graph API. It specifically looks for multiple GET requests to the `/v1.0/users/*/mailFolders/Inbox/messages` endpoint from a single IP address and session within a 5-minute window. The detection is based on the behavior of tools like Invoke-GraphOpenInboxFinder in GraphRunner, but is applicable to any tool performing similar inbox scanning. The rule provides outcomes detailing the number of scanned users, successful accesses (HTTP 200), forbidden accesses (HTTP 403), and not found inboxes (HTTP 404).
This rule detects the use of the GraphRunner tool's Invoke-GraphRecon command to enumerate permissions and conditional access data within the Microsoft Graph API. It specifically looks for a sequence of three API calls: 'estimateAccess', '/me', and 'policies/authorizationPolicy' originating from the same IP address and within a 5-minute window. This activity is indicative of an attacker or red teamer performing reconnaissance on an Azure AD environment.
This rule identifies when the HTTP DELETE method is used within the Microsoft Graph API. This can indicate administrative activities such as deleting users, groups, or other resources. The rule specifically looks for network HTTP events where the product event type is 'Microsoft Graph Activity' and the HTTP method is 'DELETE'. It excludes IP addresses within a specific Azure CIDR range (20.151.0.0/16) to reduce noise from internal Azure operations. Further tuning can be applied to target specific API endpoints or user agents.
This rule detects requests to the Microsoft Graph API endpoint for listing applications (https://graph.microsoft.com/v1.0/applications). This activity can be indicative of reconnaissance by an attacker attempting to enumerate applications within an Entra ID (Azure AD) environment. The rule specifically looks for successful GET requests (HTTP 200 response code) to this endpoint.
This rule detects calls to the undocumented 'Estimate Access' API in Microsoft Graph. This API is used by tools like GraphRunner for reconnaissance purposes, specifically to determine what actions a user can perform. While not inherently malicious, its use can indicate an adversary attempting to enumerate permissions or discover accessible resources within an Azure environment. The rule filters for successful POST requests to the specific beta endpoint and excludes certain Microsoft IP ranges to reduce false positives.
This rule detects the enumeration of both users and group members within an Entra ID (formerly Azure Active Directory) tenant via the Microsoft Graph API. It specifically looks for two distinct HTTP GET requests originating from the same IP address and within a 15-minute window: one targeting the `/v1.0/users` endpoint and another targeting the `/v1.0/groups/*/members` endpoint. This activity is often associated with reconnaissance efforts, such as those performed by tools like GraphRunner, to map out an organization's user and group structure.
This rule detects the creation of new applications within Microsoft Entra ID (formerly Azure AD). While application creation can be a legitimate administrative activity, frequent or unauthorized creation of applications can indicate malicious activity, such as an attacker establishing persistence, creating backdoors, or setting up infrastructure for further attacks. The rule specifically looks for 'Add application' events in the Azure AD Directory Audit logs.
This rule detects HTTP 400 Bad Request errors when attempting to interact with the Microsoft Graph API's /v1.0/groups endpoint via a POST request. This specific activity can indicate a failed attempt to duplicate a group, potentially by tools like GraphRunner's Invoke-SecurityGroupCloner function. It focuses on identifying issues during group creation or modification operations within Azure AD through the Graph API.
This rule detects successful group deletion events within Microsoft Entra ID (formerly Azure AD). It specifically looks for audit logs where the event type is 'GROUP_DELETION', the product event type is 'Delete group', the product is 'Azure AD Directory Audit', the vendor is 'Microsoft', and the security result indicates the action was 'ALLOW'. The rule also groups these events by user over a 5-minute window.
This rule detects when an excessive number of permissions are changed for an application within Microsoft Entra ID (formerly Azure AD). While adding permissions is a normal activity, a sudden increase in the number of permissions granted to an application, exceeding a defined threshold (currently 5), could indicate malicious activity such as an attacker attempting to escalate privileges or broaden access for a compromised application. The rule specifically looks for 'Update application' events in Azure AD Directory Audit logs where the 'RequiredResourceAccess' attribute changes significantly.
This rule detects the hard deletion of an application within Entra ID (formerly Azure AD). A 'hard delete' means the application is permanently removed without a recovery option, which can indicate malicious activity such as an attacker attempting to remove traces of their presence or disrupt services by deleting critical applications.
This rule detects when an application in Entra ID (formerly Azure AD) is restored. This action implies that the application was previously soft-deleted and is now being recovered. This could be an administrative action to recover a mistakenly deleted application or could indicate an attempt to restore a malicious application that was previously removed.
This rule detects when an application is deleted in Entra ID (formerly Azure AD). This action is a soft delete, meaning the application can still be recovered. Detection is based on specific event types and product names within Azure AD audit logs.
Detects authentication to O365 followed by a non-interactive sign-ins that aligns to suspicious activity.
Identify the use GraphRunner's Invoke-DumpApps function to collect applications and external apps as well as users that consented to permissions in their apps.
Identify the enumeration of members within groups in Entra ID. This is based on GraphRunner Get-SecurityGroups function behavior so modifications may be needed for other scenarios
This detects when the groups endpoint is called in the Graph API. GraphRunner contains a function called Get-DynamicGroups but other tools may as well.
Identify when mailboxes are being accessed with requests for N number of messages
Adding permissions to an application is expected, however if excessive permissions are changed at one time over a defined threshold, it may be worth validating.
Page 52 of 55