Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,865 detections
Filters
Last updated
All Time
Detection languages
2,524
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,934
7,265
6,535
3,865
3,645
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects high-privilege OAuth application consent grants occurring shortly after a user identity recovery event (e.g., password or MFA reset). This pattern is indicative of a help-desk social engineering attack where an adversary uses an identity reset to gain access to an account and subsequently establishes persistent access via a malicious OAuth application.
In DeviceNetworkEvents, we can find both JA4 and JA4S inside AdditionalFields for some TLS connections. This is interesting because we can look at both sides of the same TLS communication. We can compare clients, servers and JA4/JA4S combinations, and look for patterns or connections that behave differently from what we normally see. The following KQL extracts and decodes both fingerprints from the same network event.
Detects high-privileged Entra ID accounts successfully reaching the verification stage of the Self-Service Password Reset (SSPR) process. While SSPR is automatically enabled for administrative accounts, this activity is anomalous and potentially indicates an attacker focusing on discovered privileged accounts after performing broader enumeration.
Detects anomalous, high-volume account enumeration against the Microsoft Self-Service Password Reset (SSPR) endpoint from a single source IP. The rule identifies a pattern of mixed response codes, specifically interleaving '50034' (Account does not exist) with successful or other outcomes, which indicates the use of automated tools to validate the existence of corporate accounts via response differentiation.
This rule detects potentially suspicious reconnaissance activity against the Microsoft Graph API. It monitors for high volumes of diverse requests originating from a single account within a 30-minute window, specifically targeting multiple distinct object types such as users, groups, sites, and applications. Such behavior is indicative of an adversary attempting to enumerate or map the target cloud environment.
This rule detects successful user logins that utilize the 'deviceCode' authentication protocol in conjunction with suspicious network indicators, specifically traffic originating from residential proxies. This combination is highly indicative of potential phishing or unauthorized access attempts using stolen session tokens or bypassed MFA mechanisms.
Detects instances where a user performs sensitive privilege escalation or administrative modifications (e.g., adding roles, consent to applications) within two hours of authenticating via the Entra ID device-code flow. This correlation is often indicative of OAuth application device-code phishing or token abuse, where an attacker tricks a user into granting permissions to a malicious application.
This rule detects successful user logins utilizing the OAuth 2.0 device authorization grant flow where Multi-Factor Authentication (MFA) was bypassed, not applied, or not performed. The device code flow is a common vector for phishing attacks where users are tricked into entering a device code on a malicious site, potentially leading to unauthorized token acquisition.
This rule monitors Microsoft Graph API audit events to detect potentially malicious reconnaissance or enumeration activity. It identifies actors who access a diverse range of resource categories (such as directory, tenant, privilege, application, repository, and mailbox) within a short 30-minute window, suggesting automated discovery or unauthorized data mapping rather than standard administrative tasks.
This rule detects potential unauthorized access to the 'My Sign-Ins' portal in Azure AD by monitoring for logins associated with multiple unique source IP addresses or Autonomous System Numbers (ASNs) for a single user account. This behavior is indicative of session hijacking or account compromise where an adversary is accessing the account from a different network than the legitimate user.
Detects high-volume or sequential Microsoft Graph API requests targeting sensitive directory, mailbox, application, and site endpoints. This behavior is consistent with reconnaissance activity where an adversary enumerates users, groups, service principals, and accessible resources within a compromised cloud tenant.
This rule detects non-interactive authentication attempts to key development and collaboration platforms (e.g., GitHub, GitLab, Slack, Azure DevOps) from IP addresses or locations that have not been observed in the user's interactive sign-in history over the past 14 days. This behavior is indicative of potential session or refresh token theft, where an adversary replays stolen browser cookies from a different infrastructure to bypass traditional authentication.
This rule identifies enterprise resource access from OnePlus or OxygenOS devices that lack proper management or compliance. It calculates an exposure score based on factors including device management status, compliance state, device trust type, and whether the device is newly observed. The rule flags high and medium priority exposure incidents, specifically targeting non-managed or non-compliant BYOD devices, which could represent an increased risk profile for corporate data access.
This rule identifies enterprise resource access from OnePlus or OxygenOS devices that lack proper management or compliance. It calculates an exposure score based on factors including device management status, compliance state, device trust type, and whether the device is newly observed. The rule flags high and medium priority exposure incidents, specifically targeting non-managed or non-compliant BYOD devices, which could represent an increased risk profile for corporate data access.
This rule identifies enterprise resource access from OnePlus or OxygenOS devices that lack proper management or compliance. It calculates an exposure score based on factors including device management status, compliance state, device trust type, and whether the device is newly observed. The rule flags high and medium priority exposure incidents, specifically targeting non-managed or non-compliant BYOD devices, which could represent an increased risk profile for corporate data access.
Detects modifications to Microsoft Entra ID (Azure AD) Conditional Access policies that weaken security controls, such as disabling policies, adding exclusions, or removing MFA and compliant device requirements. The rule also alerts on deletions of Conditional Access policies and modifications occurring outside of standard business hours.
Detects successful device code authentication flows involving applications that are not part of a known list of standard Microsoft and Azure client applications. Device code flows are frequently abused in phishing attacks to bypass traditional credential-based authentication.
Detects when a user registers a new MFA or authentication method, such as a software token or authenticator app, within one hour of a suspicious sign-in event. This pattern is commonly indicative of an adversary establishing persistence or bypassing authentication controls following account compromise via phishing or credential harvesting.
Detects anomalous reconnaissance activity targeting sensitive Microsoft Graph control-plane endpoints, including directory roles, MFA settings, application registrations, service principals, and OAuth consent configurations. The rule identifies high-volume access across multiple distinct sensitive endpoints within a short time frame, which is indicative of an adversary enumerating infrastructure to identify opportunities for privilege escalation, persistence, or bypass of security controls.
This rule detects successful or attempted sign-ins to Microsoft Entra ID using the OAuth 2.0 device authorization grant flow. This specific authentication flow is increasingly leveraged by adversaries in passkey-themed phishing campaigns to obtain valid access and refresh tokens without requiring direct credential or cookie theft. By monitoring for this protocol usage, security teams can identify potential attempts to bypass traditional authentication mechanisms.
This rule monitors for updates to a user's multi-factor authentication (MFA) configuration, specifically detecting when a new device is registered or activated. Attackers often register their own devices as MFA second factors to maintain persistent access to a compromised user account.
Page 53 of 185