Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,936
7,266
6,537
3,866
3,647
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects high-frequency, multi-action data access events through the Microsoft Graph API, indicative of automated exfiltration of Exchange, SharePoint/OneDrive, and Teams data. This behavior is consistent with an adversary using stolen OAuth access tokens to perform bulk enumeration and extraction of sensitive cloud-hosted data.
Detects administrator-privileged actions in JFrog Artifactory audit logs attributed to the 'token:anonymous' identity, the tell-tale signature left when CVE-2026-42018 (unauthenticated token retrieval) is chained with CVE-2026-42016 (privilege escalation) to mint an admin-scope token that retains the anonymous username. Also relevant to CVE-2026-82329 authentication bypass activity.
This rule monitors email or communication logs for phishing lures themed around 'passkey' or 'sso' (Single Sign-On). It looks for indicators of urgency, helpdesk impersonation, or targeting of personal devices, which are often precursors to Adversary-in-the-Middle (AiTM) or device-code phishing attacks.
This rule monitors for OAuth device-code authentication flow completions initiated from devices flagged as non-compliant or unmanaged in Azure AD. This behavior is indicative of potential token theft via vishing or SMS-based phishing lures (consistent with Storm-3121/Storm-3032 TTPs), where an adversary tricks a user into completing a device authorization grant to facilitate MFA bypass and persistence.
Detects sign-in failures in Azure Active Directory specifically linked to MFA error codes 50074 (MFA required) or 50140 (MFA interruption/continuation). This logic monitors for users who are unable to complete the MFA challenge during the OfficeHome sign-in process, which may indicate issues with MFA registration, configuration, or an attempt to bypass MFA requirements.
This rule detects successful authentication events for any user within the monitored environment. This serves as a foundational building block for detecting anomalous user behavior, particularly when combined with additional identity provider audit logs such as MFA method usage or registration timestamps to identify potential MFA bypass or persistence via newly registered MFA devices.
Detects anomalous activity in Microsoft Graph API logs where a single identity (user or application) performs a high volume of requests across multiple sensitive administrative categories, such as directory role management, authentication method modification, application or service principal changes, and OAuth consent operations. This pattern is indicative of potential unauthorized reconnaissance, privilege escalation, or persistence attempts within an Azure/Microsoft 365 environment.
Detects anomalous or high-volume activity related to Microsoft Graph API calls targeting email messages, mail folders, or attachments. This behavior is indicative of potential unauthorized bulk email collection or exfiltration attempts, often observed in account compromise scenarios where an attacker enumerates and downloads mail contents.
Detects login events to the 'My Sign-Ins' portal (mysignins.microsoft.com) by users. This portal is a high-value target for adversaries who have gained access to a session via token theft or session hijacking, as it allows them to modify or add authentication methods (such as MFA devices) to establish long-term persistence in the victim's account.
Detects anomalous, high-volume access to Exchange Online via the REST API, potentially indicating programmatic exfiltration of email content. This rule monitors for specific suspicious Application IDs, Account Display Names, or Account Object IDs that exceed a threshold of 500 Exchange REST events, which is characteristic of mass-email collection patterns often seen in cloud-based identity compromises.
This rule monitors various logs (device network events, Entra ID sign-ins, cloud application events, and email events) for any interaction with a predefined list of indicator IP addresses identified as being associated with malicious actor egress traffic.
Detects a single user account authenticating, performing Graph API reconnaissance, and conducting data exfiltration across three distinct source IP addresses within a one-hour window. This behavior is indicative of threat actors like Storm-3121 or Storm-3032 rotating infrastructure per attack stage to evade network-based detection.
Detects when a user registers a new MFA or authentication method, such as a software token or authenticator app, within one hour of a suspicious sign-in event. This pattern is commonly indicative of an adversary establishing persistence or bypassing authentication controls following account compromise via phishing or credential harvesting.
Detects a single user account authenticating, performing Graph API reconnaissance, and conducting data exfiltration across three distinct source IP addresses within a one-hour window. This behavior is indicative of threat actors like Storm-3121 or Storm-3032 rotating infrastructure per attack stage to evade network-based detection.
This rule detects potential identity compromise via abuse of the OAuth device-code grant flow. It monitors for successful user logins leveraging the device code flow, which is a common indicator of AiTM (Adversary-in-the-Middle) phishing campaigns that lure users into authorizing malicious applications under pretexts like security updates or SSO re-authentication.
This rule detects potential identity compromise via abuse of the OAuth device-code grant flow. It monitors for successful user logins leveraging the device code flow, which is a common indicator of AiTM (Adversary-in-the-Middle) phishing campaigns that lure users into authorizing malicious applications under pretexts like security updates or SSO re-authentication.
This rule detects HTTP requests to the Microsoft device login endpoint (/devicelogin) that originate from a non-Microsoft referrer domain. This behavior is highly indicative of Adversary-in-the-Middle (AiTM) phishing attacks targeting OAuth device code flows, where a malicious proxy site redirects users to the legitimate Microsoft login page while attempting to capture session tokens.
This rule detects high-volume usage (500+ events per hour) of Microsoft Exchange Online resources by accounts that lack an associated AccountObjectId but utilize a TokenObjectId. This pattern is indicative of service accounts or potentially compromised tokens performing bulk actions, such as mass email access or data collection within the Exchange environment.
This rule detects anomalous behavior where an identity performs multi-category discovery (e.g., users, groups, directory roles, applications) via Microsoft Graph API within a single session, followed by intensive collection of content (files, attachments, or messages). This sequence is indicative of an adversary performing reconnaissance to map an environment before moving to data exfiltration or theft.
Detects anomalous POST requests containing SharePoint 'MSOTlPn_' ToolPane markup directed at pages other than the expected 'ToolPane.aspx'. This pattern is characteristic of attempts to exploit the SPUtility.EnsureAuthentication bypass vulnerability, allowing attackers to access or execute operations on SharePoint pages without proper authentication.
Detects interaction with known infrastructure associated with the PREY-0058 campaign, which utilizes Adversary-in-the-Middle (AiTM) phishing lures mimicking passkey or MFA registration pages to target Microsoft 365 and other SaaS applications.
Page 57 of 142