Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,865 detections
Filters
Last updated
All Time
Detection languages
2,524
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,934
7,265
6,535
3,865
3,645
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects a multi-stage cloud attack sequence involving a sign-in anomaly, modification of user authentication methods (e.g., registering an attacker-controlled device), reconnaissance using Microsoft Graph API, and subsequent abnormal data access/download, typically observed in Storm-3121 and Storm-3032 activities.
Detects a suspicious sign-in sequence indicative of an Adversary-in-the-Middle (AiTM) phishing attack. The rule identifies a user attempting to sign in from an unmanaged device (triggered by Azure AD error 50074, requiring secondary authentication) followed shortly by an interruption in session persistence (triggered by error 50140) while using a browser user agent, suggesting the session is being relayed through a malicious proxy.
This rule detects potential identity compromise via abuse of the OAuth device-code grant flow. It monitors for successful user logins leveraging the device code flow, which is a common indicator of AiTM (Adversary-in-the-Middle) phishing campaigns that lure users into authorizing malicious applications under pretexts like security updates or SSO re-authentication.
Detects anomalous, high-frequency access to multiple distinct Microsoft Graph API endpoints (e.g., users, groups, applications) by a single user within a short timeframe, which is indicative of tenant-wide reconnaissance following identity compromise.
Detects a suspicious pattern where a user registers a new PhoneAppOTP MFA method and subsequently logs in using this method after a significant time delay (exceeding 3 days). This behavior is indicative of an attacker who has gained temporary access, registered their own MFA device to ensure persistent future access, and returned later to utilize it.
Detects a suspicious pattern where a user registers a new PhoneAppOTP MFA method and subsequently logs in using this method after a significant time delay (exceeding 3 days). This behavior is indicative of an attacker who has gained temporary access, registered their own MFA device to ensure persistent future access, and returned later to utilize it.
This rule detects successful sign-in activity to the 'My Sign-Ins' application where the device is not marked as trusted or the sign-in carries a non-zero risk level. This behavior may indicate an adversary attempting to gain access to account security settings or sensitive portal information using compromised or unmanaged devices.
Detects anomalous, systematic enumeration of multiple Microsoft Graph API resource categories (e.g., users, groups, applications, sites) by a single identity, IP, or application within a short time window. This activity often indicates an adversary performing discovery or reconnaissance against the M365 tenant environment.
Detects a sequence of authentication events indicative of Adversary-in-the-Middle (AiTM) phishing, where a user session experiences MFA-related errors (50074, 50140) followed by a successful sign-in (0). This pattern suggests an adversary proxying credentials and MFA requests in real-time.
Detects anomalous sign-in behavior following a successful device code authentication. The rule identifies instances where a successful device code login is immediately followed by a sign-in session using a different IP address or device name for the same account, indicating potential session theft or adversary-in-the-middle phishing activity.
This rule detects activity associated with the 'Ghostcode' threat campaign by monitoring multiple telemetry sources. It identifies connections to known malicious IP addresses and domains, patterns consistent with phishing kit hosting, and specific URL structures used in credential harvesting or payload delivery. The rule correlates sign-in logs, device network events, DNS queries, and email telemetry to identify potential compromise.
This rule detects device registration, joining, or enrollment events where the DeviceDisplayName follows a specific naming pattern (e.g., 'word-word-alphanumeric-word-hash'). It groups these events by device and user to track frequency, which can help identify potentially automated or malicious device registration behavior.
Detects a suspicious sequence of events where a user initiates a device code authorization flow, immediately followed by a Microsoft Authentication Broker sign-in using the 'sso_reload=true' parameter. This pattern is indicative of an attacker hijacking the device code authorization process to gain unauthorized access to a user's session.
This rule detects suspicious Azure AD sign-in activity originating from a single user account that utilizes the 'deviceCode' authentication protocol while simultaneously exhibiting activity from multiple distinct and highly specific User Agent strings (Python requests library and Microsoft Outlook 16.0.17425). This pattern is indicative of potential token theft or automated credential harvesting where a legitimate OAuth flow is subverted to gain persistent access.
Detects high-volume credential guessing attacks against applications, characterized by a large number of distinct source IP addresses and geographic locations. This pattern is indicative of attackers using residential proxy pools to distribute their attempts, effectively bypassing traditional rate limiting or per-IP WAF thresholds while targeting authentication or error oracles. The rule specifically filters for relevant failure codes and enforces constraints on IP/user diversity to reduce noise from single-point-of-failure events or legitimate infrastructure.
Detects high-volume credential guessing attacks against applications, characterized by a large number of distinct source IP addresses and geographic locations. This pattern is indicative of attackers using residential proxy pools to distribute their attempts, effectively bypassing traditional rate limiting or per-IP WAF thresholds while targeting authentication or error oracles. The rule specifically filters for relevant failure codes and enforces constraints on IP/user diversity to reduce noise from single-point-of-failure events or legitimate infrastructure.
Detects rapid, successive successful interactive sign-ins for the same user account that each satisfy MFA requirements, but originate from geographically and technically distinct environments (different IP locations, ASNs, and device IDs) within a 2-minute window. This behavior is indicative of session hijacking via Adversary-in-the-Middle (AiTM) or Phishing-as-a-Service (PhaaS) frameworks.
Detects rapid, successive successful interactive sign-ins for the same user account that each satisfy MFA requirements, but originate from geographically and technically distinct environments (different IP locations, ASNs, and device IDs) within a 2-minute window. This behavior is indicative of session hijacking via Adversary-in-the-Middle (AiTM) or Phishing-as-a-Service (PhaaS) frameworks.
Detects rapid, successive successful interactive sign-ins for the same user account that each satisfy MFA requirements, but originate from geographically and technically distinct environments (different IP locations, ASNs, and device IDs) within a 2-minute window. This behavior is indicative of session hijacking via Adversary-in-the-Middle (AiTM) or Phishing-as-a-Service (PhaaS) frameworks.
This rule performs a wide aggregation of logs across proxy, cloud, GitHub, and network destination data sources. Because it lacks specific filtering logic or behavioral indicators, it does not detect any specific attack technique and serves only as a broad data collection query.
This rule monitors for network connections, firewall traffic, and Entra ID authentication events involving known malicious IP addresses (the 'Wall of Shame'). The rule specifically flags interactions occurring over common VPN ports, suggesting potential unauthorized access or persistence attempts via VPN services.
Page 65 of 185