Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,866 detections
Filters
Last updated
All Time
Detection languages
2,525
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,936
7,266
6,535
3,866
3,647
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects 'GetBlob' operations on Azure Storage blobs that have extensions commonly associated with executable files, scripts, or archives, which may indicate the retrieval of malicious payloads.
This rule detects potentially malicious OAuth application consent grants in Microsoft Entra ID (formerly Azure AD). It monitors for consent events involving high-risk scopes by non-verified publishers, instances of admins attempting to bypass consent requirements, and follows up by checking for unusually high activity (sign-ins or resource access) from the newly consented application within a short timeframe.
This rule identifies potential MFA fatigue attacks by detecting multiple MFA denial or failure events for a user within a 30-minute window, followed by a successful authentication for the same user in the same time frame.
Detects the execution of AADInternals PowerShell toolkit commands. AADInternals is a known framework used for administration, enumeration, and exploitation of Azure Active Directory and Microsoft Entra ID, including the creation of backdoors and manipulation of federation settings.
This rule monitors for various types of events (user logons, network connections, API audits, cloud app events, and email traffic) originating from a specific CIDR block (160.79.104.0/21), which is flagged as suspicious or unauthorized.
This rule correlates email sender activity with network, cloud, and identity logs by matching traffic against a specific IP range (160.79.104.0/21) identified as malicious or suspicious. The rule flags instances where this range appears as an email sender IP or as a remote/source IP address across various infrastructure indices, potentially indicating adversary communication or exfiltration.
This rule correlates email sender activity with network, cloud, and identity logs by matching traffic against a specific IP range (160.79.104.0/21) identified as malicious or suspicious. The rule flags instances where this range appears as an email sender IP or as a remote/source IP address across various infrastructure indices, potentially indicating adversary communication or exfiltration.
This rule detects various event types (email, identity authentication, network connections, and cloud audit logs) originating from or interacting with the specific IP address range 160.79.104.0/22 to 160.79.111.0/22, which is associated with known malicious activity.
Detects successful sign-ins where Multi-Factor Authentication (MFA) was approved using the 'PhoneAppOTP' method, specifically where the method was registered by the user prior to the observed sign-in timeframe. This pattern can indicate an adversary using an actor-controlled MFA device registered previously to maintain persistent access to a compromised account.
This rule detects administrative updates to a user account in Azure Active Directory (Microsoft Entra ID) that involve modifying authentication methods to include 'SoftwareTokenActivated' associated with HMAC-SHA1 and specific authentication type configurations. Such modifications may indicate an adversary attempting to register a new MFA device or method to maintain persistence or bypass existing security controls.
This rule detects potential reconnaissance activity within a Microsoft Entra ID (Azure AD) environment by monitoring Microsoft Graph API audit logs. It specifically flags accounts that exhibit high-frequency access to sensitive endpoints related to directory roles, role management, authentication methods, service principals, and application permissions. The detection triggers when an identity interacts with multiple distinct sensitive API paths within a 30-minute window, a pattern indicative of an adversary enumerating privileges, MFA configurations, or application consent settings for potential escalation or persistence.
This rule detects anomalous activity where users access Microsoft 365 services (SharePoint, OneDrive, Exchange) through identified anonymous proxy connections. It identifies potentially malicious exfiltration or bulk activity by flagging users who perform a high number of operations (1,000+ events) or download a significant volume of data (5GB+) within a 2-hour window.
Detects changes to user authentication methods, such as activating software tokens, registering new security information, or changing MFA configuration. This activity can indicate an adversary attempting to modify MFA settings to maintain persistent access or bypass account security controls.
This rule detects high-frequency and broad-scope enumeration of multiple Microsoft Graph API endpoints by a single identity. By monitoring for access to diverse sensitive categories (organization, users, groups, directoryroles, sites, messages) within a short timeframe, it flags activity patterns consistent with reconnaissance, account discovery, or unauthorized data exploration.
Detects the registration of a new MFA authentication method (software OTP token or authenticator app) on an Azure AD account, specifically when triggered with 'NO_DEVICE' or 'NO_DEVICE_TOKEN' markers and 'SoftwareTokenActivated' tags. This behavior is indicative of potential attacker persistence following account compromise where a new MFA device is added for future access.
Detects login events to the 'My Sign-Ins' portal (mysignins.microsoft.com) by users. This portal is a high-value target for adversaries who have gained access to a session via token theft or session hijacking, as it allows them to modify or add authentication methods (such as MFA devices) to establish long-term persistence in the victim's account.
Detects the registration of a new MFA authentication method (software OTP token or authenticator app) on an Azure AD account, specifically when triggered with 'NO_DEVICE' or 'NO_DEVICE_TOKEN' markers and 'SoftwareTokenActivated' tags. This behavior is indicative of potential attacker persistence following account compromise where a new MFA device is added for future access.
Detects a single Azure AD identity successfully authenticating from three or more unique IP addresses within a 24-hour window. This behavior is indicative of infrastructure rotation by threat actors, such as those observed in Storm-3121/Storm-3032 campaigns, intended to evade network-based detection and conditional access controls during reconnaissance or exfiltration phases.
Detects a suspicious sequence of events where a user's password is changed or reset by an administrator (or help-desk role) followed within a short time window by that same user registering a new MFA device, potentially indicating a vishing-based account takeover attack (e.g., PREY-0058/UNC6671).
Detects high-volume image pull activity against an Azure Container Registry from a single identity, which may indicate reconnaissance or mass harvesting of container images to extract embedded credentials, secrets, or source code.
This rule detects potential Server-Side Request Forgery (SSRF) activity where web application or runtime processes attempt to access the Cloud Instance Metadata Service (IMDS) or container task metadata endpoints. By monitoring network connections and application logs, the rule filters out known legitimate metadata clients and identifies suspicious processes frequently associated with web-based vulnerabilities that are repeatedly querying sensitive metadata paths.
Page 69 of 185