Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
This rule detects potential reconnaissance activity within a Microsoft Entra ID (Azure AD) environment by monitoring Microsoft Graph API audit logs. It specifically flags accounts that exhibit high-frequency access to sensitive endpoints related to directory roles, role management, authentication methods, service principals, and application permissions. The detection triggers when an identity interacts with multiple distinct sensitive API paths within a 30-minute window, a pattern indicative of an adversary enumerating privileges, MFA configurations, or application consent settings for potential escalation or persistence.
This rule detects anomalous activity where users access Microsoft 365 services (SharePoint, OneDrive, Exchange) through identified anonymous proxy connections. It identifies potentially malicious exfiltration or bulk activity by flagging users who perform a high number of operations (1,000+ events) or download a significant volume of data (5GB+) within a 2-hour window.
This rule detects successful user authentication events within the environment. It acts as a base filter to capture login success, which can be further refined with context such as IP addresses or usernames to monitor for anomalous login patterns, though it does not inherently provide detection of complex attacks like session token hijacking on its own.
Detects instances where a user or entity accessing a file (download, access, or preview) originates from an IP address identified as an anonymous proxy. This rule is designed to be used with a downstream aggregation tool to identify potentially unauthorized data exfiltration or access via anonymization services.
This rule detects high-frequency interaction with the Exchange REST API originating from user agents identified as 'One Outlook Web', potentially indicative of automated password spraying or brute force attacks targeting cloud mailboxes. This rule identifies the underlying event pattern and should be paired with a scheduled/aggregation rule to detect the volume threshold (e.g., 500+ events per hour).
Detects messages sent through Microsoft Teams containing common phishing pretexts such as 'passkey', 'SSO update', or 'help desk'. This pattern is often used in credential harvesting campaigns where an attacker impersonates IT or support personnel to lure users into providing credentials or performing authentication-related actions.
Detects changes to user authentication methods, such as activating software tokens, registering new security information, or changing MFA configuration. This activity can indicate an adversary attempting to modify MFA settings to maintain persistent access or bypass account security controls.
This rule detects high-frequency and broad-scope enumeration of multiple Microsoft Graph API endpoints by a single identity. By monitoring for access to diverse sensitive categories (organization, users, groups, directoryroles, sites, messages) within a short timeframe, it flags activity patterns consistent with reconnaissance, account discovery, or unauthorized data exploration.
This rule detects anomalous, high-volume file access or download activity across cloud applications and file storage services. It tracks users over a period of time, flagging individuals whose daily activity consistently contributes to a large total volume of data access (exceeding 500MB) over at least five days, specifically looking for sustained behavior that deviates from sudden, single-day spikes.
Detects potential social engineering attacks in Microsoft Teams where an internal user sends multiple messages containing terms related to MFA, SSO, or passkey updates, potentially attempting to harvest credentials from other users.
This rule detects potentially malicious or automated data access patterns within Microsoft 365 or similar cloud environments. It identifies user accounts or applications that exhibit a high volume of file/email access operations across a diverse set of paths, which is often indicative of automated data exfiltration, scraping, or suspicious collection by a compromised identity.
Detects the registration of a new MFA authentication method (software OTP token or authenticator app) on an Azure AD account, specifically when triggered with 'NO_DEVICE' or 'NO_DEVICE_TOKEN' markers and 'SoftwareTokenActivated' tags. This behavior is indicative of potential attacker persistence following account compromise where a new MFA device is added for future access.
Detects anomalous data access or collection activity across multiple M365 workloads (SharePoint, OneDrive, Exchange). The rule identifies users exhibiting high volumes of file or mail access across at least two distinct workloads within a one-hour window, which may indicate account compromise, bulk data exfiltration, or unauthorized persistence via mailbox rules.
Detects the registration of a new MFA authentication method (software OTP token or authenticator app) on an Azure AD account, specifically when triggered with 'NO_DEVICE' or 'NO_DEVICE_TOKEN' markers and 'SoftwareTokenActivated' tags. This behavior is indicative of potential attacker persistence following account compromise where a new MFA device is added for future access.
Detects automated file access and download operations in SharePoint or OneDrive performed by the 'python-httpx' library. This behavior may indicate an attacker using scripts or automated tools to perform unauthorized data collection or exfiltration, often observed in automated cloud compromise scenarios.
Detects Microsoft Teams messages containing lures related to passkey, SSO, or MFA updates, which are frequently used by attackers to solicit user credentials or trick users into compromising their account security.
Detects Microsoft Teams messages containing lures related to passkey, SSO, or MFA updates, which are frequently used by attackers to solicit user credentials or trick users into compromising their account security.
Detects a suspicious sequence of events where a user's password is changed or reset by an administrator (or help-desk role) followed within a short time window by that same user registering a new MFA device, potentially indicating a vishing-based account takeover attack (e.g., PREY-0058/UNC6671).
Detects when a user registers a new MFA or authentication method, such as a software token or authenticator app, within one hour of a suspicious sign-in event. This pattern is commonly indicative of an adversary establishing persistence or bypassing authentication controls following account compromise via phishing or credential harvesting.
Detects anomalous authentication behavior where a user successfully completes an OAuth device-code grant, followed by a subsequent login event using the same user context but originating from a different source IP address. This pattern is indicative of device-code phishing, where an adversary tricks a user into authorizing a device, then uses the resulting session or token from their own infrastructure.
Detects anomalous, high-frequency access to multiple distinct Microsoft Graph API endpoints (e.g., users, groups, applications) by a single user within a short timeframe, which is indicative of tenant-wide reconnaissance following identity compromise.
Page 70 of 179