Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects anomalous reconnaissance activity targeting sensitive Microsoft Graph control-plane endpoints, including directory roles, MFA settings, application registrations, service principals, and OAuth consent configurations. The rule identifies high-volume access across multiple distinct sensitive endpoints within a short time frame, which is indicative of an adversary enumerating infrastructure to identify opportunities for privilege escalation, persistence, or bypass of security controls.
Detects anomalous authentication behavior where a user successfully completes an OAuth device-code grant, followed by a subsequent login event using the same user context but originating from a different source IP address. This pattern is indicative of device-code phishing, where an adversary tricks a user into authorizing a device, then uses the resulting session or token from their own infrastructure.
Detects anomalous, high-frequency access to multiple distinct Microsoft Graph API endpoints (e.g., users, groups, applications) by a single user within a short timeframe, which is indicative of tenant-wide reconnaissance following identity compromise.
Detects high-frequency requests to Microsoft Graph API endpoints related to messages, mailFolders, or attachments, indicative of an adversary performing mailbox reconnaissance or data collection via cloud APIs.
Detects anomalous, high-volume activity directed at SharePoint and OneDrive Graph API endpoints (e.g., /sites, /drives, /search, /children). The activity pattern, characterized by multiple distinct path requests and the usage of pagination tokens within a short timeframe, strongly indicates an adversary attempting to map the file structure and contents of a repository prior to data collection or exfiltration.
This rule detects high-volume file access, preview, or download activity from SaaS applications (SharePoint, OneDrive, Exchange Online) originating from IP addresses classified as anonymous proxies. The threshold is set to 1000 events within a 2-hour window, which is indicative of automated, high-speed data exfiltration rather than standard user behavior.
Detects anomalous, high-volume enumeration of SharePoint and OneDrive resources via Microsoft Graph API by monitoring for repeated access patterns involving /sites, /drives, or /drive endpoints combined with search, directory traversal, and pagination parameters.
Detects anomalous or high-volume activity related to Microsoft Graph API calls targeting email messages, mail folders, or attachments. This behavior is indicative of potential unauthorized bulk email collection or exfiltration attempts, often observed in account compromise scenarios where an attacker enumerates and downloads mail contents.
Detects anomalous or high-volume activity related to Microsoft Graph API calls targeting email messages, mail folders, or attachments. This behavior is indicative of potential unauthorized bulk email collection or exfiltration attempts, often observed in account compromise scenarios where an attacker enumerates and downloads mail contents.
Detects anomalous, high-volume file access (downloading, accessing, or previewing) in cloud applications that originates from an IP address identified as an anonymous proxy. This behavior is indicative of potential data exfiltration or unauthorized mass data collection.
Detects suspicious reconnaissance or modification activity within Microsoft Graph API by identifying high volumes of requests targeting sensitive management endpoints (such as directory roles, authentication methods, service principals, or OAuth permissions) from a single actor within a 30-minute window.
Detects anomalous Microsoft Graph API usage patterns where a single account interacts with a high number of unique request paths using common API pagination or search parameters, indicating potential resource enumeration or reconnaissance activity.
Detects high-volume, potentially malicious email campaigns characterized by discount-themed subject lines containing keywords like '65% off' and links pointing to '.shop' domains. The rule identifies suspicious patterns by aggregating events and flagging instances where multiple users are targeted with similar subjects and domains, excluding those specifically allowlisted.
Detects non-interactive sign-ins, such as those using refresh or session tokens, originating from an IP address, ASN, device, or country that does not match the user's recent interactive sign-in history. The absence of an MFA challenge for these new contexts is characteristic of session token replay attacks, often associated with AiTM phishing campaigns.
Detects anomalous sign-in behavior where a device code authentication flow is initiated from one location, but the resulting session is replayed from a different IP address in a different country within a one-hour window. This behavior is indicative of an adversary capturing an authentication token via a device code phishing or relay attack and attempting to use it from their own infrastructure to bypass conditional access policies and MFA.
Detects instances where a user authenticates via the device code flow and subsequently performs a device enrollment or registration action from an unusual or non-compliant device naming convention. This pattern is indicative of an adversary enrolling their own device to bypass MFA or gain persistent access to corporate resources.
This rule detects potential OAuth 2.0 device code phishing attempts by monitoring network activity for requests to common Microsoft OAuth device authorization endpoints. It flags requests that utilize a specific hardcoded client_id associated with known suspicious application registrations, combined with requested scopes for graph.microsoft.com and a Python-based user agent. This behavior is indicative of an adversary attempting to gain unauthorized access by tricking a user into authorizing a malicious application.
This rule detects potential OAuth 2.0 device code phishing attempts by monitoring network activity for requests to common Microsoft OAuth device authorization endpoints. It flags requests that utilize a specific hardcoded client_id associated with known suspicious application registrations, combined with requested scopes for graph.microsoft.com and a Python-based user agent. This behavior is indicative of an adversary attempting to gain unauthorized access by tricking a user into authorizing a malicious application.
Detects instances where a user successfully authenticates using the OAuth Device Code flow followed by subsequent mailbox operations (such as reading, sending, or deleting items) from a different IP address within a 10-minute window. This behavior is a strong indicator of adversary-in-the-middle phishing attacks where an attacker captures a session token and utilizes it from a remote location.
This rule monitors Entra ID Audit Logs for device registration events where the display name of the registered device matches a specific naming pattern used by the GhostCode phishing kit. The pattern typically consists of three dash-separated words, a dash-separated hex string, and an optional suffix, which is indicative of automated phishing-based device enrollment.
This rule monitors Entra ID Audit Logs for device registration events where the display name of the registered device matches a specific naming pattern used by the GhostCode phishing kit. The pattern typically consists of three dash-separated words, a dash-separated hex string, and an optional suffix, which is indicative of automated phishing-based device enrollment.
Page 71 of 179