Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,866 detections
Filters
Last updated
All Time
Detection languages
2,525
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
This rule detects proxy requests directed to the legitimate Microsoft OAuth 2.0 device authorization endpoint (/common/oauth2/deviceauth). This activity is indicative of OAuth device code phishing, where a user is tricked into entering a malicious or attacker-provided device code into the legitimate Microsoft device login page to complete an authentication flow and grant unauthorized access to an attacker-controlled application.
This rule detects modifications to Azure Service Principal and Application object redirect URIs that match known patterns for reverse proxies, tunneling services, temporary callback infrastructure, or potential local token theft. Such changes may indicate an adversary attempting to establish persistent access, intercept authentication tokens, or bypass network controls via unauthorized application configurations.
Detects successful authentication events using the OAuth device code flow. This flow is often abused by adversaries to perform OAuth phishing, where a user is tricked into authorizing a malicious application, granting it access tokens to cloud resources.
Detects successful Azure AD sign-in events authenticated via the device code flow that subsequently access Microsoft 365 resources such as Outlook, SharePoint, OneDrive, or Teams. This pattern is consistent with post-compromise use of OAuth tokens obtained through device-code phishing.
Detects HTTP POST requests to the Microsoft login endpoint for OAuth2 tokens using the client_credentials grant type, where the request body contains evidence of hardcoded client_secret parameters and specific scopes. This behavior often indicates an application or script with embedded, potentially leaked or insecurely stored, credentials being used to authenticate against Microsoft cloud services.
This rule detects proxy requests directed to the legitimate Microsoft OAuth 2.0 device authorization endpoint (/common/oauth2/deviceauth). This activity is indicative of OAuth device code phishing, where a user is tricked into entering a malicious or attacker-provided device code into the legitimate Microsoft device login page to complete an authentication flow and grant unauthorized access to an attacker-controlled application.
Detects successful authentication events using the OAuth device code flow. This flow is often abused by adversaries to perform OAuth phishing, where a user is tricked into authorizing a malicious application, granting it access tokens to cloud resources.
Detects successful Azure AD sign-in events authenticated via the device code flow that subsequently access Microsoft 365 resources such as Outlook, SharePoint, OneDrive, or Teams. This pattern is consistent with post-compromise use of OAuth tokens obtained through device-code phishing.
Detects successful Azure AD sign-in events authenticated via the device code flow that subsequently access Microsoft 365 resources such as Outlook, SharePoint, OneDrive, or Teams. This pattern is consistent with post-compromise use of OAuth tokens obtained through device-code phishing.
This rule analyzes Microsoft Entra (Azure AD) sign-in logs over a 30-day period for access to sensitive administrative applications (e.g., Azure Portal, Microsoft Intune, Defender). It flags user-application-IP sessions that exhibit unusual characteristics, such as login successes following failures, access from multiple geographic locations, or the use of multiple client types, which may indicate account compromise or unauthorized access.
Detects GET requests to the Microsoft Graph API 'organization' endpoint, often used by malicious tools to validate a tenant environment or gather metadata before initiating C2 communication or secondary stages of an attack.
Entra ID Device Registration Event
Cortex XDR
Detects device registration events within Entra ID. Attackers may register their own device to a compromised account to maintain persistent access or satisfy device-compliance conditional access policies.
Detects rapid sequence of unsuccessful (401) followed by successful (201) POST requests to the WordPress user API endpoint from the same source IP, indicating potential brute force or account enumeration attempts.
This rule detects non-interactive sign-in events involving the 'Microsoft Authentication Broker' where the authentication was performed using only single-factor authentication and originated from a device that is not recognized or lacks trust information (unmanaged/unknown device). This pattern is consistent with token replay attacks or session hijacking, where an adversary uses stolen authentication artifacts to access resources without undergoing standard multi-factor authentication.
Detects the creation of user accounts or identity updates that utilize naming conventions or email domains associated with 'wp2shell' malicious activity patterns. This is commonly used in WordPress exploitation scenarios to establish persistent unauthorized administrative access.
Detects Microsoft Entra ID sign-in events using the Resource Owner Password Credentials (ROPC) flow where the client application displays a blank name. This pattern is commonly associated with attackers spoofing OAuth client IDs to bypass security controls or perform user enumeration.
Detects anomalous sign-in behavior where a single unique token identifier is used from multiple IP addresses, countries, or devices within a short timeframe (less than one hour). This pattern is often indicative of session token theft, where an adversary uses an exfiltrated token to authenticate from a different location or device, bypassing standard credential-based authentication.
Detects successful authentication events using the OAuth device code flow. This flow is often abused by adversaries to perform OAuth phishing, where a user is tricked into authorizing a malicious application, granting it access tokens to cloud resources.
Detects potential SQL injection attempts against Azure App Service endpoints (specifically /wp-json/batch/v1 and /batch/v1) by identifying SQL-specific characters in URI query parameters that correlate with SQL syntax error logs within a 5-minute window.
Detects GET requests to the Microsoft Graph API 'organization' endpoint, often used by malicious tools to validate a tenant environment or gather metadata before initiating C2 communication or secondary stages of an attack.
Detects which privileged users have signed in recently, how often, from how many IPs/apps, what authentication methods they used, and whether any password-only sign-ins occurred?
Page 88 of 185