Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,864 detections
Filters
Last updated
All Time
Detection languages
2,523
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,448
1,199
1,091
792
575
Platforms
39,926
7,251
6,535
3,864
3,632
Products / Services
1,755
1,449
1,120
438
406
MITRE Techniques
1,888
1,391
913
814
726
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Correlates an Entra ID MFA/authenticator reset with a new device registration within 30 minutes for the same account. Models the Scattered Spider (UNC3944/Octo Tempest) and CrowdStrike-tracked 'Mutant Spider' helpdesk-vishing playbook, where Mandiant's M-Trends 2026 measured ~40 minutes from vished reset to domain admin.
Detects a sequence of authentication activity indicative of a credential stuffing attack. The rule identifies a burst of failed password-only authentication attempts followed by a successful authentication for the same account. It requires that the IP address used for the successful login overlaps with the set of IPs that initiated the failed attempts, effectively filtering out typical user noise and highlighting potentially malicious activity where an attacker has identified a valid credential.
Detects potential consent phishing attempts by identifying when a user grants high-risk, persistent-access OAuth scopes (such as Mail or Files) to a new third-party application. The rule specifically excludes known first-party Microsoft apps and utilizes a lookback period to avoid alerting on applications that have already been consented to within the tenant, reducing noise from routine enterprise app usage.
Device code authentication flow completed, followed by subsequent session activity from a different IP/user-agent, indicating token replay to an attacker-controlled client that bypasses MFA
Detects Microsoft Entra ID (formerly Azure AD) sign-in attempts that use the specific, hardcoded User-Agent string associated with the TeamFiltration tool. This tool is frequently used for mass credential testing against Microsoft 365 environments. The detection looks for a suspicious and outdated combination of Teams, Electron, and Chrome versions that would not be present in legitimate, modern Microsoft Teams client traffic.
Detects MFA fatigue attacks (MFA prompt-bombing) characterized by repeated denied MFA attempts for a single user, or successful MFA logins that occur under high-risk sign-in conditions, which are characteristic of activity associated with Lapsus$ (DEV-0537/Strawberry Tempest).
Detects potential help-desk impersonation or social engineering activity involving account credential or MFA method resets, followed shortly by a sign-in from an unknown device or geography. The rule excludes activity tied to established ticketing systems or standard automated password expiration processes.
This rule detects administrative or user activity within Azure via AzureActivity logs and web request patterns in AppServiceHTTPLogs that originate from a predefined list of known malicious IP addresses.
Detects instances where a user account registers a new MFA security method shortly after an initial successful sign-in from an unfamiliar device or network (Autonomous System Number). This behavioral pattern is characteristic of attackers, such as ShinyHunters vishing operators, who gain initial access via compromised credentials and subsequently enroll their own MFA devices to establish persistent access.
Detects potential MFA push fatigue (bombing) attacks by identifying users who receive an abnormal frequency of MFA push notification denials or interruptions within a short window, followed immediately by a successful authentication on a previously unseen device fingerprint. This pattern is characteristic of attackers attempting to wear down users into approving unauthorized login requests.
Detects instances where an administrative, helpdesk, or support account registers or updates security info (such as MFA methods) for a user, specifically when this action is preceded by a password reset for that same user. This pattern is indicative of account takeover attempts, particularly those involving vishing-based social engineering of helpdesk staff to bypass MFA.
This rule monitors for the addition of new credentials (secrets) to service principals or applications in an Azure/Entra ID environment. It then correlates this event with subsequent mailbox activity (such as accessing mail items, sending mail, or message binding) performed by the application within 7 days of the credential creation. This detection pattern is indicative of potential OAuth application-based persistence and mailbox data exfiltration.
This rule detects potentially compromised accounts by correlating risky Entra ID sign-ins to Citrix NetScaler with subsequent VPN session establishment followed by rapid, high-volume outbound connection activity from the source IP address. This pattern is indicative of a threat actor using compromised credentials to gain access via VPN and immediately perform internal network scanning or data staging.
This rule identifies successful sign-in events using the Azure CLI application where multi-factor authentication (MFA) was not enforced. This is a potential indicator of a misconfiguration where sensitive cloud management interfaces are accessible via single-factor authentication, or a sign of an adversary attempting to leverage a less secure authentication pathway.
Detects high-risk operations performed by the Entra ID/AAD Connect synchronization service account (e.g., Sync_* or ADToAADSyncServiceAccount). This account, which often holds broad directory permissions, is a prime target for attackers to gain persistence or escalate privileges within the cloud directory. The rule monitors for unauthorized sign-ins, sensitive configuration changes (such as modifications to federation trust, authentication policies, or directory synchronization settings), and password resets targeting the sync account itself.
Detects the addition of passwords or certificates to Entra ID applications or service principals by an identity that is not currently listed as an owner. This behavior is a common persistence technique used by threat actors to maintain long-term access, bypass password resets, and circumvent MFA.
Detects modifications to Entra ID (formerly Azure AD) that disable security defaults, per-user MFA enforcement, or conditional access policies requiring MFA. Such actions remove tenant-wide MFA protection and are often precursors to account takeover, password spraying, or ransomware attacks.
Detects instances where a Service Principal or Enterprise Application is assigned a highly privileged Entra ID directory role (e.g., Global Administrator, Privileged Role Administrator). This behavior is often associated with adversary attempts to establish persistent access that survives remediation of human-managed identities.
This rule detects anomalous sign-in behavior for Azure Service Principals by comparing current activity against a 14-day baseline. It alerts on sign-ins from new ASNs or countries, significant spikes in sign-in volume, or unauthorized access to sensitive resources such as Microsoft Graph, Exchange Online, or Azure Key Vault, while filtering out known cloud egress ranges.
Detects the creation of a new application secret or credential in a cloud environment followed by an immediate authentication attempt using that credential from an IP address that has not been observed performing successful authentication within the specified lookback window. This behavior is indicative of potential unauthorized persistence or the use of compromised credentials by an adversary.
Detects unauthorized sharing, copying, or exporting of EBS, disk, or database snapshots to external cloud accounts, subscriptions, or projects that are not present in the defined trusted allow-list for AWS, Azure, or GCP environments.
Page 9 of 184