Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,866 detections
Filters
Last updated
All Time
Detection languages
2,525
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects the registration of a new FIDO2 security key or passkey in Entra ID that is associated with a sign-in from an unmanaged or non-compliant device shortly before or after the registration. This behavior often suggests a vishing or social engineering scenario where an attacker guides a user through an authentication method registration process while impersonating IT support.
Detects potential misuse of an Azure Managed Identity token on a Linux host, where 'curl' is used to interact with the Azure Key Vault API (vault.azure.net/secrets) while presenting an Authorization bearer token. This pattern can indicate an adversary who has obtained a Managed Identity token (e.g., via the Instance Metadata Service) and is attempting to exfiltrate or access sensitive secrets stored in Azure Key Vault.
Detects push operations to an Azure Container Registry. This activity is a common administrative task but can also indicate an adversary pushing a malicious, backdoored, or unauthorized container image into an environment, potentially for persistence or supply chain attack purposes.
Detects Microsoft Entra ID authentication failures (AADSTS700016) where a client ID is provided that does not exist in the directory. This error often indicates attackers attempting to spoof legitimate OAuth client applications to perform reconnaissance or bypass conditional access policies.
This rule detects potential user enumeration attacks targeting Entra ID tenants by monitoring for failed sign-in attempts (ResultType 50034) involving common, predictable username patterns across multiple tenants within a 24-hour window. This behavior often indicates an adversary attempting to map valid usernames by exploiting error code differences or identity discovery patterns.
Detects Microsoft Entra ID authentication attempts (Resource Owner Password Credentials - ROPC) where the Client ID and Application Display Name are blank. This pattern is indicative of attackers attempting to enumerate users or bypass security controls by using malformed or spoofed client identification in authentication requests.
Detects a sign-in failure with error code 50199 (indicating a device-code interrupt/waiting state) followed immediately by a successful sign-in from the same source IP address. This pattern is characteristic of device-code phishing attacks, where an attacker intercepts a device code and completes the authentication process on behalf of the victim.
Detects Microsoft Entra ID sign-in events using the non-interactive OAuth device-code protocol against the 'common' tenant endpoint where MFA was not applied. This behavior is consistent with OAuth device-code phishing campaigns (e.g., Storm-2372/DEBULL) that exploit Conditional Access device-code flow allowances to bypass standard authentication controls.
This rule detects suspicious sign-in patterns indicative of an EvilTokens-style Microsoft Device Code OAuth phishing attack. It identifies successful device code flow sign-ins where Multi-Factor Authentication (MFA) was not applied or satisfied, suggesting an adversary has bypassed MFA using a stolen device code. The rule aggregates these suspicious sign-ins by user, listing associated applications, IP addresses, and locations for analyst review.
Detects potential Resource Owner Password Credential (ROPC) password guessing attempts in Entra ID by monitoring for multiple AADSTS50126 (Invalid Username or Password) errors. Attackers may abuse ROPC to bypass multi-factor authentication requirements or perform brute-force attacks against cloud identities.
Detects the use of spoofed Exchange Online Application IDs in Azure sign-in logs. Attackers use these specific spoofed AppID patterns to bypass controls during Resource Owner Password Credential (ROPC) authentication, often for user enumeration purposes.
This rule detects authentication attempts in Azure AD Sign-in Logs where the User Agent identifies the request as originating from the Python Requests library (version 2.32.3). This pattern is often indicative of Resource Owner Password Credentials (ROPC) flows, which are frequently abused by threat actors to perform credential stuffing or automated authentication bypassing multi-factor authentication (MFA) requirements in cloud environments.
Detects sign-in attempts where the OAuth Client ID (AppId) does not have a corresponding display name (AppDisplayName) in the logs, and the same Client ID is observed across multiple different Azure tenants. This pattern often indicates an adversary using a malicious or spoofed OAuth application to perform multi-tenant abuse, consent phishing, or unauthorized access across different organizational boundaries.
Detects anomalous authentication patterns originating from a single IP address where multiple users are targeted. The rule specifically monitors for a combination of error codes (50034 - User not found, 50126 - Invalid credentials, 700016 - Multi-factor authentication required) to identify potential password spraying or brute force activity targeting Microsoft Entra ID (formerly Azure AD).
Detects potential credential harvesting or account enumeration activity by identifying successful enumeration of user accounts (via specific sign-in result codes) followed by a spike in account lockouts for the same users within a 60-minute window. This behavior is indicative of an attacker verifying valid accounts before launching a targeted brute force or credential stuffing campaign.
Detects the creation of Azure Container Registry (ACR) scoped access tokens or scope maps. Adversaries may use these features to establish persistent, least-privileged access to registry resources, often bypassing standard authentication monitoring.
Detects the deployment of an Azure Container Instance (ACI) where the image source or container name matches identified indicators of a potentially compromised registry or unauthorized deployment pattern.
Detects a sequence of authentication events from a specific IP address associated with the Microsoft Authentication Broker app, where an initial MFA challenge (ResultType 50199 - MFA challenge) is followed by a successful authentication (ResultType 0). This pattern is indicative of MFA fatigue attacks where an adversary repeatedly prompts a user until they inadvertently approve the request.
Detects successful execution of the 'List Credentials' action on an Azure Container Registry. This action returns the administrative credentials (username and password) for the registry, which may indicate unauthorized credential access or preparation for exfiltration or lateral movement.
Detects the creation or modification of tokens for an Azure Container Registry (ACR). This activity may indicate an administrator managing registry access, or an adversary creating long-lived credentials for persistence within the container environment.
This rule monitors for successful Azure Container Registry task write, run, or action operations that involve references to identity configurations, Azure KeyVault (vault.azure.net), or ACR task YAML files. These keywords are often associated with the configuration of managed identities or secret retrieval within the build process, which may indicate unauthorized task creation or manipulation to escalate privileges or exfiltrate secrets.
Page 91 of 185