Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6 detections
Filters
Last updated
All Time
Detection languages
6
Contributors
6
Categories
6
4
Platforms
39,781
7,128
6,515
3,860
3,597
Products / Services
6
3
1
MITRE Techniques
5
2
2
1
1
Detects enumeration of Entra ID applications and permissions via AzureHound or ROADrecon, identified by distinct user-agent strings or abnormal Graph API request volume — the same signal Organization B's custom alerts used to catch CISA's red team.
Detects a single device requesting Entra ID access/refresh tokens on behalf of multiple distinct users in a short window, indicative of Primary Refresh Token (PRT) theft used to impersonate other users, as CISA's red team did against an application owner.
Detects a new client secret added to an Entra ID application shortly followed by Mail.ReadWrite Graph API calls, indicating the application was hijacked to impersonate its identity and read a target user's mailbox — the technique CISA's red team used after obtaining an access token.
Detects newly granted or consented Microsoft Entra ID application permissions exceeding baseline, a weakness CISA's red team exploited to escalate privileges and reach cloud resources.
Detects service-principal/workload-identity sign-ins occurring without an enforced Conditional Access policy — a gap CISA's red team exploited for unauthorized cloud access.
Detects interactive sign-in by an Entra Connect/AAD Connect sync service account (Sync_ prefix), which should only authenticate non-interactively. CISA's red team compromised a hybrid sync account to pivot from on-prem AD into cloud resources.