Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
3
Contributors
3
Categories
3
1
Platforms
3
Products / Services
10,553
9,767
6,699
4,418
3,742
MITRE Techniques
2
1
1
1
1
Detects enumeration of Entra ID applications and permissions via AzureHound or ROADrecon, identified by distinct user-agent strings or abnormal Graph API request volume — the same signal Organization B's custom alerts used to catch CISA's red team.
Detects a new client secret added to an Entra ID application shortly followed by Mail.ReadWrite Graph API calls, indicating the application was hijacked to impersonate its identity and read a target user's mailbox — the technique CISA's red team used after obtaining an access token.
Detects newly granted or consented Microsoft Entra ID application permissions exceeding baseline, a weakness CISA's red team exploited to escalate privileges and reach cloud resources.