Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
414 detections
Filters
Last updated
All Time
Detection languages
226
76
49
34
16
Contributors
129
50
43
42
35
Categories
152
125
118
106
84
Platforms
338
155
147
27
11
Products / Services
10,664
9,758
6,692
4,418
3,749
414
MITRE Techniques
254
202
134
129
109
CVEs
1
1
1
Correlates a high-risk or compromised Microsoft Entra sign-in event with a subsequent device registration (Add device or Register device) performed by the same user account within a 3-hour window.
Correlates a high-risk or compromised Microsoft Entra sign-in event with a subsequent device registration (Add device or Register device) performed by the same user account within a 3-hour window.
This rule monitors Entra ID Sign-in logs for authentication events flagged by risk detections related to anonymizing infrastructure, such as VPNs, TOR exit nodes, or proxies. It identifies successful logins and aggregate sign-in volume from these IP addresses, flagging successful logins as critical due to the potential for valid account abuse through multi-hop proxy chains.
This rule monitors Entra ID Sign-in logs for authentication events flagged by risk detections related to anonymizing infrastructure, such as VPNs, TOR exit nodes, or proxies. It identifies successful logins and aggregate sign-in volume from these IP addresses, flagging successful logins as critical due to the potential for valid account abuse through multi-hop proxy chains.
This rule monitors Entra ID Sign-in logs for authentication events flagged by risk detections related to anonymizing infrastructure, such as VPNs, TOR exit nodes, or proxies. It identifies successful logins and aggregate sign-in volume from these IP addresses, flagging successful logins as critical due to the potential for valid account abuse through multi-hop proxy chains.
Detects an anomalous volume of file downloads from SharePoint or OneDrive by a user on an unmanaged, non-compliant device, shortly following a suspicious or risky sign-in event. The rule establishes a baseline for individual user behavior over 30 days and alerts when the current hourly download activity significantly exceeds that baseline.
This rule detects potentially compromised accounts by correlating suspicious authentication activity (such as risky sign-ins, impossible travel, or malicious OAuth/Mail-rule configurations) with a subsequent spike in SharePoint or OneDrive file access, downloads, or external link sharing within a one-hour window. This behavior is indicative of an adversary performing cloud-based data exfiltration after gaining unauthorized access to an account.
Correlates an Entra ID MFA/authenticator reset with a new device registration within 30 minutes for the same account. Models the Scattered Spider (UNC3944/Octo Tempest) and CrowdStrike-tracked 'Mutant Spider' helpdesk-vishing playbook, where Mandiant's M-Trends 2026 measured ~40 minutes from vished reset to domain admin.
Detects potential help-desk impersonation or social engineering activity involving account credential or MFA method resets, followed shortly by a sign-in from an unknown device or geography. The rule excludes activity tied to established ticketing systems or standard automated password expiration processes.
Detects unauthorized configuration or content changes (e.g., login or portal pages) performed outside of standard business hours by user accounts that have recently exhibited high-risk or compromised authentication behavior. This pattern aligns with tactics observed in the ShinyHunters playbook where compromised accounts are used to deface public-facing applications.
Detects the assignment of high-privilege Azure directory roles to a service principal identity. Threat actors may leverage this behavior to establish persistent, non-interactive backdoor access in a cloud tenant, bypassing MFA and sign-in scrutiny.
Detects when a user registers a new multi-factor authentication (MFA) method, such as an authenticator app, phone number, or FIDO key, within 30 minutes of a sign-in event flagged as anomalous (e.g., impossible travel, new ASN, or risky sign-in score). This pattern is indicative of an adversary establishing persistence by registering their own MFA device to maintain access to a compromised account after a session hijack.
This rule detects potential Multi-Factor Authentication (MFA) push-bombing, also known as MFA fatigue, where an adversary floods a user with push requests in hopes that the user eventually approves one. The rule flags instances where a successful MFA push approval is preceded by five or more failed, denied, or timed-out MFA push notifications within a 15-minute rolling window for the same user.
Detects MFA push-bombing or authentication fatigue attacks where an adversary repeatedly triggers MFA challenge requests for a user in a short period, potentially from multiple IP addresses, culminating in a successful authentication event. This behavior is indicative of an attacker attempting to coerce a user into approving an MFA request.
Detects a suspected Multi-Factor Authentication (MFA) fatigue attack, characterized by a user denying three or more consecutive MFA authentication requests in a short period (10 minutes) followed by a successful authentication approval. This behavior often indicates an adversary bombarding a user with push notifications to eventually solicit an accidental or coerced approval.
Detects account modification activity (e.g., password resets or MFA registration changes) followed within 24 hours by a sign-in event for the same user account that is flagged as risky or exhibits anomalous device/location characteristics, indicative of social engineering campaigns like Scattered Spider.
Detects the creation of a new Entra ID application followed closely by high-privilege permission grants or consent. This is a common technique used by attackers to establish persistent access to cloud resources, such as mailboxes or sensitive data, via OAuth application backdoors.
Detects modifications to SAML identity providers, federation settings, and trust configurations in AWS and Azure AD/Entra where the signing certificate fingerprint does not match a known-good baseline, and no corresponding change ticket is detected in the raw logs.
Detects anomalous sign-in activity for service principals (non-interactive accounts) where the same application authenticates from multiple distinct countries within a 24-hour window. This behavior often indicates the unauthorized use of compromised service principal credentials, such as client secrets or certificates, from distributed attacker-controlled infrastructure.
This rule detects the installation or execution of common Remote Monitoring and Management (RMM) tools (e.g., AnyDesk, ScreenConnect, Atera, Splashtop, TeamViewer) on Windows endpoints within a 4-hour window of associated cloud identity risk activity (such as risky sign-ins, MFA changes, or privilege grants). It filters out legitimate activity initiated via standard software management pipelines (e.g., SCCM, Intune) to identify potential unauthorized use of remote access software by adversaries following account compromise.
Detects an account performing a mass download or synchronization of files from SharePoint or OneDrive within a 30-minute window, occurring within two hours of a medium or high-risk Azure AD sign-in event. This pattern is indicative of potential account takeover and subsequent data exfiltration by an adversary using harvested credentials.
Page 1 of 20