Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
505 detections
Filters
Last updated
All Time
Detection languages
245
92
78
48
19
Contributors
141
113
53
46
41
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
210
138
110
80
76
Products / Services
147
74
61
41
28
MITRE Techniques
243
128
69
68
55
CVEs
10
9
5
5
5
IDS Classtypes
4
IDS Protocols
4
This rule detects scenarios where an Azure application's permissions (scopes) are upgraded to high-risk levels after an initial period, a technique known as 'incremental consent'. This is often used by attackers to avoid triggering high-risk consent alerts during the initial application authorization process, subsequently escalating privileges over time.
This rule detects scenarios where an Azure application's permissions (scopes) are upgraded to high-risk levels after an initial period, a technique known as 'incremental consent'. This is often used by attackers to avoid triggering high-risk consent alerts during the initial application authorization process, subsequently escalating privileges over time.
Detects instances where a non-administrative user grants OAuth application permissions for high-risk Microsoft Graph delegated scopes. This activity is a common indicator of 'consent phishing' campaigns, where an attacker tricks a user into authorizing a malicious application, granting persistent access to the user's data and resources via API tokens, even after password resets.
Detects the addition of a new client secret or certificate to an existing Microsoft Entra ID (formerly Azure AD) application or service principal. This behavior is often used by adversaries to establish persistence following the compromise of an existing identity with administrative permissions, allowing continued access even if the original compromised credentials are revoked.
Detects a potential Business Email Compromise (BEC) persistence chain where a user grants an OAuth application mail-read or mail-write permissions, followed by the creation of a malicious inbox rule designed to forward, move, or delete sensitive email threads. This combination enables persistent exfiltration and stealth, bypassing password resets as the OAuth token remains active.
Detects OAuth application consent events in Azure Active Directory where the application is from an unverified publisher, requests high-risk scopes (specifically offline_access plus at least two others like Mail, Files, Contacts, or Directory), and potentially indicates a mass-campaign if multiple users consent to the same application.
Detects modifications to an Azure Active Directory application where a new Redirect URI is added, particularly when the URI points to localhost, a raw IP address, or a non-corporate domain. The rule additionally correlates this change with recent OAuth grant activities to identify potential adversary attempts to hijack tokens or maintain persistent access via malicious application configurations.
Detects the addition of new credentials (secrets or certificates) to an existing service principal or application within a cloud environment. This behavior is often associated with persistence or privilege escalation tactics in cloud identity platforms. The rule flags activity from potentially non-automated accounts and can correlate with recent administrative role assignments.
Detects high-risk activities related to SAML token-signing certificates, including certificate export from Active Directory Federation Services (AD FS) or Active Directory Certificate Services (AD CS) and unauthorized configuration changes to enterprise application certificate management. These activities are potential precursors to Golden SAML attacks, where an adversary attempts to forge authentication tokens.
Detects a potential Business Email Compromise (BEC) persistence chain where a user grants an OAuth application mailbox read/write permissions, followed immediately by the creation of an inbox rule (forwarding, moving, or deleting) targeting messages containing keywords like 'invoice', 'wire', or 'payment'.
Detects a potential Business Email Compromise (BEC) persistence chain where a user grants an OAuth application mailbox read/write permissions, followed immediately by the creation of an inbox rule (forwarding, moving, or deleting) targeting messages containing keywords like 'invoice', 'wire', or 'payment'.
Detects the addition of a federated identity credential to an Azure AD / Entra ID application. Adversaries may use this technique to establish persistent, secretless access to an application's service principal by configuring trust with an external OIDC issuer under their control (e.g., a malicious GitHub repository or personal OIDC provider).
Detects a potential Business Email Compromise (BEC) persistence chain where a user grants an OAuth application mailbox read/write permissions, followed immediately by the creation of an inbox rule (forwarding, moving, or deleting) targeting messages containing keywords like 'invoice', 'wire', or 'payment'.
Detects the addition of a federated identity credential to an Azure AD / Entra ID application. Adversaries may use this technique to establish persistent, secretless access to an application's service principal by configuring trust with an external OIDC issuer under their control (e.g., a malicious GitHub repository or personal OIDC provider).
Detects the creation or modification of Exchange mailbox or transport rules that exhibit suspicious characteristics, such as external forwarding, movement to hidden or system folders, automatic deletion/marking as read, or rules containing keywords related to financial fraud. The rule specifically monitors for activities occurring via non-standard or automated clients to increase detection fidelity.
Detects the creation or modification of Exchange mailbox or transport rules that exhibit suspicious characteristics, such as external forwarding, movement to hidden or system folders, automatic deletion/marking as read, or rules containing keywords related to financial fraud. The rule specifically monitors for activities occurring via non-standard or automated clients to increase detection fidelity.
Detects high-privilege OAuth application consent grants (such as Mail.Read or Files.ReadWrite.All) occurring within four hours of a risky or anomalous user sign-in. This sequence indicates a potential compromise where an attacker uses a compromised account to authorize a malicious OAuth application for persistent access and data exfiltration.
Detects the granting of high-risk OAuth application scopes (e.g., Mail.Read, offline_access) within two hours of a risky sign-in event for the same user. This pattern is indicative of attackers establishing persistence and maintaining access to sensitive data (such as emails or files) even after potential credential resets.
Detects a suspicious sequence of events where a user exhibits signs of account compromise—either through impossible travel patterns or the use of OAuth tokens on a new device—followed within one hour by the modification of mailbox settings, such as creating new inbox rules or modifying mailbox permissions, which is a common indicator of persistence and email exfiltration.
This rule detects GitHub Actions workflows that explicitly reference specific 'actions-cool' GitHub actions using a known-bad mutable version tag ('@v2.2.1'). This tag corresponds to malicious code introduced into these repositories, allowing for potential CI/CD pipeline poisoning and supply chain compromise.
Detects the creation of Azure AD applications with generic display names, often combined with the addition of delegated permissions for 'Mail.Read' or 'Mail.ReadWrite' scopes. This activity is consistent with OAuth-based consent phishing campaigns used by threat groups such as APT35 (also known as Mint Sandstorm or Charming Kitten) to gain persistent access to user email environments.
Page 6 of 25