Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
23 detections
Filters
Last updated
All Time
Detection languages
18
3
1
1
Contributors
23
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
10
6
5
5
3
Products / Services
9
5
3
3
3
MITRE Techniques
10
5
5
3
3
CVEs
5
IDS Classtypes
1
IDS Protocols
1
Detects enumeration of Entra ID applications and permissions via AzureHound or ROADrecon, identified by distinct user-agent strings or abnormal Graph API request volume — the same signal Organization B's custom alerts used to catch CISA's red team.
Detects a single device requesting Entra ID access/refresh tokens on behalf of multiple distinct users in a short window, indicative of Primary Refresh Token (PRT) theft used to impersonate other users, as CISA's red team did against an application owner.
Detects a new client secret added to an Entra ID application shortly followed by Mail.ReadWrite Graph API calls, indicating the application was hijacked to impersonate its identity and read a target user's mailbox — the technique CISA's red team used after obtaining an access token.
Detects access to the AWS CLI credentials file (~/.aws/credentials) in a user's home directory, used by CISA's red team to harvest long-lived static IAM access keys.
Detects newly granted or consented Microsoft Entra ID application permissions exceeding baseline, a weakness CISA's red team exploited to escalate privileges and reach cloud resources.
Detects service-principal/workload-identity sign-ins occurring without an enforced Conditional Access policy — a gap CISA's red team exploited for unauthorized cloud access.
Detects interactive sign-in by an Entra Connect/AAD Connect sync service account (Sync_ prefix), which should only authenticate non-interactively. CISA's red team compromised a hybrid sync account to pivot from on-prem AD into cloud resources.
Detects an account making repeated Microsoft Graph API user search requests for payroll/HR display names via an axios HTTP client against a specific ApplicationId, consistent with Storm-2755 payroll-personnel reconnaissance.
Detects bursts of 10+ MailItemsAccessed events within 60 seconds via a REST client with a specific ClientAppId/APIId pairing, consistent with automated mailbox collection using a replayed AiTM-stolen session token.
Detects bulk file copy to staging directories, mass file read access, mailbox-export-rule creation, and bulk PST/mailbox access, excluding DLP/eDiscovery/legal-hold exports tagged with a case ID and scheduled data-migration windows.
Detects large-volume outbound TLS transfers scoped to mega.nz/mega.io SNI/destination, tuned against a typical daily-use baseline so routine small file-sharing does not trigger, consistent with Gunra's confirmed exfiltration of up to tens of terabytes to Mega.
Detects creation of malicious Exchange inbox rules (move to Deleted Items / mark as read) correlated via SessionId to an interactive sign-in from the Datawagon hosting ASN (27176) and a subsequent MailItemsAccessed event, consistent with Storm-2755 AiTM session-replay and mailbox-hiding persistence.
Detects anomalous OneDrive/SharePoint bulk download activity specifically correlated with execution of the named main.exe process, excluding Microsoft-signed sync clients and known enterprise migration tools (SharePoint Migration Tool, ShareGate).
Detects cross-region GraphApiAuditEvents calls for the same AccountObjectId/ApplicationId occurring faster than plausible travel time, indicating a replayed/stolen session token.
Detects centralized automation collecting mail across 3+ tenants within a short synchronized window, consistent with coordinated mailbox collection infrastructure.
Detects abuse of Google Cloud Authenticator device-management API calls associated with the Pass-ta-key attack, where an attacker-controlled key is introduced or a device is de-registered without a legitimate biometric/attestation ceremony. Covers device/register with keys/genpair, device/add_uv_key, and device/forget commands observed in cloud authenticator device-management event logs. To reduce false positives, device/add_uv_key and device/forget calls only alert when they lack an associated preceding hardware attestation or biometric ceremony event, and legitimate user-initiated new-device enrollment (following a known legitimate sign-in with a prior MFA/biometric ceremony on the requesting device) and legitimate account-recovery flows are excluded.
Detects an inbound Microsoft Teams call or chat using a known STAC4749 helpdesk-impersonation persona display name, a caller UPN on a known STAC4749 .top IT-themed domain, or a source IP previously observed originating STAC4749 vishing calls.
Detects an inbound Microsoft Teams call or chat using a known STAC4749 helpdesk-impersonation persona display name, a caller UPN on a known STAC4749 .top IT-themed domain, or a source IP previously observed originating STAC4749 vishing calls.
Detects new-device passkey bootstrap via PRF exchange and encrypted passkey download correlated with an anomalous signal (no prior authentication history on the device, new geolocation/ASN, or missing user-presence confirmation on the trusted device), consistent with an attacker abusing the one-time cross-device sync bootstrap flow to sync a victim's passkeys to an attacker-controlled device.
Detects the Silver Pass-ta-key attack chain where a device or UV key registration event (device/register, keys/genpair, device/add_uv_key) on the cloud authenticator is followed within a short window by a successful login to a high-value account from a device with no prior authentication history. To reduce false positives from legitimate device enrollment-then-use, the rule additionally requires either that the registration lacked an expected attestation/biometric ceremony, or that the subsequent login originated from a geolocation/ASN inconsistent with the user's normal authentication pattern, consistent with fully automated authentication using an attacker-registered UV key without human interaction.
Detects new-device passkey bootstrap via PRF exchange and encrypted passkey download correlated with an anomalous signal (no prior authentication history on the device, new geolocation/ASN, or missing user-presence confirmation on the trusted device), consistent with an attacker abusing the one-time cross-device sync bootstrap flow to sync a victim's passkeys to an attacker-controlled device.
Page 1 of 2