Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,832 detections
Filters
Last updated
All Time
Detection languages
1,375
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,456
11,839
5,876
5,155
4,865
2,832
Platforms
1,449
916
693
670
264
Products / Services
994
701
613
469
216
MITRE Techniques
1,240
912
484
482
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
This rule hunts for indicators associated with the TrustSink technique, which involves using rogue External Authentication Methods (EAM) or malicious OIDC providers to bypass authentication or maintain persistence within a cloud environment. It monitors Azure AD sign-in and audit logs, alongside DNS and network events, for references to known malicious domains and URLs used for EAM-based attacks.
Detects anomalous privilege reconnaissance activity where an account queries Microsoft Graph API endpoints (such as directory roles or member/transitive member lists) multiple times in a short window, which may indicate a compromised account attempting to enumerate Global or Exchange Administrator role memberships.
Detects high-frequency, multi-action data access events through the Microsoft Graph API, indicative of automated exfiltration of Exchange, SharePoint/OneDrive, and Teams data. This behavior is consistent with an adversary using stolen OAuth access tokens to perform bulk enumeration and extraction of sensitive cloud-hosted data.
Detects high-volume access to Microsoft Graph API endpoints related to messages, mail folders, and attachments by a single user account within a 30-minute window. This behavior is indicative of automated, unauthorized email and attachment scraping, often associated with remote email collection attempts.
This rule monitors for OAuth device-code authentication flow completions initiated from devices flagged as non-compliant or unmanaged in Azure AD. This behavior is indicative of potential token theft via vishing or SMS-based phishing lures (consistent with Storm-3121/Storm-3032 TTPs), where an adversary tricks a user into completing a device authorization grant to facilitate MFA bypass and persistence.
Detects anomalous activity in Microsoft Graph API logs where a single identity (user or application) performs a high volume of requests across multiple sensitive administrative categories, such as directory role management, authentication method modification, application or service principal changes, and OAuth consent operations. This pattern is indicative of potential unauthorized reconnaissance, privilege escalation, or persistence attempts within an Azure/Microsoft 365 environment.
Detects anomalous or high-volume activity related to Microsoft Graph API calls targeting email messages, mail folders, or attachments. This behavior is indicative of potential unauthorized bulk email collection or exfiltration attempts, often observed in account compromise scenarios where an attacker enumerates and downloads mail contents.
Detects anomalous, high-volume access to Exchange Online via the REST API, potentially indicating programmatic exfiltration of email content. This rule monitors for specific suspicious Application IDs, Account Display Names, or Account Object IDs that exceed a threshold of 500 Exchange REST events, which is characteristic of mass-email collection patterns often seen in cloud-based identity compromises.
This rule monitors various logs (device network events, Entra ID sign-ins, cloud application events, and email events) for any interaction with a predefined list of indicator IP addresses identified as being associated with malicious actor egress traffic.
Detects a single user account authenticating, performing Graph API reconnaissance, and conducting data exfiltration across three distinct source IP addresses within a one-hour window. This behavior is indicative of threat actors like Storm-3121 or Storm-3032 rotating infrastructure per attack stage to evade network-based detection.
Detects a single user account authenticating, performing Graph API reconnaissance, and conducting data exfiltration across three distinct source IP addresses within a one-hour window. This behavior is indicative of threat actors like Storm-3121 or Storm-3032 rotating infrastructure per attack stage to evade network-based detection.
This rule detects high-volume usage (500+ events per hour) of Microsoft Exchange Online resources by accounts that lack an associated AccountObjectId but utilize a TokenObjectId. This pattern is indicative of service accounts or potentially compromised tokens performing bulk actions, such as mass email access or data collection within the Exchange environment.
This rule detects anomalous behavior where an identity performs multi-category discovery (e.g., users, groups, directory roles, applications) via Microsoft Graph API within a single session, followed by intensive collection of content (files, attachments, or messages). This sequence is indicative of an adversary performing reconnaissance to map an environment before moving to data exfiltration or theft.
Detects interaction with known infrastructure associated with the PREY-0058 campaign, which utilizes Adversary-in-the-Middle (AiTM) phishing lures mimicking passkey or MFA registration pages to target Microsoft 365 and other SaaS applications.
Detects anomalous non-interactive sign-ins that bypass multi-factor authentication (MFA) requirements from a geographical location not previously seen in the user's historical sign-in baseline. This pattern is indicative of attackers using stolen OAuth access or refresh tokens to maintain persistence and bypass standard authentication controls.
Detects anomalous administrative activity within Microsoft Exchange by identifying accounts performing multiple suspicious operations within a short timeframe. This rule flags activities like modifying transport rules, virtual directories, or management role assignments, which are often indicative of malicious persistence or configuration tampering, while excluding known authorized service accounts.
Detects modifications to credentials associated with Azure AD service principals or applications, such as adding new secrets or certificates. This behavior is commonly associated with attackers maintaining persistence or escalating privileges by creating backdoored credentials.
Detects usage of the OAuth device code authentication flow by high-value accounts (Finance, Accounts Payable, Admins). This flow is often abused in phishing campaigns to obtain access tokens by coercing users to authorize malicious applications via a code entry process.
Detects the creation or modification of inbox and transport rules in Office 365 that perform automatic email actions such as redirecting, forwarding, deleting, or marking emails as read, especially when targeting keywords related to sensitive information (e.g., invoice, payment, vendor, bank). This behavior is often associated with email account compromise and data exfiltration or persistence strategies.
Detects network connection events involving a specific known malicious IP address (5.230.71.51) identified as participating in unauthorized Intune enrollment or Entra ID device registration processes.
Detects network connection events involving a specific known malicious IP address (5.230.71.51) identified as participating in unauthorized Intune enrollment or Entra ID device registration processes.
Page 50 of 135