Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,832 detections
Filters
Last updated
All Time
Detection languages
1,375
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,456
11,839
5,876
5,155
4,865
2,832
Platforms
1,449
916
693
670
264
Products / Services
994
701
613
469
216
MITRE Techniques
1,240
912
484
482
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects anomalous or high-volume activity related to Microsoft Graph API calls targeting email messages, mail folders, or attachments. This behavior is indicative of potential unauthorized bulk email collection or exfiltration attempts, often observed in account compromise scenarios where an attacker enumerates and downloads mail contents.
Detects suspicious reconnaissance or modification activity within Microsoft Graph API by identifying high volumes of requests targeting sensitive management endpoints (such as directory roles, authentication methods, service principals, or OAuth permissions) from a single actor within a 30-minute window.
Detects anomalous Microsoft Graph API usage patterns where a single account interacts with a high number of unique request paths using common API pagination or search parameters, indicating potential resource enumeration or reconnaissance activity.
This rule detects potentially malicious interaction with specific GCP service account identifiers and client IDs. It monitors multiple log sources—including cloud audit logs, sign-in activity, security logs, and device network events—to identify unauthorized access, command and control communication, or data exfiltration attempts targeting Google API services (specifically oauth2.googleapis.com and sheets.googleapis.com).
Detects a GitLab personal access token/response indicating Owner-level (access_level 50) group access combined with the broad 'api' scope on the sensitive gnutls/gnutls project -- the excessive standing-privilege pattern that turned one leaked token into a 55-project exposure.
Detects the gitlab-triage automation tool being invoked with a personal access token scoped to the broad 'api' permission rather than a narrower issue/MR-only scope, inflating the blast radius if the token leaks.
This rule detects potentially malicious activity where a user performs a device code authentication followed by multiple rapid token exchanges (often of different types) within an extremely short time window. This pattern is indicative of an attacker attempting to leverage a compromised device code grant to programmatically retrieve access or refresh tokens before the user has completed a legitimate flow or to automate malicious access.
Detects instances where a user authenticates via the device code flow and subsequently performs a device enrollment or registration action from an unusual or non-compliant device naming convention. This pattern is indicative of an adversary enrolling their own device to bypass MFA or gain persistent access to corporate resources.
Detects instances where a user successfully authenticates using the OAuth Device Code flow followed by subsequent mailbox operations (such as reading, sending, or deleting items) from a different IP address within a 10-minute window. This behavior is a strong indicator of adversary-in-the-middle phishing attacks where an attacker captures a session token and utilizes it from a remote location.
This rule monitors Entra ID Audit Logs for device registration events where the display name of the registered device matches a specific naming pattern used by the GhostCode phishing kit. The pattern typically consists of three dash-separated words, a dash-separated hex string, and an optional suffix, which is indicative of automated phishing-based device enrollment.
This rule monitors Entra ID Audit Logs for device registration events where the display name of the registered device matches a specific naming pattern used by the GhostCode phishing kit. The pattern typically consists of three dash-separated words, a dash-separated hex string, and an optional suffix, which is indicative of automated phishing-based device enrollment.
Detects suspicious Microsoft Intune device enrollment activities characterized by the use of a spoofed User-Agent (matching Microsoft Office/Outlook strings) and rapid, multiple enrollment attempts within a short timeframe. This behavior is associated with adversary use of device-code phishing kits to enroll rogue devices using stolen session tokens.
Detects rapid rotation of multiple unique IP addresses originating from the same user account shortly after a device code authentication event. This behavior is indicative of threat actors using proxy rotation services (like FlashProxy) to obfuscate their origin and bypass location-based security controls or impossible-travel detections after hijacking a session.
Detects rapid rotation of multiple unique IP addresses originating from the same user account shortly after a device code authentication event. This behavior is indicative of threat actors using proxy rotation services (like FlashProxy) to obfuscate their origin and bypass location-based security controls or impossible-travel detections after hijacking a session.
Detects non-interactive Entra ID sign-ins utilizing the python-requests library, which suggests an automated polling mechanism. This is indicative of 'GhostCode' or similar device code phishing attacks where an adversary uses a stolen device code token to programmatically poll for a successful authorization grant.
Detects anomalous, rapid registration of rogue devices following a device-code authentication flow. The rule identifies instances where an 'unbound' device registration is immediately followed by a 'bound' call to obtain Azure AD and Microsoft Graph tokens, or where a Primary Refresh Token (PRT) is acquired shortly after a device-code sign-in, indicating potential abuse of the device authorization grant flow by an attacker using phishing kits.
Detects anomalous device registration activity where a single user principal registers three or more distinct devices within a short duration (2 minutes). This behavior is characteristic of device-code phishing attacks where adversaries abuse stolen device authorization codes to register multiple rogue devices, potentially for PRT (Primary Refresh Token) acquisition.
Detects anomalous device registration or Intune enrollment activity where a single user principal name (UPN) is associated with three or more distinct source IP addresses performing registration actions within a 90-second window. This behavior is indicative of automated, rapid rogue device registration campaigns aiming to bypass conditional access policies or establish unauthorized persistence.
Detects interaction with known infrastructure associated with the PREY-0058 campaign, which utilizes Adversary-in-the-Middle (AiTM) phishing lures mimicking passkey or MFA registration pages to target Microsoft 365 and other SaaS applications.
Detects rapid, sequential identity-validation API calls (such as GetCallerIdentity, GetSessionToken, or AssumeRole) performed across a large number of distinct AWS access keys from a single source within a short time window. This pattern is indicative of automated tooling validating a harvested corpus of AWS access keys to identify active credentials.
This rule monitors Office 365 activity for anomalous search behavior, specifically targeting high volumes of distinct search queries involving site collections, web structures, or index ID patterns. Such patterns are indicative of automated data discovery or enumeration activities performed against SharePoint or OneDrive environments.
Page 59 of 135