Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
985 detections
Filters
Last updated
All Time
Detection languages
640
105
82
64
34
Contributors
242
226
216
58
46
Categories
20,443
11,831
5,875
5,151
4,864
985
Platforms
485
405
224
192
62
Products / Services
416
384
182
109
81
MITRE Techniques
498
497
264
235
234
CVEs
4
4
4
3
3
IDS Classtypes
1
Detects Microsoft Entra ID sign-in events using the non-interactive OAuth device-code protocol against the 'common' tenant endpoint where MFA was not applied. This behavior is consistent with OAuth device-code phishing campaigns (e.g., Storm-2372/DEBULL) that exploit Conditional Access device-code flow allowances to bypass standard authentication controls.
Detects the use of spoofed Exchange Online Application IDs in Azure sign-in logs. Attackers use these specific spoofed AppID patterns to bypass controls during Resource Owner Password Credential (ROPC) authentication, often for user enumeration purposes.
Detects potential credential harvesting or account enumeration activity by identifying successful enumeration of user accounts (via specific sign-in result codes) followed by a spike in account lockouts for the same users within a 60-minute window. This behavior is indicative of an attacker verifying valid accounts before launching a targeted brute force or credential stuffing campaign.
Detects high-frequency failed logon attempts (>= 6) against accounts with administrative naming conventions within a 3-minute window. The rule specifically flags activity targeting multiple distinct destination hosts, which is a strong indicator of lateral movement or account brute-forcing/spraying attempts across an enterprise network.
Detects Microsoft Entra authentication events using the Resource Owner Password Credentials (ROPC) grant type where the User-Agent string explicitly identifies as a Microsoft Outlook desktop client. Adversaries often spoof these User-Agent strings in OAuth client ID campaigns to bypass conditional access policies or appear as legitimate traffic during automated login attempts.
Detects anomalous NTLM authentication activity (LogonType 3) where a single account or source IP attempts to authenticate to 25 or more unique hosts within a 10-minute window. This behavioral pattern is frequently observed during credential spraying, pass-the-hash attacks, or unauthorized lateral movement attempts using NTLM.
Detects Entra ID users with active medium-to-high identity risk events who perform Microsoft Copilot actions in cloud applications while simultaneously exhibiting impossible travel indicators — successful sign-ins from multiple geographic locations using unmanaged (non-registered) devices within a one-hour window. This triple-signal correlation (identity risk + impossible travel on unmanaged device + Copilot usage) is a strong indicator of account compromise where an adversary has taken over a legitimate identity and is leveraging AI-powered tools to accelerate reconnaissance, data access, or exfiltration against Microsoft 365 resources.
Detects successful authentication events in Azure SigninLogs that utilize the Device Code OAuth flow. Attackers may leverage this flow in phishing campaigns or to bypass MFA by tricking users into authorizing malicious devices, which can lead to subsequent token theft.
This rule detects potential brute force or password guessing attempts by monitoring Windows security logs for instances where a failed logon (Event ID 4625) is followed by a successful logon (Event ID 4624) for the same user on the same host within a 60-second window.
This rule identifies accounts, hosts, and remote IP addresses associated with a high volume of Remote Desktop Protocol (RDP) logon activity, which may indicate brute-force attempts, credential stuffing, or anomalous remote access behavior.
This rule detects successful Azure AD sign-in events (ResultType 0) that occur following a series of repeated failed sign-in attempts (ResultType 50126) from the same user account. The activity is specifically scoped to the LSHIY IPv6 address range and utilizes Azure CLI or similar mobile/desktop client applications, which is a strong indicator of an automated password spraying or credential stuffing attack followed by a successful compromise.
This rule detects potential brute force authentication attempts via LDAP occurring shortly after a specific DLL (ending in 'ode.dll') is loaded on a system. This behavior may indicate an adversary is using a malicious or secondary module to facilitate credential brute forcing or unauthorized authentication attempts.
Detects non-interactive sign-ins to Microsoft 365 using the OAuth Resource Owner Password Credentials (ROPC) flow via the Azure CLI. This legacy authentication method enables attackers to bypass multi-factor authentication (MFA) by submitting credentials directly to the authentication endpoint, a technique observed in password spraying campaigns.
This rule detects potential lateral movement or account compromise by identifying instances where a single user account successfully logs into four or more unique computer systems via Remote Desktop (Logon Type 10) within a 30-minute window.
This rule detects successful Remote Desktop Protocol (RDP) logons (Event ID 4624 with Logon Type 10) and the execution of the Remote Desktop Connection client (mstsc.exe). It monitors for signs of remote interactive access to windows endpoints, which can indicate unauthorized access or legitimate administrative activity.
This rule detects potential 'impossible travel' scenarios within Azure AD sign-in logs. It identifies users who successfully sign in to Office 365 from two geographically distant IP addresses within a one-hour window, suggesting a potential compromise or an attempt to bypass security controls.
Detects a single source IP address initiating Remote Desktop Protocol (Logon Type 10) connections to three or more distinct computer destinations within a 10-minute window. This behavior is indicative of lateral movement or internal network scanning activity.
This rule monitors for RDP connections (Windows Event ID 4624 Logon Type 10) and RDP client launches (mstsc.exe) within an environment. It enriches these events by checking against a baseline of historically observed source-to-destination host pairs. A new or previously unseen connection pair triggers an alert, helping to identify potential lateral movement.
This rule detects potential RDP lateral movement by identifying accounts that log on to multiple distinct workstations via RDP (LogonType 10) within a one-hour window, where the workstation name is different from the computer name. A logon chain of more than two distinct computers for the same account and IP address within an hour is flagged as suspicious.
Detects Microsoft Entra ID (formerly Azure AD) sign-in logs where a single user account authenticates from two different countries within a 10-minute window, which is indicative of potential account compromise or credential sharing.
This rule detects potential session token theft or replay attacks by identifying non-interactive sign-in events that occur from a different IP or geographic location than the user's most recent successful MFA-authenticated interactive session. It flags cases where a non-interactive token is used within a short timeframe (1 hour) of an interactive session from a different location, which may indicate the exfiltration and subsequent use of session cookies or OAuth tokens.
Page 29 of 47