Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
23 detections
Filters
Last updated
All Time
Detection languages
17
3
1
1
1
Contributors
6
6
1
1
1
Categories
12
10
8
7
4
Platforms
20
4
2
2
1
Products / Services
12
8
5
5
4
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
'Example query for SigninLogs showing how to break out packed fields. In this case extending conditional access Policies '
This rule detects attempts to retrieve the Microsoft Graph authorization policy, specifically targeting the `/policies/authorizationPolicy` endpoint. This policy contains sensitive information about who can create applications, invite guest users, and other critical settings within Entra ID (formerly Azure AD). Such requests are typically made by administrators for review or modification, and unexpected calls to this endpoint could indicate reconnaissance or unauthorized access attempts. The rule filters for successful GET requests (HTTP 200) and excludes known Azure IP ranges to reduce false positives.
Page 2 of 2