Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
771 detections
Filters
Last updated
All Time
Detection languages
392
128
66
49
47
Contributors
296
150
91
39
27
Categories
388
258
255
124
110
Platforms
523
344
285
121
72
Products / Services
370
328
112
51
43
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
771
CVEs
2
1
IDS Classtypes
15
11
3
1
1
IDS Protocols
29
This rule detects the reuse of the same user's refresh token from two different countries within a 15-minute window. This behavior is a strong indicator of token theft or session hijacking, commonly associated with AiTM phishing, infostealer malware, or session cookie extraction, where an adversary uses stolen credentials from a remote location.
Detects OAuth2 permission consent events where a user grants a third-party or newly registered application access to high-risk scopes (such as Mail, Files, or Directory). This technique is commonly used to establish persistence and bypass MFA by gaining access to user accounts via malicious or compromised OAuth applications.
Detects the addition of suspicious redirect URIs, such as those containing wildcards, non-HTTPS protocols, or known URL-shortening services, to an OAuth application registration. Such configurations can be exploited by attackers to perform OAuth authorization code or token interception (e.g., through adversary-controlled endpoints).
This rule detects potential account compromise by identifying 'impossible travel' scenarios where successful logins for the same user occur from different geolocations within a short timeframe (less than 1 hour), specifically when at least one authentication event uses a refresh or session token rather than interactive MFA. It correlates these suspicious logins with previous endpoint infostealer detections on the same device within the last 72 hours, indicating that the token may have been stolen by malware.
This rule correlates a risky or compromised sign-in event in Entra ID (Azure AD) with a subsequent OAuth consent grant by the same user within 60 minutes. It specifically looks for grants that request sensitive permissions such as Mail.Read, Mail.ReadWrite, Files.ReadWrite.All, or offline_access, which are commonly associated with consent phishing and persistence tactics.
Detects instances where a user account identified as high or medium risk, or marked as 'at risk' by Azure AD Identity Protection, performs an OAuth application consent action within one hour of the risky sign-in event. This correlation targets potential illicit application consent attacks where a compromised account is used to grant permissions to a malicious application.
Detects non-interactive sign-in events where a refresh token is used to authenticate without satisfying a multi-factor authentication (MFA) requirement. This pattern is indicative of potential token theft and replay attacks, where an adversary uses a stolen refresh token to maintain persistence or access resources without triggering the expected MFA prompt.
Detects instances where a user or administrator grants consent to an OAuth application in Azure AD requesting highly sensitive delegated or application permissions, such as Mail.Read, Mail.ReadWrite, offline_access, or directory-wide read/write scopes. Attackers often use these consents to maintain persistent, silent access to a user's mailbox and cloud resources even after primary session tokens are revoked.
Detects mailbox items being accessed or bound by an OAuth-based application (app-only context) in Microsoft 365, filtering out expected interactive client signatures like Outlook or OWA. This behavior is indicative of potential post-compromise mailbox enumeration or data harvesting by malicious applications using stolen or illicitly granted OAuth access tokens.
Detects a suspicious sequence of events where a user performs a device-code authentication flow from a previously unseen application, followed within a two-hour window by sensitive account activities such as OAuth application consent/registration or mailbox-related administrative operations. This behavior is characteristic of passkey-phishing campaigns designed to steal access tokens and achieve persistence or data access via malicious OAuth applications.
This rule detects potentially malicious OAuth application consent grants where a user authorizes an application with high-privilege scopes (such as mail or directory access). The detection flags consent grants for applications that are either unverified by the publisher or newly created within the last 30 days, and correlates these events with suspicious sign-in activity (high/medium risk or failures) for the same user within a two-hour window.
Monitors Azure AuditLogs for application consent events that grant high-privilege Microsoft Graph API scopes, such as Mail.Read, Files.ReadWrite.All, or Directory.ReadWrite.All. This activity is a common indicator of illicit consent grant phishing attacks, where adversaries trick users into granting permissions to a malicious OAuth application to gain persistent, unauthorized access to sensitive data without requiring direct user credentials or MFA.
Monitors Azure AuditLogs for application consent events that grant high-privilege Microsoft Graph API scopes, such as Mail.Read, Files.ReadWrite.All, or Directory.ReadWrite.All. This activity is a common indicator of illicit consent grant phishing attacks, where adversaries trick users into granting permissions to a malicious OAuth application to gain persistent, unauthorized access to sensitive data without requiring direct user credentials or MFA.
Detects OAuth2 authorization code flow attempts in Entra ID (Azure AD) sign-in logs where the redirect URI is external to the Microsoft ecosystem, followed by an immediate token issuance event to that same suspicious endpoint. This behavior is indicative of 'ClickFix' or 'ConsentFix' phishing attacks, where users are manipulated into copying an authorization code from a legitimate Microsoft sign-in prompt and pasting it into an attacker-controlled application.
Detects anomalous sign-in behavior where the same Entra ID session or refresh token is reused from two geographically distant IP addresses within a short timeframe. This activity is correlated with a prior suspicious OAuth consent-grant or device-code authentication event on the same account, which is a common indicator of an 'EvilTokens' style session-token replay attack.
Detects a sequence of potentially malicious local command execution (via PowerShell, cmd, or mshta) that mirrors the 'ClickFix' social engineering pattern, followed by an OAuth application consent grant or device-code authorization by the same user within a short timeframe. This behavior is indicative of an adversary attempting to bypass MFA by tricking a user into authorizing a malicious application after establishing local execution on their endpoint.
Detects potential consent phishing attempts by identifying when a user grants high-risk, persistent-access OAuth scopes (such as Mail or Files) to a new third-party application. The rule specifically excludes known first-party Microsoft apps and utilizes a lookback period to avoid alerting on applications that have already been consented to within the tenant, reducing noise from routine enterprise app usage.
Detects potential consent phishing attempts by identifying when a user grants high-risk, persistent-access OAuth scopes (such as Mail or Files) to a new third-party application. The rule specifically excludes known first-party Microsoft apps and utilizes a lookback period to avoid alerting on applications that have already been consented to within the tenant, reducing noise from routine enterprise app usage.
Detects potential consent phishing attempts by identifying when a user grants high-risk, persistent-access OAuth scopes (such as Mail or Files) to a new third-party application. The rule specifically excludes known first-party Microsoft apps and utilizes a lookback period to avoid alerting on applications that have already been consented to within the tenant, reducing noise from routine enterprise app usage.
Detects potential consent phishing attempts by identifying when a user grants high-risk, persistent-access OAuth scopes (such as Mail or Files) to a new third-party application. The rule specifically excludes known first-party Microsoft apps and utilizes a lookback period to avoid alerting on applications that have already been consented to within the tenant, reducing noise from routine enterprise app usage.
Detects a suspicious sequence of events where a user exhibits signs of account compromise—either through impossible travel patterns or the use of OAuth tokens on a new device—followed within one hour by the modification of mailbox settings, such as creating new inbox rules or modifying mailbox permissions, which is a common indicator of persistence and email exfiltration.
Page 5 of 37