Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,259 detections
Filters
Last updated
All Time
Detection languages
1,550
1,190
352
288
225
Contributors
792
520
494
354
298
Categories
1,717
1,495
401
382
376
Platforms
3,058
530
334
314
258
Products / Services
778
656
633
283
238
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
4,259
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
Detects usage of SoftPerfect's "netscan.exe". An application for scanning networks.
It is actively used in-the-wild by threat actors to inspect and understand the network architecture of a victim.
It is actively used in-the-wild by threat actors to inspect and understand the network architecture of a victim.
Detects the execution of AADInternals PowerShell cmdlets. AADInternals is a tool used for administering Azure AD and Office 365, which can be abused by threat actors for various attacks including reconnaissance, credential access, and impact within Azure AD or Office 365 environments. The rule specifically looks for the unique "-AADInt" string prefix in cmdlet names.
Detects the execution of NimScan, a port scanning utility. This rule identifies NimScan based on its executable name ('NimScan.exe') and specific IMPHASH values associated with different versions of the tool. Adversaries have been observed using this utility to scan for open ports on remote hosts within compromised environments.
Estimate Access is an undocumented API in MS Graph and is used in the following GraphRunner functions Get-UpdatableGroups, Get-DynamicGroups and Invoke-GraphRecon. Although not inherently malicious, it does submit an action and then determines if the user can perform it
This detects actions intended to identify updatable groups in Entra ID. GraphRunner contains a function called Get-UpdatableGroups but other tools may as well.
The authorization policy of Entra ID (User Settings) contains information about who can create applications, invite guest users and more. It's not something that is generally modified or reviewed except by administrators so it's worth knowing who may be requesting this endpoint.
Identify when the http delete method is being called within the Microsoft Graph API.
Identify the use GraphRunner's Invoke-DumpApps function to collect applications and external apps as well as users that consented to permissions in their apps.
Identify the use of the GraphRunner recon command Invoke-GraphRecon with the permission enum flag set, providing allowed actions and conditional access data for the current user.
Identify the enumeration of members within groups in Entra ID. This is based on GraphRunner Get-SecurityGroups function behavior so modifications may be needed for other scenarios
This detects when the groups endpoint is called in the Graph API. GraphRunner contains a function called Get-DynamicGroups but other tools may as well.
Identify the use of the user API call to collect a listing of users. This can be chatty due to other commands calling this single API.
Identify the use of the application API call to collect a listing of applications in Entra ID. This can be chatty due to other commands calling this single API.
Identify a 400 bad request to the groups endpoint in the MS Graph API. GraphRunner's Invoke-SecurityGroupCloner function will trigger this if it fails to duplicate a group.
This detects when the search/query endpoint is called which can be used for enumeration of items like SharePoint site URLs. GraphRunner contains a function called Get-SharePointSiteURLs but other tools may as well.
Identify enumeration of inboxes across the Entra ID tenant. This detection is based on the Invoke-GraphOpenInboxFinder in GraphRunner but the concepts are applicable to other tools that scan for accessible inboxes.
Identify the enumeration of both the users and members of groups in the Entra ID tenant. While these are two separate functions in GraphRunner, they are often run in support of one another.
Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.
Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.
Detects network connections made by non-browser processes to public IP lookup services. This activity can indicate an adversary performing discovery to understand the external IP address of a compromised system, often as a post-compromise internet connectivity test or for reconnaissance purposes.
Detects usage of NimScan, a portscanner utility.
In early 2025, adversaries were observed using this utility to scan for open ports on remote hosts in a compromised environment.
This rule identifies the execution of NimScan based on the process image name and specific hash values associated with different versions of the tool.
In early 2025, adversaries were observed using this utility to scan for open ports on remote hosts in a compromised environment.
This rule identifies the execution of NimScan based on the process image name and specific hash values associated with different versions of the tool.
Page 180 of 203