Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,868 detections
Filters
Last updated
All Time
Detection languages
2,527
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,092
793
576
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,757
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects a browser session that contacts an EvilTokens Device Code phishing endpoint (/api/device/status/) and then immediately navigates to onedrive.live.com, indicating the attacker backend returned status:completed and the kit executed window.location.replace to redirect the victim to OneDrive after token capture. This sequence suggests a successful device code phishing attack where the victim's credentials or tokens have been captured, and they are then redirected to a legitimate service to avoid suspicion.
This rule detects successful user sign-ins from anomalous IP addresses, indicative of an Adversary-in-the-Middle (AiTM) reverse proxy attack. It correlates successful logins with the receipt of a phishing email containing specific subject keywords ('Code of Conduct') within a two-hour window, suggesting that the login was a direct result of the phishing lure.
Detects a compromised account revoking refresh tokens, signing out other sessions, or replacing authentication state to retain exclusive access. This behavior is indicative of an attacker attempting to maintain exclusive control over a compromised account by invalidating other legitimate sessions or tokens.
This rule detects attempts to modify or delete Conditional Access Policies within Azure Active Directory (now Microsoft Entra ID) by monitoring network events targeting 'graph.microsoft.com' with 'conditionalAccessPolicies' in the AdditionalFields, specifically looking for 'PATCH' or 'DELETE' operations. Such activities could indicate an adversary attempting to weaken security controls or maintain persistence.
Detects the successful removal of Azure Resource Management locks. Attackers may attempt to delete these locks to modify, move, or delete protected resources that would otherwise be restricted, often as a precursor to data destruction or infrastructure tampering.
Detects the successful removal of Azure Resource Management locks. Attackers may attempt to delete these locks to modify, move, or delete protected resources that would otherwise be restricted, often as a precursor to data destruction or infrastructure tampering.
This rule monitors for unauthorized deletion or modification of Microsoft Sentinel alert rules and automation rules. Such actions are indicative of an attacker attempting to impair security monitoring, silence alerts, or disable automated responses to maintain persistence and evade detection.
Detects high volumes of sign-in failures or instances where Conditional Access policies are not applied, particularly for unregistered devices, indicating potential attempts to bypass security controls or perform brute-force attacks against cloud authentication.
Detects the invitation of an external user to the Azure AD tenant. This activity often results in the creation of a guest account with the '#EXT#' suffix in the User Principal Name (UPN). Monitoring this event is critical for identifying potential unauthorized external access or social engineering attempts aimed at gaining persistence within the environment.
Detects installation or update of a VM extension whose settings invoke scripts, remote support tooling, or command execution outside standard configuration management. This could indicate an adversary establishing persistence or remote access.
This rule detects successful configuration modifications to diagnostic settings or storage services where the destination resource is identified as being outside of the organization's trusted subscriptions or expected storage naming conventions. This activity may indicate an adversary attempting to exfiltrate logs or data to an attacker-controlled storage account.
Detects when a single user initiates a high volume (5 or more) of external guest user invitations within a one-hour window. This behavior can be indicative of reconnaissance or attempts to establish persistence by an compromised account by inviting external identities into the tenant.
Detects successful OAuth application consent events where the requested permissions include sensitive scopes such as Mail, Files, or User profile access. This is a common indicator of OAuth application-based phishing or persistence attempts, often referred to as 'Illicit Consent Grant' attacks.
This rule detects when sensitive administrative roles are assigned directly to users in Microsoft Entra ID (formerly Azure AD) without utilizing the Privileged Identity Management (PIM) service. Direct assignment of these roles bypasses the security controls and JIT (Just-In-Time) access workflows enforced by PIM, potentially indicating unauthorized privilege escalation or a misconfiguration.
This rule detects unauthorized or suspicious modifications to Microsoft Sentinel alert rules. It specifically monitors for the deletion of alert rules or the disabling of existing rules via the Azure activity logs. Such actions may indicate an attempt by an adversary to impair security monitoring and defensive capabilities.
This rule detects potentially malicious activity within Azure Automation by monitoring for the creation or modification of runbooks and jobs, combined with the presence of suspicious command-line or script patterns in job stream output, such as credential harvesting (e.g., Get-AutomationPSCredential) or execution of web-based payloads (e.g., IEX, Invoke-WebRequest).
Detects instances where a guest user is invited to the organization using an email address from potentially malicious TLDs (e.g., .ru, .cn, .ir, .kp) or a domain structure that is represented as an IP address. These patterns are often associated with phishing, reconnaissance, or adversary attempts to gain a foothold in an environment by inviting external identities.
Detects any modification (add, update, or delete) to Entra ID cross-tenant access settings. Adversaries may manipulate these trust configurations to weaken inbound security restrictions, establish unauthorized access between tenants, or facilitate cross-tenant impersonation.
Detects potential Adversary-in-the-Middle (AiTM) phishing activity by identifying successful user sign-ins from a new, historically unseen IP address occurring within 30 minutes of a legitimate sign-in from a known IP, indicating the potential replay of a stolen session or refresh token.
Detects modifications or publication of Azure Automation runbooks by users or service principals other than known, pre-approved automation service principals. This activity may indicate an unauthorized user or compromised service principal attempting to inject malicious code into automation workflows.
Detects anomalous, high-frequency account enumeration activity in cloud audit logs, specifically targeting user, group, device, and service principal listing operations. This behavior is indicative of potential reconnaissance or discovery efforts by an attacker who has compromised a user account.
Page 111 of 185