Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,921
7,246
6,535
3,864
3,627
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
This rule detects O365 login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by default
Detect when the Unified Audit Log is enabled
Secrets added to applications have legitimate purposes, but can also be a method of persistence. This alert will trigger on creation, modification or delete of a client secret
Logins to Azure AD PowerShell app can have legitimate purposes, but are also abused to gain access to user information. Programmatic access to Entra ID (Azure AD) should generally be through apps, so reviewing these activities is needed.
This rule detects O365 login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by default
Anonymous links can be used to export files from OneDrive. While this isn't always a sign of malicious activity, some organizations do not support the use of anonymous links because of the risk of data leakage. This rule detects when anonymous links are used to access files from OneDrive.
Anonymous links can be used to export files from OneDrive. While this isn't always a sign of malicious activity, some organizations do not support the use of anonymous links because of the risk of data leakage. This rule detects when anonymous links are used to download files from OneDrive.
Anonymous links can be used to access files from OneDrive. While this isn't always a sign of malicious activity, some organizations do not support the use of anonymous links because of the risk of data leakage. This rule detects when anonymous links are used to access files from OneDrive.
Anonymous links can be used to export files from OneDrive. While this isn't always a sign of malicious activity, some organizations do not support the creation of anonymous links because of the risk of data leakage. This rule detects the creation or modification of anonymous links in OneDrive.
Detects when a user is created in Entra ID and assigned roles within a defined time window.
This rule detects suspicious user-agent strings associated with the GraphRunner tool. GraphRunner is a PowerShell script used for interacting with Microsoft Graph API and other Microsoft services, often for malicious purposes like token manipulation or brute-forcing client IDs. The rule specifically looks for a predefined set of user-agent strings that are hardcoded within GraphRunner's functions. Detection is focused on Azure Activity, Office 365, Azure AD, Azure AD Directory Audit, and Microsoft Graph Activity logs. The rule aggregates detections by principal IP or user ID over a 5-minute window.
This rule detects GET requests to the Microsoft Graph API's '/v1.0/groups' endpoint. This activity can indicate an adversary enumerating groups within an Azure Active Directory environment, potentially using tools like GraphRunner's 'Get-DynamicGroups' function or similar custom scripts. Successful requests (HTTP 200) are specifically targeted.
This rule detects suspicious activity involving an initial successful authentication to Office 365, followed by a non-interactive sign-in to Azure Activity (Entra ID) from the same user and IP address, but with different session IDs, applications, and user agents. This pattern is indicative of token theft and reuse, potentially using tools like GraphRunner, where an adversary uses a stolen token to perform non-interactive actions. The rule specifically looks for a mismatch in session ID, application, and user agent between the initial interactive login and the subsequent non-interactive login, while the user and IP remain consistent. The user agent strings are specifically chosen to align with those used by the GraphRunner tool.
Detects when mail items are accessed via API through an Entra ID application that is not explicitly approved. This rule specifically looks for 'MailItemsAccessed' events in Office 365 where the accessing application's ClientAppId does not match known legitimate Microsoft applications like Exchange Online, Substrate Context Service, or Microsoft Office. This could indicate unauthorized access to mailboxes by a suspicious application.
This rule detects API requests to the Microsoft Graph search/query endpoint. This endpoint can be used by adversaries to enumerate items such as SharePoint site URLs, which is a common technique used by tools like GraphRunner's Get-SharePointSiteURLs function. The detection specifically looks for successful POST requests to 'https://graph.microsoft.com/v1.0/search/query'.
This rule identifies API requests made to the Microsoft Graph API to access user mailboxes and retrieve a specified number of messages. It specifically looks for GET requests to the `/v1.0/users/*/mailFolders/*/messages?$top=` endpoint with a successful HTTP 200 response. This activity could indicate an attacker attempting to exfiltrate emails from a compromised mailbox.
Detects when an attempt to create a group in Office 365 fails. This could indicate an adversary attempting to create a new group for various purposes (e.g., data exfiltration, privilege escalation) but being blocked due to insufficient permissions, policy restrictions, or other errors. Repeated failures from a single user might suggest a targeted attempt.
This rule detects when a single user adds more than 4 members to the same Office 365 group within a 5-minute window. It specifically looks for successful 'Add member to group' events in Office 365 audit logs, focusing on the `GROUP_MODIFICATION` event type. The threshold of 4 users added is configurable.
This rule detects when a user is successfully removed from a group within Office 365. It specifically looks for 'GROUP_MODIFICATION' events with the product event type 'Remove member from group.' from Microsoft Office 365, where the action was allowed.
Detects when a group is successfully deleted in Office 365. This rule specifically looks for events where the event type is 'GROUP_DELETION', the product event type is 'Delete group.', the product is 'Office 365', the vendor is 'Microsoft', and the security result action is 'ALLOW'. It also tracks the user responsible for the deletion.
Detects when a new group is successfully created within Office 365. This rule specifically looks for events indicating a 'GROUP_CREATION' event type with a product event type of 'Add group.' originating from 'Office 365' by 'Microsoft', where the action was 'ALLOW'. This can help identify legitimate administrative actions or potentially unauthorized group creation.
Page 147 of 150