Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,867 detections
Filters
Last updated
All Time
Detection languages
2,526
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
793
576
Platforms
39,952
7,270
6,537
3,867
3,651
Products / Services
1,756
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects a non-interactive sign-in using a refresh token for the Microsoft Authentication Broker client, targeting the Device Registration Service (DRS) with the 'adrs_access' scope. This specific combination of attributes is highly indicative of an adversary using tools like ROADtools to register a malicious device in the tenant following a successful OAuth phishing attack.
Detects Microsoft Entra ID sign-in events where a user principal authenticates using a refresh token issued to the Microsoft Authentication Broker (MAB) client, targeting the Device Registration Service (DRS) with the "adrs_access" OAuth scope. This pattern may indicate token-based access to DRS following an initial authorization code phishing or as a precursor to malicious device registration using tools like ROADtx.
Detect suspicious graph user activity with behavioral analytics (UEBA)
Detects a sequence of events indicative of a new device being registered using a refresh token, a TTP associated with the ROADtools framework following an OAuth phishing attack. This sequence involves the Device Registration Service adding a device with a specific hardcoded OS version, followed by user and owner assignments, all within a short timeframe and sharing the same correlation ID.
This rule detects activity from a list of specified malicious IP addresses across network connection events and sign-in attempts. It correlates `DeviceNetworkEvents` (network connections from devices) and `SigninLogs` (user authentication attempts) to identify instances where these IPs are involved. The rule is designed for hunting, looking back 30 days for any activity originating from the defined IP addresses.
This rule detects attempts to phish user credentials by identifying Base64 encoded User Principal Names (UPNs) or their domains within URLs clicked by users. Adversaries often encode sensitive information like UPNs in malicious URLs to bypass security controls or to make the links appear less suspicious. The rule specifically looks for partial Base64 encoded strings of the user's UPN or domain within the 'UrlChain' field of URL click events.
Hypothesis: An adversary who has successfully phished a user for an OAuth authorization code or refresh token may use it in a non-interactive sign-in to abuse trusted first-party Microsoft applications for persistence or data exfiltration.
This rule detects two primary scenarios observed in such campaigns:
1. A refresh token issued to the Microsoft Authentication Broker is used to access the Device Registration Service (DRS) with the 'adrs_access' scope. This is indicative of an adversary registering a new device to gain persistence via a Primary Refresh Token (PRT).
2. A token is used by the Visual Studio Code application to access the Microsoft Graph API. This can be used by an attacker who has phished an authorization code to exfiltrate data like emails.
This rule detects two primary scenarios observed in such campaigns:
1. A refresh token issued to the Microsoft Authentication Broker is used to access the Device Registration Service (DRS) with the 'adrs_access' scope. This is indicative of an adversary registering a new device to gain persistence via a Primary Refresh Token (PRT).
2. A token is used by the Visual Studio Code application to access the Microsoft Graph API. This can be used by an attacker who has phished an authorization code to exfiltrate data like emails.
KQL Query from file: Potential MFASweep (tool) activity has been detected.
Detects potential malicious use of LDAP queries associated with Metasploit activity targeting Active Directory. LDAP enumeration can reveal detailed information about users, groups, computers, and other objects within a network that can be exploited by attackers.
Detects when a Global Administrator elevates access to all subscriptions and management groups in a tenant. When a Global Administrator elevates access they are assigned the User Access Administrator role at root scope. This Sentinel analytics rule monitors who has elevated access in your tenant so that admins can take appropriate action.
This detection identifies when Microsoft Copilot Studio agents are created in your organization's tenant. This activity is significant as the default behavior in Copilot agent creation is to configure a new service principal with cloud app administrator role.
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
This detection rule identifies when Microsoft Copilot Studio agent properties are modified in your organization's tenant. This activity is significant as the default behavior in Copilot agent creation is to configure a new service principal with cloud app administrator role.
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
KQL Query from file: Kerberos Roasting Detection
KQL Query from file: GraphRunner Recon Detection & Response
KQL Query from file: Threat Hunting AzureHound Usage
KQL Query from file: Azure Cloud Security Monitoring
KQL Query
KQL Query from file: Detect Microsoft Graph API Abuse
KQL Query from file: Monitoring Cross-Tenant Abuse by Threat Actors
KQL Query from file: Monitor Privilege User SSPR
KQL Query
Page 155 of 185