Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,749 detections
Filters
Last updated
All Time
Detection languages
2,543
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,244
994
880
773
476
Platforms
2,849
1,449
1,229
356
73
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
1,096
988
949
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Detects when a new user is created in Entra ID (formerly Azure Active Directory) and subsequently assigned administrative or other specified roles within a 90-minute window. This rule aims to identify potential privilege escalation or suspicious account setup activities.
This rule detects successful Office 365 login activity to applications that are not part of a predefined list of common, first-party Microsoft Cloud applications. This can help identify potentially unauthorized or unusual access to cloud resources via less common applications, which might indicate credential compromise or an attempt to bypass standard access controls. The rule specifically excludes certain known benign Microsoft application IDs and allows for filtering out ADFS synchronization traffic.
This rule detects when the Unified Audit Log (UAL) is disabled in Office 365. This is identified by monitoring for the 'Set-AdminAuditLogConfig' product event type where the 'UnifiedAuditLogIngestionEnabled' field is set to 'False'. Disabling the UAL can indicate an adversary attempting to impair defenses and avoid detection by preventing their actions from being logged.
This rule detects when anonymous links are used to access files from OneDrive. While not always malicious, some organizations prohibit anonymous links due to data leakage risks. The rule specifically looks for 'USER_RESOURCE_ACCESS' events with 'FileAccessed' product event type from Office 365, where the principal user ID indicates an anonymous access (e.g., 'urn:spo:anon#' or 'anonymous').
This rule detects when anonymous links are used to access files from OneDrive. While this isn't always a sign of malicious activity, some organizations do not support the use of anonymous links because of the risk of data leakage. The rule specifically looks for 'USER_RESOURCE_ACCESS' events with 'AnonymousLinkUsed' as the product event type, originating from 'Office 365' and 'Microsoft', where the user ID is 'anonymous'.
This rule detects when the Unified Audit Log is enabled in Office 365. This event is triggered when the 'Set-AdminAuditLogConfig' cmdlet is used to set 'UnifiedAuditLogIngestionEnabled' to 'True'. While enabling logging is generally a positive security action, this rule is designed to alert if logging was previously disabled and is now being re-enabled, which could indicate an adversary attempting to cover their tracks after a period of operating without logging, or to restore logging after intentionally disabling it.
Detect when the Unified Audit Log is disabled
Continual logins to Azure AD PowerShell app are not a security best practice, if this is observed, additional investigation is needed
Detects when an Entra ID conditional access policy has been modified
This rule detects O365 login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by default
Detects file downloads using O365 or Graph Activity logs, not including anonymous file links
Detect when the Unified Audit Log is enabled
Secrets added to applications have legitimate purposes, but can also be a method of persistence. This alert will trigger on creation, modification or delete of a client secret
Logins to Azure AD PowerShell app can have legitimate purposes, but are also abused to gain access to user information. Programmatic access to Entra ID (Azure AD) should generally be through apps, so reviewing these activities is needed.
This rule detects O365 login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by default
Anonymous links can be used to export files from OneDrive. While this isn't always a sign of malicious activity, some organizations do not support the use of anonymous links because of the risk of data leakage. This rule detects when anonymous links are used to access files from OneDrive.
Anonymous links can be used to export files from OneDrive. While this isn't always a sign of malicious activity, some organizations do not support the use of anonymous links because of the risk of data leakage. This rule detects when anonymous links are used to download files from OneDrive.
Anonymous links can be used to access files from OneDrive. While this isn't always a sign of malicious activity, some organizations do not support the use of anonymous links because of the risk of data leakage. This rule detects when anonymous links are used to access files from OneDrive.
Anonymous links can be used to export files from OneDrive. While this isn't always a sign of malicious activity, some organizations do not support the creation of anonymous links because of the risk of data leakage. This rule detects the creation or modification of anonymous links in OneDrive.
Detects when a user is created in Entra ID and assigned roles within a defined time window.
This rule detects suspicious user-agent strings associated with the GraphRunner tool. GraphRunner is a PowerShell script used for interacting with Microsoft Graph API and other Microsoft services, often for malicious purposes like token manipulation or brute-forcing client IDs. The rule specifically looks for a predefined set of user-agent strings that are hardcoded within GraphRunner's functions. Detection is focused on Azure Activity, Office 365, Azure AD, Azure AD Directory Audit, and Microsoft Graph Activity logs. The rule aggregates detections by principal IP or user ID over a 5-minute window.
Page 174 of 179