Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,864 detections
Filters
Last updated
All Time
Detection languages
2,523
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,448
1,199
1,091
792
575
Platforms
39,926
7,251
6,535
3,864
3,632
Products / Services
1,755
1,449
1,120
438
406
MITRE Techniques
1,888
1,391
913
814
726
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
This rule detects when an excessive number of permissions are changed for an application within Microsoft Entra ID (formerly Azure AD). While adding permissions is a normal activity, a sudden increase in the number of permissions granted to an application, exceeding a defined threshold (currently 5), could indicate malicious activity such as an attacker attempting to escalate privileges or broaden access for a compromised application. The rule specifically looks for 'Update application' events in Azure AD Directory Audit logs where the 'RequiredResourceAccess' attribute changes significantly.
This rule detects requests to the Microsoft Graph API's '/v1.0/users' endpoint with a GET method and a successful 200 response code. This API call is used to enumerate users within an Azure Active Directory environment. The rule is designed to identify potential reconnaissance activities where an attacker might be collecting a listing of users. It notes that this can be a 'chatty' API call, meaning it might generate a high volume of legitimate traffic.
This rule detects when a single user adds more than 4 members to the same Office 365 group within a 5-minute window. It specifically looks for successful 'Add member to group' events in Office 365 audit logs, focusing on the `GROUP_MODIFICATION` event type. The threshold of 4 users added is configurable.
This rule detects when a user is successfully removed from a group within Office 365. It specifically looks for 'GROUP_MODIFICATION' events with the product event type 'Remove member from group.' from Microsoft Office 365, where the action was allowed.
This rule detects the hard deletion of an application within Entra ID (formerly Azure AD). A 'hard delete' means the application is permanently removed without a recovery option, which can indicate malicious activity such as an attacker attempting to remove traces of their presence or disrupt services by deleting critical applications.
This rule detects successful events where a user is added to a group within Office 365. It specifically looks for 'GROUP_MODIFICATION' events with the product event type 'Add member to group.' originating from 'Office 365' by 'Microsoft' where the security action was 'ALLOW'. The rule also identifies the user performing the action, the group name, group GUID, and the user who was added to the group.
This rule detects when an application in Entra ID (formerly Azure AD) is restored. This action implies that the application was previously soft-deleted and is now being recovered. This could be an administrative action to recover a mistakenly deleted application or could indicate an attempt to restore a malicious application that was previously removed.
This rule detects when an application is deleted in Entra ID (formerly Azure AD). This action is a soft delete, meaning the application can still be recovered. Detection is based on specific event types and product names within Azure AD audit logs.
Detects when a group is successfully deleted in Office 365. This rule specifically looks for events where the event type is 'GROUP_DELETION', the product event type is 'Delete group.', the product is 'Office 365', the vendor is 'Microsoft', and the security result action is 'ALLOW'. It also tracks the user responsible for the deletion.
Detects when a new group is successfully created within Office 365. This rule specifically looks for events indicating a 'GROUP_CREATION' event type with a product event type of 'Add group.' originating from 'Office 365' by 'Microsoft', where the action was 'ALLOW'. This can help identify legitimate administrative actions or potentially unauthorized group creation.
Detects the execution of AADInternals PowerShell cmdlets. AADInternals is a tool used for administering Azure AD and Office 365, which can be abused by threat actors for various attacks including reconnaissance, credential access, and impact within Azure AD or Office 365 environments. The rule specifically looks for the unique "-AADInt" string prefix in cmdlet names.
Logins to Azure AD PowerShell app can have legitimate purposes, but are also abused to gain access to user information. Programatic access to Azure AD should generally be through other apps
Estimate Access is an undocumented API in MS Graph and is used in the following GraphRunner functions Get-UpdatableGroups, Get-DynamicGroups and Invoke-GraphRecon. Although not inherently malicious, it does submit an action and then determines if the user can perform it
This detects actions intended to identify updatable groups in Entra ID. GraphRunner contains a function called Get-UpdatableGroups but other tools may as well.
Detects when a group is attempted to be created but fails in Office 365. This could be due to insufficient permissions or other errors
Detects authentication to O365 followed by a non-interactive sign-ins that aligns to suspicious activity.
The authorization policy of Entra ID (User Settings) contains information about who can create applications, invite guest users and more. It's not something that is generally modified or reviewed except by administrators so it's worth knowing who may be requesting this endpoint.
Identify when the http delete method is being called within the Microsoft Graph API.
Identify the use GraphRunner's Invoke-DumpApps function to collect applications and external apps as well as users that consented to permissions in their apps.
This detects when a 401 Unauthorized status is received on multiple attempts of the same file when attempting to download from OneDrive and may indicate a permissions issue for the user.
This detects when a 401 Unauthorized status code is returned when attempting to download multiple unique files from OneDrive and may indicate a permissions issue for the user.
Page 178 of 184