Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,867 detections
Filters
Last updated
All Time
Detection languages
2,526
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
793
576
Platforms
39,952
7,270
6,537
3,867
3,651
Products / Services
1,756
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
This rule detects potential quishing (QR code phishing) attempts by identifying emails with one or more image attachments and minimal URL content, followed by a risky user authentication event within a 3-hour window. This behavior is indicative of an attacker attempting to harvest credentials via a malicious QR code that redirects the user to a phishing site.
Detects the modification of critical Entra ID authentication method policies, such as the registration or configuration of external MFA/OIDC providers, by a user account shortly after an anomalous or high-risk login event. This behavior is indicative of an attacker attempting to establish persistent backdoor access via rogue MFA provider registration, consistent with techniques used to subvert cloud authentication policies.
This rule identifies enterprise resource access from OnePlus or OxygenOS devices that lack proper management or compliance. It calculates an exposure score based on factors including device management status, compliance state, device trust type, and whether the device is newly observed. The rule flags high and medium priority exposure incidents, specifically targeting non-managed or non-compliant BYOD devices, which could represent an increased risk profile for corporate data access.
This rule detects potentially compromised accounts by correlating risky Entra ID sign-ins to Citrix NetScaler with subsequent VPN session establishment followed by rapid, high-volume outbound connection activity from the source IP address. This pattern is indicative of a threat actor using compromised credentials to gain access via VPN and immediately perform internal network scanning or data staging.
Detects high or medium severity security alerts related to Kerberos Golden Ticket forgery, as identified by Microsoft Defender for Identity. This rule filters for specific alert names indicative of forged TGTs minted from the krbtgt account, excluding generic or informational ticket anomalies.
Detects potential passkey phishing follow-on activity by monitoring for successful sign-ins from unmanaged or non-compliant devices to OfficeHome or via device code flow, followed within 30 minutes by access to self-service account-management applications, accompanied by specific authentication errors (50074 or 50140).
Detects a suspicious sequence of identity-related operations performed by a single user within a 2-hour window. The chain consists of a password reset, MFA method modification, new device registration, and a subsequent privilege escalation event (such as role assignment or application consent). This pattern is consistent with helpdesk-vishing campaigns often used by threat actors like Scattered Spider to perform full account takeovers.
This rule detects the creation of a new Azure AD (Entra ID) application with a name containing AI-related keywords (e.g., 'ai', 'copilot', 'gpt') that is subsequently granted high-privilege Microsoft Graph API permissions within a 24-hour window. This behavior is often associated with attackers setting up seemingly benign-looking applications to conduct OAuth-based persistent access or data exfiltration.
Detects successful sign-ins to Azure AI/ML related administrative consoles (such as Azure OpenAI, Azure Machine Learning, and Cognitive Services) from different countries within a short time window (4 hours), which is indicative of potential account compromise or credential abuse.
Detects a suspicious pattern where a user authenticates via device code and, within a short timeframe (two hours), registers a new device to their account. This behavior is indicative of the 'ARToken' persistence pattern, where an adversary uses a stolen session to bind a rogue device to the victim's account, potentially to mint a Primary Refresh Token (PRT) for persistent access.
Detects anomalous authentication patterns where multiple distinct user identities authenticate from the same source IP (often a VPN or proxy) within a short timeframe, characteristic of North Korean IT worker laptop-farm or identity-mule operations where a single operator manages multiple contractor accounts.
This rule detects scenarios where a user completes a device-code authentication flow, followed immediately (within 10 minutes) by the registration of an unmanaged, non-compliant device to their account. This behavior is indicative of potential token theft (e.g., EvilTokens) where an adversary uses a stolen token to register their own device as a persistent, unmanaged entity, bypassing standard corporate device enrollment controls.
This rule detects large-scale, non-interactive password-spraying campaigns targeting Microsoft Entra ID (Azure AD) accounts. It specifically identifies anomalous login behavior originating from Azure CLI or similar non-interactive clients, where a single source IP attempts to authenticate against a large number of distinct user accounts with a low number of failures per user within a short timeframe, characteristic of 'low-and-slow' password spraying.
Detects the 'auto-exfil' pattern associated with the TeamFiltration tool. The rule identifies a sequence of SharePoint Online file access immediately followed by a Microsoft Graph token request from the SharePoint Online Web Client Extensibility app. To reduce noise, it mandates a very short time delta between events (<= 60 seconds) combined with either the use of an IP address/ASN not previously seen for the account in the last 14 days, or a preceding failed sign-in attempt for the account.
Detects a suspected account compromise sequence where an account first authenticates to a Microsoft Teams application from infrastructure associated with TeamFiltration (e.g., specific AWS ranges), followed by a rapid (within 2 minutes) authentication to a VPN or SAML service provider from a different IP address, indicative of an account pivot.
Detects the TeamFiltration/UNK_CondorFiltration spray signature: a large
number of distinct target UserPrincipalNames within a single tenant, each
receiving only a handful of sign-in attempts, spread across many distinct
AWS EC2-hosted source IPs/regions within a short time window. Individual
sign-ins from AWS-hosted IP ranges (VPN gateways, corporate cloud proxies,
remote contractors) are not flagged on their own; the rule requires both
the account-fanout and the IP-rotation dimensions to co-occur for the same
tenant in the same window.
number of distinct target UserPrincipalNames within a single tenant, each
receiving only a handful of sign-in attempts, spread across many distinct
AWS EC2-hosted source IPs/regions within a short time window. Individual
sign-ins from AWS-hosted IP ranges (VPN gateways, corporate cloud proxies,
remote contractors) are not flagged on their own; the rule requires both
the account-fanout and the IP-rotation dimensions to co-occur for the same
tenant in the same window.
Detects anomalous, high-volume reconnaissance activity against multiple Microsoft Graph API endpoints (users, groups, roles, authentication methods, service principals, sites, and drives) by a single identity within a one-hour window. This behavior is indicative of post-compromise enumeration, often associated with threats like UNC6671/Storm-3121.
Detects instances where a user successfully authenticates via the OAuth Device Code flow using an unmanaged or non-compliant device, followed closely by high-privileged Azure/Graph API administrative actions within a short timeframe. This behavior is indicative of a device-code phishing attack aimed at bypassing MFA controls, including FIDO2/passkeys, by compromising an active session.
Detects instances where a user successfully authenticates via the OAuth Device Code flow using an unmanaged or non-compliant device, followed closely by high-privileged Azure/Graph API administrative actions within a short timeframe. This behavior is indicative of a device-code phishing attack aimed at bypassing MFA controls, including FIDO2/passkeys, by compromising an active session.
Detects attempts to tamper with, disable, or delete audit logging configurations in AWS CloudTrail and Azure Monitor. Monitoring these activities is critical to ensure that audit logs remain intact for security investigations.
This rule normalizes common Azure AD sign-in fields such as user principal names, source IP addresses, application display names, and authentication requirements for consistent monitoring and analysis.
Page 22 of 185