Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,936
7,266
6,535
3,866
3,647
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects changes to Entra ID Conditional Access policies that degrade security posture. This includes deleting a policy, disabling an enabled policy, removing grant controls (like MFA requirements), expanding trusted location/IP ranges, or adding user/group/role exclusions. Such activities are indicative of an attacker attempting to weaken authentication and security enforcement to maintain persistent access or facilitate further lateral movement.
Detects attempts to exploit a SharePoint vulnerability that involves bypassing SafeControls via quote-injection within the Register directive. The rule monitors POST requests to .aspx files for specific malicious patterns, including the use of 'ignoreParentFrozen' and malformed 'Register' tags that facilitate unauthorized code execution.
Detects modifications to Azure DevOps pipelines or service connections that include indicators of outbound tunneling or reverse proxy tools (e.g., ngrok, socat, chisel, or SSH reverse tunnels). This behavior is characteristic of an attacker attempting to establish a command-and-control channel or bypass firewall restrictions by tunneling traffic out of the CI/CD pipeline execution environment.
Detects modifications to domain federation settings in Microsoft Entra ID (formerly Azure AD) where a domain is converted from a managed authentication state to a federated authentication state. This type of configuration change is often used by adversaries to establish persistence or facilitate domain-level identity deception.
This rule detects potentially compromised accounts by correlating suspicious authentication activity (such as risky sign-ins, impossible travel, or malicious OAuth/Mail-rule configurations) with a subsequent spike in SharePoint or OneDrive file access, downloads, or external link sharing within a one-hour window. This behavior is indicative of an adversary performing cloud-based data exfiltration after gaining unauthorized access to an account.
Detects exploitation attempts against Microsoft SharePoint leveraging the ToolShell exploit chain, as well as subsequent post-exploitation webshell activity involving anomalous 'layoutNsp.aspx' naming conventions. This covers initial exploitation of vulnerabilities such as CVE-2025-49704 and associated variants, followed by the deployment of webshells associated with the ToolShell campaign.
Detects exploitation attempts against Microsoft SharePoint leveraging the ToolShell exploit chain, as well as subsequent post-exploitation webshell activity involving anomalous 'layoutNsp.aspx' naming conventions. This covers initial exploitation of vulnerabilities such as CVE-2025-49704 and associated variants, followed by the deployment of webshells associated with the ToolShell campaign.
This rule detects a password-spraying attack pattern directed at privileged or manager-titled accounts. It monitors for multiple failed sign-in attempts from a single source IP address against a large volume of distinct user accounts identified as managers or senior staff. The detection logic filters for low-frequency attempts per account, which is indicative of a distributed spray attack designed to evade account lockout thresholds while focusing on high-value targets.
Detects modifications to Microsoft Entra ID (formerly Azure AD) authentication policies, specifically the registration, enablement, or modification of External Authentication Methods (EAMs). This activity can indicate an attempt to add a rogue authentication provider for persistent unauthorized access, bypassing standard MFA or conditional access policies.
This rule detects anomalous activity associated with the Antino backdoor, which uses Microsoft OneDrive as a dead-drop command-and-control (C2) channel. It identifies specific file paths related to heartbeat check-ins, operator tool drops, and exfiltration retrieval, summarizing events by user and IP to highlight potential malicious persistent communication and data transfer patterns.
Detects anomalous authentication patterns associated with AI agent or service account credentials. The rule monitors for logins originating from multiple disparate network locations, ASNs, or countries within a 15-minute window, and detects unexpected MFA challenges directed at accounts that typically function as automated, headless identities.
Detects registration of a new actor-controlled MFA authentication method (phone, authenticator app, or software OTP token) via an Update user operation, matching the NO_DEVICE/NO_DEVICE_TOKEN/SoftwareTokenActivated pattern used to convert temporary compromise into durable identity persistence
This rule detects potential adversary-in-the-middle (AiTM) session hijacking by monitoring non-interactive sign-in events. It identifies when a refresh token is redeemed from a device identifier that does not exist in the user's recent interactive sign-in history and from a geographical location different from the user's last known interactive session.
Detects potential session cookie replay attacks by identifying sign-in events using SSO or session tokens from different IP addresses, geographic locations, or devices compared to an established user baseline, without a corresponding fresh MFA challenge in the same timeframe. This behavior is indicative of unauthorized access to an already-authenticated session.
Detects successful authentication events to Snowflake cloud data warehouse platforms where no secondary authentication factor (MFA) was registered or triggered. This pattern is indicative of potential credential stuffing or reuse attacks, particularly those involving stolen credentials from infostealer malware, where MFA was not configured or successfully bypassed.
Detects potential insider threats or departing employees by correlating abnormal bulk data downloads from cloud repositories (SharePoint/OneDrive/Box/etc.) with subsequent sensitive data access and exfiltration signals. It uses baseline behavioral profiling, requires a threshold of sensitive file interactions, and mandates high-confidence exfiltration indicators (removable media usage, suspicious external domains, or multiple combined destination events) to reduce noise. Archive/staging activity is used as an optional confidence booster.
Hunting query, not intended as a scheduled alert.
Tested in a live Sentinel tenant with a test file. Copilot Cowork and Claude Code folder conventions not validated with live events; the Tool column is a label only and does not filter results. Matches files named SKILL.md in OneDrive and SharePoint only; local-only files and marketplace plugin skills are not visible.
Tested in a live Sentinel tenant with a test file. Copilot Cowork and Claude Code folder conventions not validated with live events; the Tool column is a label only and does not filter results. Matches files named SKILL.md in OneDrive and SharePoint only; local-only files and marketplace plugin skills are not visible.
Detects unauthorized POST requests to SharePoint WebPart gallery pages that lack valid authentication cookies, which may indicate exploitation of CVE-2026-65660. The rule monitors for POST methods to specific SharePoint pages while excluding requests that already contain standard SharePoint authentication cookies (FedAuth, rtFa).
This rule correlates phishing emails containing URLs with successful, MFA-satisfied sign-ins from an ASN or network location that has not been associated with the user account within the previous 30 days. This pattern is highly indicative of an Adversary-in-the-Middle (AiTM) session hijacking attempt, where a user is phished and their session cookie is intercepted by an attacker.
Detects a suspicious sequence of events involving NetScaler ADC or Gateway appliances: anomalous account authentication, followed by the establishment of a VPN or remote access session, and subsequent unusual outbound network activity indicating potential lateral movement or C2 communication from the appliance.
Detects modifications to domain federation settings in Microsoft Entra ID (formerly Azure AD) where a domain is converted from a managed authentication state to a federated authentication state. This type of configuration change is often used by adversaries to establish persistence or facilitate domain-level identity deception.
Page 7 of 142