Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,868 detections
Filters
Last updated
All Time
Detection languages
2,527
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,092
793
576
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,757
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
This rule detects potential malicious activity associated with the 'ClickFix' technique, commonly linked to Midnight Blizzard. It identifies a sequence of events where a device attempts to resolve or fetch a 'wpad.dat' file (a common indicator of proxy configuration manipulation or man-in-the-middle attempts) followed shortly thereafter by the execution of 'powershell.exe' or 'mshta.exe' spawned from 'explorer.exe' on the same host within a 30-minute window. This pattern is indicative of a user being coerced into executing malicious scripts under the guise of fixing connectivity or security prompts.
This rule identifies potential account compromise or session hijacking by correlating anomalous outbound email patterns with risky sign-in events. It monitors for users who send outbound emails to a threshold of previously unseen external recipients within a short window after authenticating under suspicious conditions, such as high-risk sign-in flags, atypical locations, or unfamiliar applications. This pattern is indicative of attackers using stolen session tokens or compromised credentials to perform mass outbound phishing, spamming, or data exfiltration from an internal mailbox.
This rule detects potential Adversary-in-the-Middle (AiTM) activity by correlating network events indicating a connection to a known phishing domain with subsequent suspicious authentication behavior. Specifically, it identifies sessions associated with non-corporate IP addresses that show evidence of token reuse (e.g., multiple distinct IP addresses for the same session identifier) occurring within a short window after accessing a phishing portal.
Detects interactive sign-in attempts for accounts commonly associated with Microsoft sync services (e.g., AD Connect, MSOL sync). Service accounts should typically perform background, non-interactive authentication. An interactive login for these accounts may indicate credential misuse or unauthorized access.
Detects interactive sign-in attempts for accounts commonly associated with Microsoft sync services (e.g., AD Connect, MSOL sync). Service accounts should typically perform background, non-interactive authentication. An interactive login for these accounts may indicate credential misuse or unauthorized access.
This rule monitors Azure Active Directory (Microsoft Entra ID) audit logs for the addition or modification of application registrations that contain specific, potentially malicious redirect URI patterns ('brk-' or 'brk-multihub'). These patterns are associated with OAuth consent phishing or malicious application authorization where an adversary registers an app to intercept authorization codes.
This rule detects when a user registers a new multi-factor authentication (MFA) method from an Autonomous System Number (ASN) that the user has not used for authentication in the previous 30 days. This behavior is indicative of potential account takeover or an adversary setting up persistent MFA access from a new location.
Provides a consolidated access review report for all Microsoft Entra ID users, including account status (Enabled/Disabled), assigned roles, role assignment history, group memberships, and membership counts. Supports identity governance, user access reviews, and multi-vendor environments by providing a single view of user access and permissions.
This rule detects potentially malicious attempts to leverage different Microsoft cloud applications (FOCI family) in a short time frame following a conditional access block (AADSTS53003). The rule identifies scenarios where a single user account, within a 10-minute window, generates a 53003 failure while attempting to use multiple different client applications (such as Teams, O365, or Azure Portal), which may indicate an adversary attempting to bypass or probe security controls or testing token validity across multiple services.
This rule detects modifications or registrations of Pass-Through Authentication (PTA) agents and changes to federation settings within an identity tenant. Such actions can indicate an adversary attempting to establish persistence, bypass authentication mechanisms, or intercept credentials by manipulating the authentication infrastructure.
Detects the creation of a new Service Principal followed by an immediate application of an app role assignment within one hour. The rule specifically targets service principals with names suggestive of automation, AI, or assistant-related roles (e.g., 'copilot', 'llm', 'bot'), which may indicate the use of newly created service principals for potential persistence or unauthorized access.
This rule detects modifications or registrations of Pass-Through Authentication (PTA) agents and changes to federation settings within an identity tenant. Such actions can indicate an adversary attempting to establish persistence, bypass authentication mechanisms, or intercept credentials by manipulating the authentication infrastructure.
This rule detects potentially malicious attempts to leverage different Microsoft cloud applications (FOCI family) in a short time frame following a conditional access block (AADSTS53003). The rule identifies scenarios where a single user account, within a 10-minute window, generates a 53003 failure while attempting to use multiple different client applications (such as Teams, O365, or Azure Portal), which may indicate an adversary attempting to bypass or probe security controls or testing token validity across multiple services.
This rule identifies successful user sign-ins originating from IP addresses associated with residential or commercial VPN ASNs that have not been observed in the user's historical sign-in data (past 30 days). By comparing current activity against a baseline of known user locations, it flags potentially unauthorized access through masked connections.
Detects anomalous access to the Azure Portal Single Page Application (SPA) by monitoring sign-in logs. The rule flags users accessing this specific application from multiple devices or over an unusually long time span (exceeding 24 hours), which may indicate session hijacking, token theft, or unauthorized access attempts via stolen session tokens.
This rule monitors Azure Active Directory (Microsoft Entra ID) audit logs for the addition or modification of application registrations that contain specific, potentially malicious redirect URI patterns ('brk-' or 'brk-multihub'). These patterns are associated with OAuth consent phishing or malicious application authorization where an adversary registers an app to intercept authorization codes.
This rule detects anomalous activity involving the legacy Microsoft Azure AD Graph API (graph.windows.net) originating from users who lack corresponding entries in standard Entra ID (AuditLogs) sign-in or management activity logs. A high frequency of these undocumented API calls (more than 5 in an hour) from a specific user and IP address indicates potential unauthorized reconnaissance or access attempts attempting to bypass standard audit logging.
Detects Azure AD sign-ins to Microsoft Teams flagged with an elevated risk state, which may indicate cloud account abuse following external Teams-based social engineering contact preceding a broader spike in malicious M365 activity.
attackers are continuously abusing Device Code phishing, convincing victims to authenticate using the legitimate Microsoft login page. The victim completes the password and MFA correctly, but the resulting tokens are delivered to the attacker.
And one point that I think is important: Device Code Flow should not be enabled if you don't really need it. The recommendation is clear: disable it where possible and only allow documented exceptions.
The KQL below takes Cmsi:Cmsi as a reference (which means a Device Code Authentication flow was used) point and looks 15 minutes backwards (the time that a Code is valid) for the same user, grouping the authentication flow together with countries, IPs, browsers and User-Agents. The aim is to identify authentication flows where we observe different Browsers, Countries, IPs or User-Agents, potentially showing the transition between the victim and attacker context.
The idea is simple: Look at the complete authentication sequence and identify what changes between the victim and attacker context.
And one point that I think is important: Device Code Flow should not be enabled if you don't really need it. The recommendation is clear: disable it where possible and only allow documented exceptions.
The KQL below takes Cmsi:Cmsi as a reference (which means a Device Code Authentication flow was used) point and looks 15 minutes backwards (the time that a Code is valid) for the same user, grouping the authentication flow together with countries, IPs, browsers and User-Agents. The aim is to identify authentication flows where we observe different Browsers, Countries, IPs or User-Agents, potentially showing the transition between the victim and attacker context.
The idea is simple: Look at the complete authentication sequence and identify what changes between the victim and attacker context.
Detects Azure AD sign-ins to Microsoft Teams flagged with an elevated risk state, which may indicate cloud account abuse following external Teams-based social engineering contact preceding a broader spike in malicious M365 activity.
Detects Azure AD sign-ins to Microsoft Teams flagged with an elevated risk state, which may indicate cloud account abuse following external Teams-based social engineering contact preceding a broader spike in malicious M365 activity.
Page 87 of 185