Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,868 detections
Filters
Last updated
All Time
Detection languages
2,527
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,092
793
576
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,757
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects anomalous non-interactive OAuth token requests against Microsoft Graph that claim multi-factor authentication (MFA) satisfaction from unmanaged devices. This behavior is indicative of Adversary-in-the-Middle (AiTM) token replay attacks, where captured session tokens are reused by an attacker to bypass authentication controls, consistent with tactics used by threat actors like Storm-2755 (Payroll Pirate).
Detects when a user or service principal is assigned the 'Owner' or 'Contributor' role at the Subscription scope in Azure. This activity is often associated with privilege escalation and persistent access techniques.
This rule detects an unusually high volume (10 or more within an hour) of successful access control or role-related operations initiated by a single caller in Azure Activity logs. Such activity could indicate an adversary attempting to enumerate permissions, escalate privileges, or modify access to resources within an Azure environment.
Detects high-frequency MFA factor updates, resets, activations, deactivations, or deletions for a single user within a 30-minute window. This behavior often indicates an adversary attempting to compromise or take control of account authentication mechanisms after gaining initial access.
Detects OAuth consent grants or permission additions in Microsoft Entra ID (Azure AD) audit logs that occur in conjunction with device login flow artifacts. This pattern is indicative of 'ConsentFix' or device code phishing attacks, where users are manipulated into authorizing malicious applications, potentially bypassing MFA requirements by using the device code flow.
Detects high-volume data access or exfiltration from Azure/Office 365 cloud environments via common scripting/automation user-agents. The rule monitors API requests to users, mail, drive, or files endpoints by non-standard clients (e.g., python, curl, Go) from previously unseen locations, calculating a risk score based on the number of endpoints accessed and the total data volume.
Detects creation of Intune device management scripts, a potential privilege abuse vector.
Detects when a single user principal name (UPN) performs two or more Azure AD admin role assignments within an hour. This could indicate an attempt to escalate privileges or establish persistence by assigning administrative roles to multiple accounts or to the same account multiple times.
Detects rapid succession of MFA authentication requests originating from multiple distinct countries within a 10-minute window, a common pattern indicating an MFA fatigue (push bombing) attack targeting a specific user.
This rule detects potential device code phishing attempts by correlating URL click events with sign-in logs using the 'deviceCode' authentication protocol. It specifically looks for successful or failed sign-ins (result types 0, 50074, 50076, 500121) that occur after a user clicks on a URL.
This rule detects potential session token theft or replay attacks by identifying non-interactive sign-in events that occur from a different IP or geographic location than the user's most recent successful MFA-authenticated interactive session. It flags cases where a non-interactive token is used within a short timeframe (1 hour) of an interactive session from a different location, which may indicate the exfiltration and subsequent use of session cookies or OAuth tokens.
Detects Microsoft 365 sign-in patterns indicative of an adversary bypassing Conditional Access device compliance requirements using an edge appliance proxy. The rule identifies successful authentication sessions from non-compliant or unmanaged devices that satisfy Conditional Access, often involving impossible travel or multiple source IPs, suggesting the use of an intermediary infrastructure to masquerade as a trusted location.
Detects potential multi-factor authentication (MFA) fatigue attacks in Azure AD by identifying a high number of push notification MFA challenges for a single user from a specific IP address within a short time frame. Specifically, it looks for 15 or more push notification MFA challenges within a 30-minute window.
This rule detects potential tampering with Conditional Access Policies in Azure Active Directory by monitoring for multiple update, delete, or add operations on policies containing 'Conditional Access' in their display name within a one-hour window. This could indicate an adversary attempting to weaken security controls to maintain access or bypass MFA.
This rule detects suspicious activity related to the assignment of application roles. Specifically, it identifies when a single user principal name (UPN) performs 10 or more successful 'Add app role assignment' operations within a one-hour window. This could indicate an attacker rapidly granting themselves or other entities access to multiple applications or resources.
This rule detects potential 'impossible travel' scenarios within Azure AD sign-in logs. It identifies users who successfully sign in to Office 365 from two geographically distant IP addresses within a one-hour window, suggesting a potential compromise or an attempt to bypass security controls.
Detects OAuth application consent grants or modifications where the application is granted sensitive permissions including Mail.Read, Directory.Read.All, or User.Read.All. These permissions can be abused by attackers to exfiltrate email data or map the organization's directory.
Detects sign-in events using the device code authentication flow (OAuth 2.0 device authorization grant) where the originating IP address is external to the organization's private network. This flow is often abused by attackers to bypass traditional MFA or interact with headless environments via common HTTP client libraries like Python requests, Go-http, or Axios.
Detects instances where a user grants an OAuth application sensitive permissions, which could indicate an illicit consent grant attack where an adversary lures a user into authorizing a malicious application to access their email, files, or directory data.
Detects successful OAuth device code authentication flows targeted at sensitive Microsoft cloud resources (Exchange Online, SharePoint, Teams, Graph) originating from unmanaged or non-compliant devices. This pattern is often indicative of consent phishing or device code phishing attacks where an adversary obtains a device token to gain long-term unauthorized access to user data.
This rule detects anomalous Azure AD sign-in behavior where a single user account authenticates from two or more distinct subnets (class C) within a 10-minute window. It specifically focuses on non-interactive logins or token issuance (e.g., refresh tokens) that are successful (resultType 0) and ignores service principal activity, which may indicate account compromise, session hijacking, or automated credential misuse.
Page 95 of 185