Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18 detections
Filters
Last updated
All Time
Detection languages
18
Contributors
18
Categories
13
9
2
1
1
Platforms
9
6
3
3
2
Products / Services
10,508
9,776
6,703
4,439
3,710
MITRE Techniques
9
9
6
4
3
Detects enumeration of Entra ID applications and permissions via AzureHound or ROADrecon, identified by distinct user-agent strings or abnormal Graph API request volume — the same signal Organization B's custom alerts used to catch CISA's red team.
Detects a single device requesting Entra ID access/refresh tokens on behalf of multiple distinct users in a short window, indicative of Primary Refresh Token (PRT) theft used to impersonate other users, as CISA's red team did against an application owner.
Detects a new client secret added to an Entra ID application shortly followed by Mail.ReadWrite Graph API calls, indicating the application was hijacked to impersonate its identity and read a target user's mailbox — the technique CISA's red team used after obtaining an access token.
Detects newly granted or consented Microsoft Entra ID application permissions exceeding baseline, a weakness CISA's red team exploited to escalate privileges and reach cloud resources.
Detects service-principal/workload-identity sign-ins occurring without an enforced Conditional Access policy — a gap CISA's red team exploited for unauthorized cloud access.
Detects interactive sign-in by an Entra Connect/AAD Connect sync service account (Sync_ prefix), which should only authenticate non-interactively. CISA's red team compromised a hybrid sync account to pivot from on-prem AD into cloud resources.
Detects sign-ins with impossible browser/OS combinations and Outlook-labeled sign-ins presenting non-native user agents, consistent with Storm-2755 AiTM session token replay and impersonation.
Detects an account making repeated Microsoft Graph API user search requests for payroll/HR display names via an axios HTTP client against a specific ApplicationId, consistent with Storm-2755 payroll-personnel reconnaissance.
Detects a single user account signing into OfficeHome from 3+ distinct proxy/anyIP-flagged IP addresses within a 15-minute window, consistent with AiTM session replay from rotating residential proxy infrastructure.
Detects OfficeHome sign-ins with error 90014 (nonce omission) followed by anomalous successful sign-ins from a different IP, or repeated 90014 failures, consistent with AiTM token replay activity.
Detects creation of malicious Exchange inbox rules (move to Deleted Items / mark as read) correlated via SessionId to an interactive sign-in from the Datawagon hosting ASN (27176) and a subsequent MailItemsAccessed event, consistent with Storm-2755 AiTM session-replay and mailbox-hiding persistence.
Detects cross-region GraphApiAuditEvents calls for the same AccountObjectId/ApplicationId occurring faster than plausible travel time, indicating a replayed/stolen session token.
Detects Outlook sign-ins that reuse the same SessionId roughly every 8 hours while source IP/ASN change, consistent with attackers replaying a stolen AiTM-captured session token through rotating residential proxy infrastructure.
Detects sign-ins from the same user account occurring from two different countries within a short time window, where the implied travel velocity exceeds physically achievable speeds, indicating impossible travel or anomalous geolocation change consistent with a hijacked account or API key credential, with special attention to sudden access from China-based infrastructure.
Detects AiTM reverse-proxy pages injecting the ServerData=$Config script alongside a redirUrl/api.country.is capture script and a rewritten login.microsoftonline.com authorize path hosted on a non-Microsoft domain, used to steal OAuth2 session tokens and bypass MFA.
Identifies Azure AD service principal credentials (KeyId) that have been continuously used for 90 or more days without rotation, surfacing long-lived static API keys/credentials that increase exposure risk to token jacking, credential theft, or gray-market resale of AI/API access.
Detects non-interactive token refreshes occurring at anomalously consistent short intervals or from previously unseen IPs/devices, consistent with AiTM stolen session token replay used to maintain persistent access.
Detects developer accounts whose daily count of API key creation or model provisioning operations exceeds their own 15-day historical per-user baseline plus several standard deviations, excluding service principals/apps, which may indicate compromised credentials being abused to provision or harvest AI API keys for resale (token jacking).