Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
3
Contributors
3
Categories
3
3
Platforms
3
Products / Services
10,508
9,776
6,703
4,439
3,710
MITRE Techniques
1
1
1
1
1
Detects an account making repeated Microsoft Graph API user search requests for payroll/HR display names via an axios HTTP client against a specific ApplicationId, consistent with Storm-2755 payroll-personnel reconnaissance.
Detects bursts of 10+ MailItemsAccessed events within 60 seconds via a REST client with a specific ClientAppId/APIId pairing, consistent with automated mailbox collection using a replayed AiTM-stolen session token.
Detects cross-region GraphApiAuditEvents calls for the same AccountObjectId/ApplicationId occurring faster than plausible travel time, indicating a replayed/stolen session token.