WHAT IT PROTECTS AGAINST

Attackers don’t hack Exchange.
They log in.

Almost every Microsoft 365 breach follows the same chain: get a password or a session, quietly widen access, move the data, and leave a back door for later. This page is the complete list of what Warden365 watches for at each link in that chain — every detection named, in plain English, exactly as it ships. Nothing here is roadmap.

✓ 31 NATIVE DETECTIONS ✓ MITRE ATT&CK MAPPED ✓ PLAIN ENGLISH, EVERY ALERT + COMMUNITY SIGMA RULES VIA SIGNED UPDATES

THE CHAIN

Five stages, all watched at once.

Detections don’t fire in isolation — they cover the takeover chain end to end, so an attacker who slips past one stage still trips the next.

01 · BREAKING IN

Getting a password, a session, or a yes

Password sprays across your accounts, sign-ins from impossible places or anonymising networks, device-code phishing, MFA-fatigue prompt-spamming, and stolen session tokens being replayed from a second address — the AiTM attack that beats MFA.

02 · CONSENT PHISHING

Walking in through an app instead

A staff member approves a convincing-looking app and it walks off with mailbox or file access — no password needed, and a reset doesn’t evict it. Risky consents are flagged at the moment they’re granted.

03 · EMAIL COMPROMISE

The staging moves behind invoice fraud

Stealth inbox rules forwarding mail out of the business, rules that hide incoming mail from the victim, mailbox delegation quietly granted, and bulk reading of a mailbox’s contents.

04 · DATA THEFT & RANSOMWARE

Moving or destroying the files

Mass downloads, mass deletions and ransomware-style change bursts across SharePoint and OneDrive — counted per user in a transparent sliding window, so the number behind an alert is inspectable, not a black-box score.

05 · DIGGING IN

Persistence that survives a password reset

New MFA methods enrolled on admin accounts, secrets added to app registrations, admin roles granted, Conditional Access quietly weakened, and cross-tenant trusts nobody remembers approving.

THE CATALOGUE

Every detection that ships, in plain English.

This list is generated from the product’s own detection catalogue — the same text you see in the Settings screen. The badge shows what each needs from your Microsoft 365 licence; most run on any tenant with the standard audit log.

Sign-in activity

READ FROM THE ENTRA SIGN-IN LOG · 10 DETECTIONS

Anonymous / Tor sign-inNATIVE-ANON-IP

Flags a sign-in coming through Tor or an anonymising proxy — a common way to hide the real source.

ANY TENANT

Impossible travelNATIVE-IMPOSSIBLE-TRAVEL

Flags a user signing in from two places too far apart to have travelled between in the time.

ANY TENANT

Sign-in from an unusual countryNATIVE-INFREQUENT-COUNTRY

Flags a sign-in from a country this tenant rarely or never sees.

ANY TENANT

Device-code phishingNATIVE-DEVICE-CODE-PHISH

Flags the device-code sign-in flow being used to trick a user into authorising an attacker's device.

ANY TENANT

MFA fatigueNATIVE-MFA-FATIGUE

Flags a burst of repeated MFA prompts followed by a success — an attacker spamming approvals until someone taps yes.

ANY TENANT

Password sprayNATIVE-PASSWORD-SPRAY

Flags one password tried across many accounts, then a success — the classic spray attack.

ANY TENANT

Session token replay (AiTM)NATIVE-AITM-SESSION-REPLAY

Flags one sign-in session appearing from two IP addresses — a sign a stolen session token is being replayed.

ANY TENANT

Sign-in to a disabled accountNATIVE-DISABLED-ACCOUNT-SIGNIN

Flags an attempt to sign in to an account that has been disabled — often an ex-employee or a target being probed.

ANY TENANT

First-ever sign-in from a countryNATIVE-NEW-COUNTRY

Flags the first time a user signs in from a country they've never used before.

ANY TENANT

Dormant account woke upNATIVE-DORMANT-REACTIVATED

Flags an account that had been silent for a long time suddenly signing in.

ANY TENANT

Identity & admin changes

READ FROM THE DIRECTORY AUDIT LOG · 6 DETECTIONS

Privileged role grantedNATIVE-PRIVILEGED-ROLE-GRANT

Flags someone being given an admin role — the kind of change an attacker makes to keep control.

AUDIT LOG

Conditional Access weakenedNATIVE-CA-WEAKENING

Flags a Conditional Access policy being disabled or loosened — often done to remove MFA before an attack.

AUDIT LOG

App credential addedNATIVE-APP-CREDENTIAL-ADDED

Flags a new secret or certificate added to an app registration — a stealthy way to keep access.

AUDIT LOG

MFA method registeredNATIVE-MFA-METHOD-REGISTERED

Flags a new MFA method added to an account — an attacker enrolling their own to keep getting in.

AUDIT LOG

Risky app consentNATIVE-ILLICIT-CONSENT

Flags consent granted to an app asking for dangerous permissions — the illicit-consent attack.

AUDIT LOG

Cross-tenant trust changeNATIVE-CROSS-TENANT-CHANGE

Flags a new trust or federation with another tenant — a route for data to leave or an attacker to enter.

AUDIT LOG

Files & mail

READ FROM THE UNIFIED AUDIT LOG — EXCHANGE, SHAREPOINT, ONEDRIVE · 10 DETECTIONS

Mass file downloadNATIVE-MASS-DOWNLOAD

Flags a user downloading an unusually large number of files — possible data theft.

AUDIT LOG

Mass file deletionNATIVE-MASS-DELETION

Flags a user deleting an unusually large number of files.

AUDIT LOG

Possible ransomwareNATIVE-RANSOMWARE

Flags a pattern of rapid file changes/renames consistent with ransomware encrypting content.

AUDIT LOG

OAuth app consent (file access)NATIVE-OAUTH-CONSENT

Flags an app being granted file-access permissions through a consent prompt.

AUDIT LOG

Forwarding mail outside the companyNATIVE-EXTERNAL-MAIL-FORWARD

Flags an inbox rule that sends copies of mail to an external address — classic account-takeover exfiltration.

AUDIT LOG

New mail-forwarding ruleNATIVE-MAIL-FORWARD

Flags a new mailbox forwarding rule of any kind.

AUDIT LOG
OFF BY DEFAULT

Internal mail-forwarding ruleNATIVE-INTERNAL-MAIL-FORWARD

Flags a rule forwarding mail to another internal mailbox.

AUDIT LOG
OFF BY DEFAULT

Mail-hiding ruleNATIVE-MAIL-HIDING-RULE

Flags a rule that deletes or hides incoming mail — attackers use it to hide their tracks from the victim.

AUDIT LOG

Mailbox delegation grantedNATIVE-MAILBOX-DELEGATION

Flags someone being given access to another person's mailbox (Full Access / Send As).

AUDIT LOG

Bulk mailbox accessNATIVE-MAILBOX-BULK-ACCESS

Flags a large number of messages being read in one mailbox (needs E5 audit — MailItemsAccessed).

AUDIT LOG

Network (Global Secure Access)

GLOBAL SECURE ACCESS TENANTS ONLY · 1 DETECTIONS

Off-tunnel sign-inNATIVE-OFFTUNNEL-SIGNIN

On a Global Secure Access tenant, flags a sign-in that bypassed the compliant network.

ANY TENANT

Microsoft's own verdicts

MICROSOFT'S OWN ALERTS, SURFACED ALONGSIDE OURS · 4 DETECTIONS

Microsoft Defender alertsNATIVE-DEFENDER-ALERT

Surfaces Microsoft Defender's own alerts (endpoint / email / identity) alongside Warden365's.

DEFENDER

Microsoft Defender incidentsNATIVE-DEFENDER-INCIDENT

Surfaces Defender's correlated incidents — the grouped case above individual alerts.

DEFENDER

Entra ID Protection risk detectionsNATIVE-ENTRA-RISK

Surfaces Microsoft's own risk detections (leaked credentials, malicious IP, atypical travel).

ENTRA ID P2

Entra ID Protection risky usersNATIVE-ENTRA-RISKY-USER

Surfaces users Microsoft currently judges to be at risk or confirmed compromised.

ENTRA ID P2

ANY TENANT works everywhere AUDIT LOG standard M365 auditing ENTRA ID P2 needs Entra ID Protection DEFENDER needs a Defender plan

BEYOND THE NATIVE LIST

And the list keeps growing — without a software update.

SIGNED RULE UPDATES

New detection content ships as cryptographically signed rule bundles you verify and install offline — no binary update, no phone-home. Roll back with one command.

COMMUNITY SIGMA RULES

The open Sigma ruleset runs alongside the native detections — community-maintained coverage for Microsoft 365 and Azure sign-in patterns, updated as the threat landscape moves.

POSTURE REPORT

Separate from live alerting, a point-in-time posture check finds the standing gaps: admins without MFA, Conditional Access policies sitting in report-only, and app consents already granted that shouldn’t be.

Don’t take the list on trust. Fire it.

The simulator on the main page runs three of these attack paths against a test account, live, with the same detection logic that ships. Nothing is pre-recorded.

RUN A LIVE SIMULATION BOOK AN ASSESSMENT