Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,000 detections
Filters
Last updated
All Time
Detection languages
1,438
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,443
11,831
5,872
5,155
4,866
3,000
Platforms
1,197
672
622
513
218
Products / Services
879
726
311
255
229
MITRE Techniques
1,659
1,107
903
465
462
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
Detects when events are deleted in Kubernetes. An adversary may delete Kubernetes events in an attempt to evade detection.
Adding users to administrative roles is not malicious, but due to the sensitivity of certain roles, validation should occur when this occurs
This detection identifies when a new Microsoft Intune device management configuration policy has been created. Intune device management configuration policies are used by administrators to remotely manage policies and settings on Intune-managed devices. This functionality can be abused by adversaries to disable defenses and evade detection.
The following analytic identifies the creation of new email forwarding rules in an Office 365 environment. It detects events logged under New-InboxRule and Set-InboxRule operations within the o365_management_activity data source, focusing on parameters like ForwardTo, ForwardAsAttachmentTo, and RedirectTo. This activity is significant as unauthorized email forwarding can lead to data exfiltration and unauthorized access to sensitive information. If confirmed malicious, attackers could intercept and redirect emails, potentially compromising confidential communications and leading to data breaches.
The following analytic identifies modifications to Okta Identity Provider (IDP) lifecycle events, including creation, activation, deactivation, and deletion of IDP configurations. It uses OktaIm2 logs ingested via the Splunk Add-on for Okta Identity Cloud. Monitoring these events is crucial for maintaining the integrity and security of authentication mechanisms. Unauthorized or anomalous changes could indicate potential security breaches or misconfigurations. If confirmed malicious, attackers could manipulate authentication processes, potentially gaining unauthorized access or disrupting identity management systems.
The analytic identifies instances where a service principal in Azure Active Directory assigns app roles without standard admin consent. This activity is detected by analyzing Entra ID logs from the `azure_monitor_aad` data source, specifically looking for "Add app role assignment to service principal" or "Add member to role*" operations initiated by a service principal. This detection is crucial for identifying potential bypasses of administrative consent processes, which could lead to unauthorized privilege grants. If malicious, this could allow attackers to exploit automation to assign sensitive permissions without proper oversight, compromising the security of the Azure AD environment.
This correlation rule identifies when a user exceeds a predefined risk threshold based on multiple suspicious Okta activities within a 24-hour period. It aggregates risk events from "Suspicious Okta Activity," "Okta Account Takeover," and "Okta MFA Exhaustion" analytic stories. The detection is significant as it highlights potentially compromised user accounts exhibiting multiple tactics, techniques, and procedures (TTPs). If confirmed malicious, this activity could indicate a serious security breach, allowing attackers to gain unauthorized access, escalate privileges, or persist within the environment.
This analytic identifies the creation or modification of email inbox rules within an Office 365 environment. It specifically looks for `New-InboxRule` and `Set-InboxRule` operations in the O365 management activity logs where the rule parameters indicate actions such as mail forwarding (`ForwardTo`, `ForwardAsAttachmentTo`, `RedirectTo`), or mail manipulation like deletion (`SoftDeleteMessage`, `DeleteMessage`) or moving to specific folders (`MoveToFolder`, `CopyToFolder`). While legitimate users create inbox rules, adversaries often leverage these techniques to exfiltrate emails, maintain persistence, or hide their activities by deleting or moving security alerts.
The analytic identifies a statistically significant increase in access to Active Directory objects, which may indicate attacker enumeration. It leverages Windows Security Event Code 4662 to monitor and analyze access patterns, comparing them against historical averages to detect anomalies. This activity is significant for a SOC because abnormal access to AD objects can be an early indicator of reconnaissance efforts by an attacker. If confirmed malicious, this behavior could lead to unauthorized access, privilege escalation, or further compromise of the Active Directory environment.
The following analytic detects attempts to disable multi-factor authentication (MFA) for an Azure AD user. It leverages Azure Active Directory AuditLogs to identify the "Disable Strong Authentication" operation. This activity is significant because disabling MFA can allow adversaries to maintain persistence using compromised accounts without raising suspicion. If confirmed malicious, this action could enable attackers to bypass an essential security control, potentially leading to unauthorized access and prolonged undetected presence in the environment.
The following analytic identifies the creation of AWS IAM access keys by a user for another user, which can indicate privilege escalation. It leverages AWS CloudTrail logs to detect instances where the user creating the access key is different from the user for whom the key is created. This activity is significant because unauthorized access key creation can allow attackers to establish persistence or exfiltrate data via AWS APIs. If confirmed malicious, this could lead to unauthorized access to AWS services, data exfiltration, and long-term persistence in the environment.
The following analytic identifies instances where a service principal in Office 365 Azure Active Directory assigns app roles without standard admin consent. It leverages `o365_management_activity` logs, specifically focusing on the 'Add app role assignment to service principal' operation. This activity is significant for SOCs as it may indicate a bypass of critical administrative controls, potentially leading to unauthorized access or privilege escalation. If confirmed malicious, this could allow an attacker to misuse automated processes to assign sensitive permissions, compromising the security of the environment.
The following analytic identifies the configuration of Azure Active Directory Applications in a manner that allows authentication from external tenants or personal accounts. This configuration can lead to inappropriate or malicious access of any data or capabilities the application is allowed to access. This detection leverages the O365 Universal Audit Log data source.
The analytic detects the creation of a new API token within an Okta tenant. It uses OktaIm2 logs ingested via the Splunk Add-on for Okta Identity Cloud to identify events where the `system.api_token.create` command is executed. This activity is significant because creating a new API token can indicate potential account takeover attempts or unauthorized access, allowing an adversary to maintain persistence. If confirmed malicious, this could enable attackers to execute API calls, access sensitive data, and perform administrative actions within the Okta environment.
This detection identifies when a new Microsoft Intune device health script has been added, updated, or deleted. Intune device remediation scripts can be used by administrators for remote device management, but this functionality can also be abused for SYSTEM-level code execution and lateral movement to Intune-managed devices.
This analytic identifies the invitation of an external guest user within Azure AD. With Azure AD B2B collaboration, users and administrators can invite external users to collaborate with internal users. External guest account invitations should be monitored by security teams as they could potentially lead to unauthorized access. An example of this attack vector was described at BlackHat 2022 by security researcher Dirk-Jan during his talk `Backdooring and Hijacking Azure AD Accounts by Abusing External Identities`. This detection leverages the Universal Audit Log (UAL)/o365:management:activity sourcetype as a detection data source.
This analytic identifies when changes are made to the external guest policies within Azure AD. Specifically, it looks for the "Update policy." operation targeting "B2BManagementPolicy" in the Office 365 Universal Audit Log. The rule extracts and highlights the specific changes made to allowed/blocked domains for B2B collaboration, indicating whether domains were added or removed. Monitoring these changes is crucial as modifications to external identity policies can impact unauthorized access, as described in the BlackHat 2022 talk "Backdooring and Hijacking Azure AD Accounts by Abusing External Identities."
The following analytic identifies attempts to delete AWS Bedrock GuardRails, which are security controls designed to prevent harmful, biased, or inappropriate AI outputs. It leverages AWS CloudTrail logs to detect when a user or service calls the DeleteGuardrail API. This activity is significant as it may indicate an adversary attempting to remove safety guardrails after compromising credentials, potentially to enable harmful or malicious model outputs. Removing guardrails could allow attackers to extract sensitive information, generate offensive content, or bypass security controls designed to prevent prompt injection and other AI-specific attacks. If confirmed malicious, this could represent a deliberate attempt to manipulate model behavior for harmful purposes.
The analytic detects instances where the O365 advanced audit is disabled for a specific user within the Office 365 tenant. It uses O365 audit logs, focusing on events related to audit license changes in AzureActiveDirectory workloads. This activity is significant because the O365 advanced audit provides critical logging and insights into user and administrator activities. Disabling it can blind security teams to potential malicious actions. If confirmed malicious, attackers could operate within the user's mailbox or account with reduced risk of detection, leading to unauthorized data access, data exfiltration, or account compromise.
This analytic identifies an abnormally high number of cloud instances being destroyed within a 4-hour period. It leverages cloud infrastructure logs and applies a probability density model to detect outliers. This activity is significant for a SOC because a sudden spike in destroyed instances could indicate malicious activity, such as an insider threat or a compromised account attempting to disrupt services. If confirmed malicious, this could lead to significant operational disruptions, data loss, and potential financial impact due to the destruction of critical cloud resources.
This detection identifies when an administrator manually triggers device management configuration policy sync events, on-demand remediation scripts, or remotely restarts devices within Microsoft Intune. While this functionality can be used legitimately to expedite policy delivery, it can also be abused by an attacker to quickly deploy malicious payloads or disrupt systems.
Page 124 of 143