Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,417
11,806
5,870
5,145
4,864
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
Detects suspicious sharing activity in Box, including the creation of open links, external collaboration invites, role escalation, and weakening of sharing policies. This rule identifies high-risk activities such as making files publicly visible without password protection, inviting external users with co-owner or editor roles, and changes that reduce security like removing expiration dates on shared links.
Azure VM RunCommand Activity
Cortex XDR
This rule detects activity related to Azure VM RunCommand, which allows execution of scripts on virtual machines without requiring RDP/SSH access. It specifically looks for 'WRITE', 'ACTION', 'DELETE', and 'READ' operations, filtering for successful or accepted statuses and valid identities. This activity can indicate an attacker executing commands or performing post-execution cleanup.
SharePoint Online Sensitive Data Search
Cortex XDR
This rule detects when users perform search queries in SharePoint Online that contain keywords indicative of sensitive data. The rule categorizes these searches into several types: credentials, personnel/HR information, infrastructure reconnaissance, financial/PII, and confidential business information.
This rule identifies 'chokepoint' devices within an environment based on their high number of inbound and outbound connections (at least 2 each). It then enriches these chokepoint devices with vulnerability and misconfiguration remediation recommendations from Microsoft Defender for Endpoint (MDE) TVM and Exposure Graph. The rule prioritizes remediation based on the calculated 'ChokepointScore' (InboundCount * OutboundCount) and indicates if the device has active exploits. This helps security teams focus remediation efforts on critical assets that could significantly impact the network if compromised.
This rule tracks user and administrator submissions of potential phishing emails to Microsoft for analysis within the Security & Compliance Center. It extracts and logs details such as the submission verdict, rescan verdict, recipients, subject, content, submitter's display name, sender information (P1 and P2), email destination, final delivery verdict, and sender IP address. This provides visibility into an organization's proactive efforts to report and analyze suspected phishing attempts.
Okta Sensitive OAuth Activity Detection
Cortex XDR
This rule detects sensitive OAuth activities within Okta, specifically focusing on OAuth client secret access, token revocation requests, and implicit flow requests. These activities can indicate potential compromise of OAuth clients, attempts to invalidate legitimate tokens, or the use of less secure OAuth flows that could be exploited.
Detects when users are added to groups or applications within Okta, which could potentially grant them elevated privileges. This rule monitors for events indicating changes in user membership for both groups and applications.
Detects Okta Multi-Factor Authentication (MFA) factor enrollment, activation, update, and reset events. These events may indicate an attacker adding their own MFA factor post-compromise to maintain access or removing an existing factor to weaken account security and facilitate unauthorized access.
SharePoint Online Sensitive Data Search
Cortex XDR
This rule detects when users perform search queries in SharePoint Online that contain keywords indicative of sensitive data. The rule categorizes these searches into several types: credentials, personnel/HR information, infrastructure reconnaissance, financial/PII, and confidential business information.
Detects modifications to the msDS-KeyCredentialLink attribute on Delegated Managed Service Account (dMSA) objects, indicating a potential Shadow Credential (X.509 certificate) planting. This allows an attacker to bypass managed password rotation and maintain permanent PKINIT access, as seen in the dMSA Ouroboros attack chain. The rule also monitors Event 4768 (PKINIT TGT requests with pre-authentication type 17) and Event 4662 (S4U2Self Object Access) for dMSA objects, which are key indicators of this attack.
Detects modifications to the msDS-GroupMSAMembership attribute on Delegated Managed Service Account (dMSA) objects. Attackers may write the dMSA's own SID into this attribute to self-authorize credential extraction, establishing a self-sustaining Ouroboros loop.
Identifies potential use of ROADtools for Azure AD reconnaissance by monitoring for Azure CLI/PowerShell App IDs coupled with a Python user agent in sign-in logs. This rule specifically looks for sign-ins to 'Windows Azure Active Directory' resource where the user agent string contains 'python' or the device detail string contains 'Python', and the App ID or App Display Name matches known Azure AD PowerShell or Azure CLI applications.
Detects when an administrator grants consent to an application on behalf of all users in an Azure AD tenant. This can be a legitimate administrative action but can also be abused by attackers to gain broad access to resources and data within the organization.
This rule detects the creation or modification of Exchange inbox rules with highly suspicious or obfuscated names. Adversaries often create inbox rules with short, non-descriptive, or special character names (e.g., '.', '...', ';') to forward, redirect, or delete emails, facilitating data exfiltration or maintaining persistence. The rule specifically looks for rule names that are very short (less than 3 characters), empty, or match a predefined list of suspicious names.
This rule detects the creation, patching, or updating of Kubernetes ClusterRoleBindings, RoleBindings, or Roles within the 'prod', 'production', or 'default' namespaces. It specifically excludes actions performed by the 'system:clusterrole-aggregation-controller' to reduce noise from legitimate system operations. This activity can indicate an attempt to manipulate access controls within the Kubernetes cluster, potentially for privilege escalation or persistence.
This rule detects when an 'Agent ID Administrator' role adds an owner to a service principal in Azure Active Directory. This activity could indicate an attempt to escalate privileges or maintain persistence within the Azure environment by granting control over service principals to potentially unauthorized entities.
This rule detects the creation, patching, or updating of Kubernetes 'clusterrolebindings', 'rolebindings', or 'roles' within 'prod', 'production', or 'default' namespaces. It specifically excludes actions performed by the 'system:clusterrole-aggregation-controller' to reduce false positives related to legitimate system operations. This activity could indicate an attempt to escalate privileges or establish persistence within critical Kubernetes environments.
This rule detects anomalous mass device wipe or deletion activity in Microsoft Intune by comparing current activity against an actor's historical behavior. It identifies four patterns: first-time wipers with high volume, known actors statistically far above their norm (Z-score), thin-history actors exceeding their personal peak, and time-compressed bursts of wipes. The rule calculates a severity based on the volume and rate of wipes.
This rule detects when a device wipe or delete operation is performed via Microsoft Intune. It specifically looks for 'wipe ManagedDevice' or 'Delete ManagedDevice' operations in Intune audit logs within the last 24 hours. The rule is designed to be correlated with other alerts by filtering on a specific ActorUPN, indicating a potential malicious mass device wipe attack.
This rule detects the assignment of highly privileged roles such as 'Global Administrator', 'Intune Administrator', or 'Cloud Device Administrator' within Azure Active Directory. This activity is often a precursor to significant malicious actions, including mass device wipes, as highlighted by the referenced threat intelligence. Monitoring these assignments helps identify potential privilege escalation or unauthorized administrative access.
This rule detects attempts to perform a mass device wipe or deletion using Microsoft Intune. It identifies devices that have been wiped or deleted within the last 24 hours and enriches this information with device details such as name, user, OS, and ownership. This can indicate a destructive attack or an attempt to remove evidence.
Page 93 of 144