Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects Microsoft 365 token replay from the Huntress token spray and replay campaign. Alerts on sign-ins from an IP new to the account (not seen on 3 or more distinct days in the 14d baseline) that match one of three behaviors: a scripted client (node or bare Mozilla/5.0 user agent with Office or Authentication Broker client IDs), Device Registration Service access (Medium-High only when corroborated by a campaign IP, scripted user agent or session IP hop, otherwise Low), or one session moving across IPs within 60 minutes. Rows are raised to High when the same new IP hits 3 or more baseline accounts in the window (token spray pattern) or matches a campaign IOC. Low Signal rows are dropped when AlertOnly = true. Does not cover MFA changes, device registration events or inbox rules.
Detects Microsoft 365 session token replay as described in the Huntress token spray research: sign-ins from the campaign addresses, scripted clients (node or a bare Mozilla/5.0 user agent) using the Office, Authentication Broker or OfficeHome app IDs from an address new to the account, Device Registration Service access from a new address and one session seen from different operating systems and addresses. The campaign address list is short lived and serves as enrichment.
Detects Gheist campaign activity: creation of a ci-sync-<6 chars> branch via stolen GitHub token followed within 10 minutes by a workflow run on that branch in the same repo. Requires GitHub audit log ingestion; table name is an assumption.
Detects AWS OIDC role assumption by a GitHub workflow running on a ci-sync-<6 chars> branch followed within an hour by Secrets Manager reads using the same session credentials, as seen in the Gheist campaign.
Detects the presence of known malicious or suspicious OAuth application IDs as well as specific third-party applications like SkyKick or ConnectWise within OAuth application metadata over a 30-day window.
Detects a single external source IP reading secrets and configmaps across multiple Kubernetes namespaces in bulk within a 1-hour window, which may indicate reconnaissance or credential theft.
Detects sign-ins and cloud app events associated with specific compromised vendor application IDs, application names, or a known malicious IP address across Microsoft Entra ID and CloudAppEvents logs.
Detects GCP audit log write operations involving settings, IAM, or metadata modifications (such as setMetadata, setIamPolicy, setServiceAccount) that either originate from a known attacker IP or are performed by a default GCP service account from a public caller IP.
Detects a suspicious behavioral sequence in AWS CloudTrail logs from external IPs using the Boto3 user agent. The sequence starts with caller-identity validation (GetCallerIdentity), followed by a high volume of secret reads (Secrets Manager) or cloud storage object reads (S3), indicating automated reconnaissance, credential theft, or data exfiltration.
Detects deletion or modification of Azure backup items, vaults, recovery points, VM snapshots, or soft-delete configurations within AzureActivity logs, which may indicate an adversary attempting to inhibit system recovery or cover tracks.
Detects Microsoft 365 activity (Exchange and SharePoint) initiated by known compromised service principal UUIDs associated with the ConnectWise supply-chain attack.
Detects high-volume Microsoft Graph API activity using attacker-associated user agents, such as python-requests, curl, or httpx, which may indicate automated token sweeping or data collection associated with supply-chain attacks.
Detects a sequence of AWS API calls where an external IP first calls sts:GetCallerIdentity, followed by Bedrock model listing APIs, and subsequently IAM or account/trail discovery events within a short timeframe, indicating potential cloud reconnaissance or unauthorized access.
This hunting query identifies successful AWS IAM access key creation events where a named IAM user creates a key for a different named IAM user.
Such activity may indicate persistence or privilege escalation, particularly when the target user has elevated permissions. The query compares the caller and target usernames; it does not assess the target user's permissions.
Hunting queries are designed to be run manually during threat hunting activities.
Such activity may indicate persistence or privilege escalation, particularly when the target user has elevated permissions. The query compares the caller and target usernames; it does not assess the target user's permissions.
Hunting queries are designed to be run manually during threat hunting activities.
This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant.
A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs.
The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.
A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs.
The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.
Detects a sequence where an assumed-role credential from an external IP calls sts:GetCallerIdentity followed by listing Amazon Bedrock foundation models within a one-hour window, potentially indicating reconnaissance of AI/ML services by an external threat actor.
Detects suspicious command execution activities using Azure RunCommand, Custom Script Extension, or Azure Connected Machine Agent combined with potentially malicious command arguments or tools such as PowerShell encoded commands, 'IEX', download strings, certutil, whoami, base64, curl, or wget.
Detects a high volume of Azure Key Vault secret reads or key decryption operations performed by a single caller identity from multiple source IP addresses within a one-hour window, which may indicate credential harvesting or unauthorized access.
Detects a successful AWS IAM CreateRole event whose trust policy allows sts:AssumeRole by a principal in another AWS account or by a wildcard
principal.
This configuration may provide persistent access if the principal can assume the role. The event alone does not establish that the role was assumed or that its creation was unauthorized.
principal.
This configuration may provide persistent access if the principal can assume the role. The event alone does not establish that the role was assumed or that its creation was unauthorized.
Detects Azure AD service principal sign-ins utilizing suspicious scripting-related user agents such as curl, python-requests, Wget, or Postman, which may indicate automated scripting, custom tooling, or potential abuse of cloud service accounts.
Detects new client secrets or certificates added to any service principal in Azure AD, specifically identifying activities linked to the ConnectWise supply-chain attack or suspicious user agents.
Page 1 of 135