Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
This rule detects potential enumeration of AWS S3 buckets by looking for the 'ListBuckets' API call in AWS CloudTrail logs. It specifically filters out activities performed by 'AssumedRole' identities to reduce false positives from legitimate automated processes or services.
Detects when an application or service principal performs sensitive configuration changes, likely via the Microsoft Graph API. This can indicate an attacker using a compromised or malicious application for persistence (adding credentials), privilege escalation (adding owners), or defense evasion (modifying Conditional Access policies). This aligns with the "Consent & Compromise" research where attackers abuse application permissions.
Detects the addition of a new network route to a route table in AWS. This activity can be indicative of an adversary attempting to reroute traffic for C2, exfiltration, or to bypass network controls.
Purpose: Hunts for risky OAuth applications in Microsoft 365 with overly permissive Microsoft Graph permissions.
Key Actions:
Finds enabled OAuth apps and retrieves their latest state (arg_max).
Expands permissions and flags sensitive ones (e.g., Mail.Send, Files.ReadWrite.All, User.ReadWrite.All, Sites.ReadWrite.All).
Notes publisher verification, origin, and last modification date.
Marks risky apps via HasRiskyPermissions flag.
Use Cases: Detects malicious consent grant phishing, overprivileged third-party apps, and integrations that could enable data theft or long-term access.
Key Actions:
Finds enabled OAuth apps and retrieves their latest state (arg_max).
Expands permissions and flags sensitive ones (e.g., Mail.Send, Files.ReadWrite.All, User.ReadWrite.All, Sites.ReadWrite.All).
Notes publisher verification, origin, and last modification date.
Marks risky apps via HasRiskyPermissions flag.
Use Cases: Detects malicious consent grant phishing, overprivileged third-party apps, and integrations that could enable data theft or long-term access.
This rule detects the creation of new Microsoft Power Automate flows that are configured to use connectors capable of exfiltrating data via email or collaboration platforms like Microsoft Teams. It specifically looks for flows created with connectors which could indicate an attempt to send sensitive information outside the organization.
This rule detects the creation of Kubernetes pods by non-system service accounts within namespaces that start with 'kube'. This could indicate an attempt to establish persistence or escalate privileges within the Kubernetes cluster by creating malicious pods in critical system namespaces.
Looks for potential enumeration of AWS buckets via ListBuckets.
This rule detects the modification of an Azure Network Security Group (NSG) rule to allow traffic from any source IP address ('*'). This configuration change significantly broadens network access and could indicate an adversary attempting to establish persistence, enable command and control, or facilitate data exfiltration by opening up previously restricted network paths.
This rule detects when an application consent operation occurs in Azure Active Directory, specifically looking for broad consent types such as 'AllPrincipals' or when an administrator has granted consent. This can indicate a malicious application gaining wide permissions within the Azure AD tenant.
Detect suspicious graph user activity with behavioral analytics (UEBA)
A user inadvertently granted consent to an external, unverified OAuth application. Exploiting the high-level permissions obtained, a threat actor initiated an attack targeting the tenant’s environment via Microsoft Graph.
Detects a sequence of events indicative of a new device being registered using a refresh token, a TTP associated with the ROADtools framework following an OAuth phishing attack. This sequence involves the Device Registration Service adding a device with a specific hardcoded OS version, followed by user and owner assignments, all within a short timeframe and sharing the same correlation ID.
This detection identifies when Microsoft Copilot Studio agents are created in your organization's tenant. This activity is significant as the default behavior in Copilot agent creation is to configure a new service principal with cloud app administrator role.
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
This detection rule identifies when Microsoft Copilot Studio agent properties are modified in your organization's tenant. This activity is significant as the default behavior in Copilot agent creation is to configure a new service principal with cloud app administrator role.
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
KQL Query
KQL Query from file: Azure Cloud Security Monitoring
KQL Query
KQL Query from file: Detect Microsoft Graph API Abuse
KQL Query
KQL Query from file: Sentinel All-In-One IP ThreatHunt
Page 111 of 135