Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects a service principal or user account performing a burst of 'ListKeys' operations across multiple Azure Storage accounts. This behavior is indicative of an attacker attempting to dump access keys for multiple storage accounts after initial compromise or privilege escalation to gain further access to sensitive cloud data.
Detects a precursor pattern identified as JADEPUFFER, where a failed 'ListKeys' operation (indicating an attempt to discover or access keys for a non-existent storage account) is immediately followed by a burst of destructive delete operations on critical cloud resources (e.g., storage, databases, key vaults) by the same actor.
Detects a coordinated, rapid deletion of a Key Vault, Function App, and App Service plan within the same resource group and time window by the same caller. This pattern is indicative of targeted destructive activity, such as that seen in the JADEPUFFER campaign, while explicitly excluding scenarios where the entire resource group is deleted, which is typical of routine IaC teardowns.
Detects a suspicious pattern often associated with Storm-3168 (JADEPUFFER) activity: prolonged, high-volume Azure resource enumeration by one service principal, followed shortly by a second service principal performing rapid, multi-subscription enumeration from the same source IP address.
Detects modifications to Microsoft Entra ID applications or service principals involving the addition or configuration of 'externalauthprovider' redirect URIs or properties. This behavior is indicative of an attacker attempting to establish a malicious federated identity or persistence mechanism by manipulating application configuration to use an adversary-controlled authentication provider.
Detects a suspicious sequence of identity-related operations in Azure AD, characterized by the modification of authentication methods policies followed by rapid application or service principal registration, consent granting, or role assignments by the same actor within a 10-minute window. This behavior often indicates an adversary attempting to establish persistence or escalate privileges via malicious OAuth applications or service principals after weakening security posture.
Detects a suspicious sequence of identity-related operations in Azure AD, characterized by the modification of authentication methods policies followed by rapid application or service principal registration, consent granting, or role assignments by the same actor within a 10-minute window. This behavior often indicates an adversary attempting to establish persistence or escalate privileges via malicious OAuth applications or service principals after weakening security posture.
This rule detects potentially malicious activity where an identity performs enumeration of Kubernetes secrets or configmaps and subsequently performs a search action within Slack from the same IP address within a one-hour window. This behavioral pattern is indicative of post-breakout reconnaissance, where a compromised identity or token is used to exfiltrate sensitive cloud configuration data and then perform internal reconnaissance in SaaS collaboration tools to identify further targets or credentials.
Single-source Sigma proxy for the authentication-persistence stage of the multi-stage device-code-phishing-to-Graph-collection chain (see the companion KQL correlation rule "Passkey Persistence: Device-Code Phishing to MFA Takeover and Graph Collection" for the full, threshold-gated, cross-table detection). Sigma has no join, temporal-windowing, or aggregation support, so this rule fires on the authentication-persistence event alone and does NOT enforce the device-code sign-in precursor or the subsequent Graph-activity burst - both required by the full correlation. Scoped to the two highest-signal operations only (new security-info registration, and any admin-initiated registration on another user's account) to cut noise from routine self-service profile edits.
Detects the multi-stage Microsoft cloud identity compromise chain reported by Microsoft Security Research (September 2026): a victim completes a successful Entra ID device-code sign-in (often induced by passkey-themed device-code phishing), the same identity's authentication/security info is registered or changed (MFA/passkey persistence) within 60 minutes (deduplicated to the earliest such event per sign-in), followed within 120 minutes by a burst of at least 25 successful, delegated-context Microsoft Graph API calls (Scopes claim populated, i.e. user-delegated permissions rather than pure application/client-credential access) spanning at least 3 distinct resource paths, exhibiting reconnaissance (>=5 requests against /users, /groups, /directoryRoles, /roleManagement, /applications, /servicePrincipals, /organization) and/or collection (>=10 requests against /messages, /mailFolders, /attachments, /drive, /drives, /sites, /lists, /search) patterns. Restricting to delegated (Scopes-bearing) Graph calls and requiring resource-path breadth removes the two largest false-positive sources: service-principal/application-only automation jobs (Roles-only tokens) and single-endpoint polling tools. Pure behavioral correlation across SigninLogs, AuditLogs, and MicrosoftGraphActivityLogs - no static IOCs. Flags whether Graph activity originated from an IP different from the original device-code sign-in IP as a strong pivot/session-reuse indicator.
This rule detects anomalous, high-volume activity from a single user account interacting with known public generative AI platforms (e.g., ChatGPT, Copilot, Claude). It uses a threshold-based approach on CloudAppEvents logs to identify potential reconnaissance or bulk information gathering activities which could signify unauthorized use or automated data scraping via AI interfaces.
Detects Salesforce Experience Cloud guest user sessions performing queries or reads on objects not within the authorized allowlist. This behavior, characterized by an abnormal volume of records retrieved or anomalous query patterns, is consistent with attempts to exploit misconfigured guest profile permissions to access internal sensitive data.
Detects the modification of critical Entra ID authentication method policies, such as the registration or configuration of external MFA/OIDC providers, by a user account shortly after an anomalous or high-risk login event. This behavior is indicative of an attacker attempting to establish persistent backdoor access via rogue MFA provider registration, consistent with techniques used to subvert cloud authentication policies.
Detects successful OAuth token grant events for specific third-party SaaS integrations (Salesloft, Drift, Gainsight) where requested scopes include broad permissions such as 'api', 'refresh_token', or 'full'. This pattern is indicative of potential consent phishing or the abuse of a compromised OAuth application to maintain persistent, high-privileged access to SaaS resources.
Detects potential session hijacking or malicious OAuth consent grants within Okta. This rule triggers either when an authenticated session start is associated with risky flags (impossible travel, anomalous device/location) or when an OAuth consent grant for 'recall' or cross-tenant functionality occurs shortly after a high-risk sign-in event.
Detects anomalous AWS IAM and Secrets Manager API activity indicative of credential abuse following suspected exposure. The rule identifies suspicious patterns such as unauthorized enumeration of access keys, secret retrieval, and creation of new keys by non-service principals, reflecting activity associated with ShinyHunters-style operations where compromised credentials are abused.
Detects adversarial AI cost harvesting (AML.T0034.000) by identifying anomalous volumes of low-complexity queries against an AI inference API that result in a significant, unexplained spike in billed costs. This behavior mimics denial-of-service tactics aimed at exhausting compute capacity and financial resources.
Detects anomalous AI model inference activity where a caller submits a high volume of near-duplicate queries while frequently requesting raw confidence scores. This behavior is indicative of a membership-inference privacy attack, where an adversary attempts to determine if specific data points were included in the model's training set by analyzing query response patterns.
This rule detects anomalous behavior in AI agent tool invocations, specifically monitoring for high volumes of tool calls, high costs associated with token consumption, or suspicious tool interactions following a flagged indirect prompt injection. This behavior is indicative of potential resource exhaustion (denial of service) or abusive agent behavior as defined by the MITRE ATLAS framework for AI security.
Detects suspicious AI agent behavior by identifying two primary scenarios: 1) The invocation of sensitive tools (e.g., code execution, file deletion) within a short timeframe following a flagged prompt injection or jailbreak attempt in the same conversation; or 2) The invocation of a tool by an AI agent that is not explicitly defined in its allowed tool list for the given workflow.
Detects anomalous access to AWS Bedrock Knowledge Bases, identifying a pattern of initial reconnaissance (enumerating bases and data sources) followed by high-volume querying (Retrieve/RetrieveAndGenerate). This sequence is indicative of an attacker attempting to map out backend storage configurations and subsequently exfiltrate indexed document content.
Page 15 of 135