Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects the weakening of "Block Public Access" setting of S3 buckets in CloudTrail logs.
Monitoring changes to Block Public Access settings is critical, as attackers may disable these safeguards before exposing a bucket through a public ACL or bucket policy.
Monitoring changes to Block Public Access settings is critical, as attackers may disable these safeguards before exposing a bucket through a public ACL or bucket policy.
Detects OAuth credential activity on GitHub. Tokens bypass password and multi-factor
controls and persist until revoked, making them the standard persistence mechanism
on the platform. A token created on a compromised account continues to work long
after the password is reset.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=iam where sourcename='GITHUB' and action='CONFIGURATION_CHANGED'
| groupby target, role, accesstype, operationtype, authtokenhash
controls and persist until revoked, making them the standard persistence mechanism
on the platform. A token created on a compromised account continues to work long
after the password is reset.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=iam where sourcename='GITHUB' and action='CONFIGURATION_CHANGED'
| groupby target, role, accesstype, operationtype, authtokenhash
Detects potential cloud storage object discovery activity in Azure Blob Storage by identifying anomalous listing or enumeration operations from callers, including high request counts, extensive container access, high failure rates, or anonymous authentication.
Detects a successful device-code sign-in followed within 60 minutes by non-interactive replay from a different IP AND a persistence action (inbox rule, app consent, device add) from a non-original IP. Persistence is now mandatory (inner join) instead of optional, and the retired AADSignInEventsBeta table is replaced by EntraIdSignInEvents.
Detects export of the Atlassian audit log. An export hands over the full record of
who did what across the tenant, which is reconnaissance of the administrative
landscape and, in the wrong hands, a map of which accounts are worth targeting.
Rare enough in normal operation that each occurrence can be confirmed individually.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ATLASSIAN' and action='AUDIT_LOG_EXPORTED'
| groupby user, sitename, domain
who did what across the tenant, which is reconnaissance of the administrative
landscape and, in the wrong hands, a map of which accounts are worth targeting.
Rare enough in normal operation that each occurrence can be confirmed individually.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ATLASSIAN' and action='AUDIT_LOG_EXPORTED'
| groupby user, sitename, domain
Detects an AWS identity making 10 or more successful EC2 Instance ConnectSendSSHPublicKey API calls within the configured search interval.
EC2 Instance Connect temporarily makes an SSH public key available to an operating-system user on an EC2 instance.
A burst of these calls may indicate automated attempts to establish access or move laterally using compromised AWS credentials.
EC2 Instance Connect temporarily makes an SSH public key available to an operating-system user on an EC2 instance.
A burst of these calls may indicate automated attempts to establish access or move laterally using compromised AWS credentials.
The following analytic detects a high volume of Amazon CloudWatch Logs read operations performed by the same AWS principal and account within a
five-minute period.
It identifies more than 500 DescribeLogGroups, DescribeLogStreams, DownloadLogEvents, FilterLogEvents, GetLogEvents, or GetQueryResults API calls.
This activity may indicate automated discovery or collection of operational, application, or security telemetry from CloudWatch Logs.
five-minute period.
It identifies more than 500 DescribeLogGroups, DescribeLogStreams, DownloadLogEvents, FilterLogEvents, GetLogEvents, or GetQueryResults API calls.
This activity may indicate automated discovery or collection of operational, application, or security telemetry from CloudWatch Logs.
Detects instances where an OAuth token is used from a new IP address and a new country within 24 hours of a successful device-code sign-in for the same user, potentially indicating token theft or abuse.
Detects when a single AWS user identity or IP address enumerates multiple resources across different AWS services (such as SQS, Lambda, ECS, CodeDeploy, S3, RDS, Athena) within a short time window, indicating potential reconnaissance or discovery activity.
Builds a 28-day hourly baseline of mail and file access operations (MailItemsAccessed, FileAccessed, FileDownloaded and SearchQueryPerformed) for each application identity and action type in CloudAppEvents, counting hours with no activity as zero, then alerts on each complete hour in the latest window where the identity’s operation count exceeds its average by more than three standard deviations and reaches a minimum volume.
Application identities legitimately read data at high volume, so a per-identity statistical baseline separates abuse of granted permissions from normal machine traffic where fixed thresholds fail. Identities with no activity in the baseline period are excluded, and a sustained change in behaviour, such as a large synchronisation or recovery job, will produce one result for each hour it remains elevated.
The rule runs every 24 hours, as this is the only Defender custom detection frequency with a 30-day lookback, and tests the 25 complete hours ending two hours before each run, allowing for audit log ingestion delays while overlapping the previous run so that no hour is missed.
Where the display name matches the AccountId, Defender for Cloud Apps could not name the identity, which is common for Microsoft first-party services, so analysts should confirm the application before drawing conclusions.
Application identities legitimately read data at high volume, so a per-identity statistical baseline separates abuse of granted permissions from normal machine traffic where fixed thresholds fail. Identities with no activity in the baseline period are excluded, and a sustained change in behaviour, such as a large synchronisation or recovery job, will produce one result for each hour it remains elevated.
The rule runs every 24 hours, as this is the only Defender custom detection frequency with a 30-day lookback, and tests the 25 complete hours ending two hours before each run, allowing for audit log ingestion delays while overlapping the previous run so that no hour is missed.
Where the display name matches the AccountId, Defender for Cloud Apps could not name the identity, which is common for Microsoft first-party services, so analysts should confirm the application before drawing conclusions.
This detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance in an Azure AD Hybrid health AD FS service.
A threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-prem AD FS server.
This can be done programmatically via HTTP requests to Azure.
A threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-prem AD FS server.
This can be done programmatically via HTTP requests to Azure.
Detects a successful device-code sign-in followed within 60 minutes by non-interactive replay from a different IP AND a persistence action (inbox rule, app consent, device add) from a non-original IP. Persistence is now mandatory (inner join) instead of optional, and the retired AADSignInEventsBeta table is replaced by EntraIdSignInEvents.
Detects scenarios where a user's password is reset or sessions are revoked in Azure Active Directory, followed closely by mailbox access (items accessed, sent, or deleted) from a client IP address that was never seen interacting with that mailbox prior to the password reset event.
Detects the creation of specific GitHub repositories ('tpcp-docs' or 'docs-tpcp') associated with TeamPCP stealer fallback exfiltration activity, including subsequent release or asset creation.
The following analytic detects an AWS principal making more than 10 distinct successful Secrets Manager BatchGetSecretValue API calls within one hour. It groups calls by AWS account and user identity ARN and deduplicates CloudTrail events by event ID. Repeated batch retrieval may indicate bulk access to secrets using a compromised identity, although legitimate automation can produce similar activity.
A successful EC2 StopInstances request was followed within one hour by a successful ModifyInstanceAttribute request targeting userData on the same instance, by the same IAM principal.
This may indicate an attempt to change instance startup behavior or establish persistence.
These CloudTrail events do not confirm that the modified user-data script executed.
This may indicate an attempt to change instance startup behavior or establish persistence.
These CloudTrail events do not confirm that the modified user-data script executed.
Detects a successful device-code sign-in followed within 60 minutes by non-interactive replay from a different IP AND a persistence action (inbox rule, app consent, device add) from a non-original IP. Persistence is now mandatory (inner join) instead of optional, and the retired AADSignInEventsBeta table is replaced by EntraIdSignInEvents.
Detects a successful device-code sign-in followed within 60 minutes by non-interactive replay from a different IP AND a persistence action (inbox rule, app consent, device add) from a non-original IP. Persistence is now mandatory (inner join) instead of optional, and the retired AADSignInEventsBeta table is replaced by EntraIdSignInEvents.
The following analytic detects the creation of open/public S3 buckets via the AWS CLI.
It leverages AWS CloudTrail logs to identify events where a user has set bucket permissions to allow access to "AuthenticatedUsers" or "AllUsers." This activity is significant because open S3 buckets can expose sensitive data to unauthorized users, leading to data breaches.
If confirmed malicious, an attacker could gain unauthorized access to potentially sensitive information stored in the S3 bucket, posing a significant security risk.
It leverages AWS CloudTrail logs to identify events where a user has set bucket permissions to allow access to "AuthenticatedUsers" or "AllUsers." This activity is significant because open S3 buckets can expose sensitive data to unauthorized users, leading to data breaches.
If confirmed malicious, an attacker could gain unauthorized access to potentially sensitive information stored in the S3 bucket, posing a significant security risk.
The following analytic detects unauthorized container uploads to AWS Elastic Container Service (ECR) by monitoring AWS CloudTrail events.
It identifies instances where a new container is uploaded by a user not previously recognized as authorized.
It identifies instances where a new container is uploaded by a user not previously recognized as authorized.
A BTP service instance or service binding was created, modified, or deleted through the Service Manager API
Page 2 of 135