Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects a coordinated, rapid deletion of a Key Vault, Function App, and App Service plan within the same resource group and time window by the same caller. This pattern is indicative of targeted destructive activity, such as that seen in the JADEPUFFER campaign, while explicitly excluding scenarios where the entire resource group is deleted, which is typical of routine IaC teardowns.
Detects a coordinated, rapid deletion of a Key Vault, Function App, and App Service plan within the same resource group and time window by the same caller. This pattern is indicative of targeted destructive activity, such as that seen in the JADEPUFFER campaign, while explicitly excluding scenarios where the entire resource group is deleted, which is typical of routine IaC teardowns.
Detects a coordinated, rapid deletion of a Key Vault, Function App, and App Service plan within the same resource group and time window by the same caller. This pattern is indicative of targeted destructive activity, such as that seen in the JADEPUFFER campaign, while explicitly excluding scenarios where the entire resource group is deleted, which is typical of routine IaC teardowns.
Detects a suspicious pattern often associated with Storm-3168 (JADEPUFFER) activity: prolonged, high-volume Azure resource enumeration by one service principal, followed shortly by a second service principal performing rapid, multi-subscription enumeration from the same source IP address.
Detects a suspicious pattern often associated with Storm-3168 (JADEPUFFER) activity: prolonged, high-volume Azure resource enumeration by one service principal, followed shortly by a second service principal performing rapid, multi-subscription enumeration from the same source IP address.
Detects a suspicious pattern often associated with Storm-3168 (JADEPUFFER) activity: prolonged, high-volume Azure resource enumeration by one service principal, followed shortly by a second service principal performing rapid, multi-subscription enumeration from the same source IP address.
Detects anomalous service principal activity characterized by multiple, rapidly issued, and overlapping OAuth tokens within a short time window. This pattern is associated with automated/agentic token orchestration (e.g., JADEPUFFER/Storm-3168 campaign) rather than standard manual operator activity, specifically when leveraging the python-requests user agent.
Detects anomalous service principal activity characterized by multiple, rapidly issued, and overlapping OAuth tokens within a short time window. This pattern is associated with automated/agentic token orchestration (e.g., JADEPUFFER/Storm-3168 campaign) rather than standard manual operator activity, specifically when leveraging the python-requests user agent.
Detects anomalous service principal activity characterized by multiple, rapidly issued, and overlapping OAuth tokens within a short time window. This pattern is associated with automated/agentic token orchestration (e.g., JADEPUFFER/Storm-3168 campaign) rather than standard manual operator activity, specifically when leveraging the python-requests user agent.
Detects anomalous service principal activity characterized by multiple, rapidly issued, and overlapping OAuth tokens within a short time window. This pattern is associated with automated/agentic token orchestration (e.g., JADEPUFFER/Storm-3168 campaign) rather than standard manual operator activity, specifically when leveraging the python-requests user agent.
Detects instances where a user grants OAuth application permissions for high-risk scopes (e.g., mail access, offline access). The rule flags these grants, with higher risk scores assigned if the application publisher is unverified or unknown, helping identify potential illicit consent grant attacks often used to maintain long-term persistence in cloud environments.
Detects high-risk IAM policy modifications, specifically the attachment or creation of policies that grant wildcard permissions or full administrator access. The rule optionally correlates these permission changes with the recent creation of access keys or service account credentials for the same principal, indicating potential preparation for persistence or unauthorized access escalation.
Detects user-granted OAuth consent in Microsoft Entra ID (formerly Azure AD) involving high-risk scopes such as Mail.Read, Files.ReadWrite.All, or offline_access. This pattern is characteristic of illicit consent-grant phishing, where attackers entice users to authorize malicious applications to bypass multi-factor authentication (MFA) and establish persistent, programmatic access to sensitive mailbox and file resources.
Detects rapid mass-cloning or downloading of private GitHub repositories shortly after an OAuth token authorization, originating from IP addresses or countries not previously associated with the user account. This behavior is indicative of unauthorized bulk data extraction using compromised credentials, consistent with threat actor activity (e.g., TeamPCP/UNC6780).
Detects the creation and immediate deletion of a GitHub OAuth token that is used to clone or fetch a large volume of private repositories within a short lifespan. This behavior is indicative of an adversary using a temporary, ephemeral token to perform rapid data exfiltration or mass reconnaissance on source code repositories.
This rule detects unauthorized GitHub repository access or OAuth activity performed by a user account identified as terminated in the organization's HR system. It uses a watchlist to cross-reference GitHub audit logs against terminated employee records, applying a 2-hour grace period to account for potential log synchronization delays or final offboarding tasks.
Detects high-risk AWS IAM privilege escalation activities, such as attaching AdministratorAccess policies, creating new access keys, roles, or users, occurring shortly after a suspicious sign-in event (e.g., impossible travel or new device login with MFA) for the same principal.
Detects anomalous SharePoint search activity that uses 'indexdocid' queries targeting specific site or web content classes. This pattern is often indicative of automated reconnaissance or enumeration of documents within a SharePoint environment, potentially attempting to bypass standard UI navigation to identify or access sensitive content.
Detects high-volume or systematic SharePoint search queries performed by a single user, specifically looking for indicators of data discovery activities such as searching for SharePoint sites, web structures, or iterating through document IDs which may suggest an adversary attempting to map or identify sensitive data within the environment.
Detects high-frequency access to mail items via specific client applications, or high-frequency file downloads/access within SharePoint and OneDrive. These patterns may indicate suspicious data collection or exfiltration attempts by a compromised account.
Detects high-volume, diverse administrative and discovery activities in cloud environments, including SharePoint site enumeration, Azure AD user/identity discovery, and suspicious access to mail items via specific client applications, potentially indicating post-compromise reconnaissance or data harvesting.
Page 39 of 135