Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects a suspicious pattern where an AI coding agent or user creates a public GitHub repository with specific naming conventions (e.g., 'sweeper-demo', 'gitshot-images') and subsequently pushes content containing sensitive terms like 'screenshot' within a short timeframe. This behavior is indicative of potential data exfiltration of internal development screenshots to a public repository.
This rule detects administrative or user activity within Azure via AzureActivity logs and web request patterns in AppServiceHTTPLogs that originate from a predefined list of known malicious IP addresses.
This rule monitors for the addition of new credentials (secrets) to service principals or applications in an Azure/Entra ID environment. It then correlates this event with subsequent mailbox activity (such as accessing mail items, sending mail, or message binding) performed by the application within 7 days of the credential creation. This detection pattern is indicative of potential OAuth application-based persistence and mailbox data exfiltration.
Detects anomalous, high-volume data retrieval from Salesforce via OAuth-authenticated Connected Apps using SOQL or Bulk API. This behavior is indicative of a compromised integration token being used by an adversary to exfiltrate sensitive CRM data, such as User, Account, Case, or Opportunity records, by bypassing standard user interface workflows.
Detects high-risk AWS API calls indicative of privilege escalation within IAM (e.g., policy attachments, credential creation) or activities aimed at tampering with or disabling CloudTrail logging, which is often a precursor to or indication of unauthorized activity to evade detection.
Detects the addition of passwords or certificates to Entra ID applications or service principals by an identity that is not currently listed as an owner. This behavior is a common persistence technique used by threat actors to maintain long-term access, bypass password resets, and circumvent MFA.
Detects instances where a Service Principal or Enterprise Application is assigned a highly privileged Entra ID directory role (e.g., Global Administrator, Privileged Role Administrator). This behavior is often associated with adversary attempts to establish persistent access that survives remediation of human-managed identities.
This rule detects anomalous sign-in behavior for Azure Service Principals by comparing current activity against a 14-day baseline. It alerts on sign-ins from new ASNs or countries, significant spikes in sign-in volume, or unauthorized access to sensitive resources such as Microsoft Graph, Exchange Online, or Azure Key Vault, while filtering out known cloud egress ranges.
Detects the creation of a new application secret or credential in a cloud environment followed by an immediate authentication attempt using that credential from an IP address that has not been observed performing successful authentication within the specified lookback window. This behavior is indicative of potential unauthorized persistence or the use of compromised credentials by an adversary.
Detects unauthorized sharing, copying, or exporting of EBS, disk, or database snapshots to external cloud accounts, subscriptions, or projects that are not present in the defined trusted allow-list for AWS, Azure, or GCP environments.
Detects the assignment of high-privilege Azure directory roles to a service principal identity. Threat actors may leverage this behavior to establish persistent, non-interactive backdoor access in a cloud tenant, bypassing MFA and sign-in scrutiny.
This rule detects when a new password credential (client secret) is added to an existing Azure AD Service Principal or application. This activity is a common method for adversaries to establish persistence in a cloud environment that survives password resets or MFA enforcement on the original administrative account.
Detects attempts by a principal to modify, stop, or delete AWS CloudTrail logging configurations. Such activity is a common indicator of defense evasion during the early stages of a cloud-based attack to prevent audit trail capture.
Detects high-volume or multi-type destructive operations against cloud backup, snapshot, and recovery infrastructure, including the disabling of immutability policies or soft-delete protections. This activity is consistent with ransomware actors attempting to eliminate recovery options before encrypting data.
Detects a service principal or application identity performing a burst of deletion operations across multiple Azure resource types, such as Storage Accounts, SQL Databases, Key Vaults, and Function Apps. This behavior is indicative of malicious activity, including potential cloud environment destruction or 'agentic' destructive operations similar to those observed in the Storm-3168 (JADEPUFFER) threat activity.
Detects instances where a user grants an OAuth application consent to high-risk scopes (such as mail reading, file access, or directory reading) without administrator oversight. This behavior is a common indicator of OAuth abuse where an attacker lures a user into granting excessive permissions to a malicious application, providing the attacker persistent access to the user's data.
Detects the creation of GCP compute instances that are attached to service accounts with broad 'cloud-platform' scope permissions. This activity is monitored to ensure that only authorized automation service accounts (e.g., IaC pipelines) are performing these actions, as creating instances with highly privileged service accounts can be a technique used to escalate privileges or establish persistence.
Detects the modification of an Azure Storage account configuration to enable public access (allowBlobPublicAccess: true). This activity is often associated with attackers attempting to facilitate anonymous data exfiltration by enabling public access to blobs and subsequently reading them.
Detects mass device management actions (e.g., remote wipe, retire, or delete) performed via the Microsoft Intune console by a user who has simultaneously exhibited risky sign-in behavior, potentially indicating a compromised administrative account.
Detects the creation or modification of Exchange Online inbox rules that configure automatic email forwarding or redirection to an external domain. The rule specifically flags if the action also involves deleting or hiding the message, which is a common persistence and exfiltration technique used in Business Email Compromise (BEC) attacks. The detection also incorporates correlation with recent high-risk sign-in activity for the associated user account.
This rule detects potentially malicious reconnaissance or enumeration activity by tracking high volumes of read-only API calls (LIST/read operations) across multiple Azure resource providers (e.g., VMs, Subscriptions, Web sites, Storage, Recovery Services) performed by a single identity within a 30-minute window.
Page 5 of 135