Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects non-interactive sign-in events using specific Microsoft application IDs (Intune for Education, Intune portal) to access Microsoft Graph that do not have a corresponding successful or failed Conditional Access policy record. This suggests potential circumvention of Conditional Access policies or service-level activity bypassing standard authentication auditing.
This rule detects instances where a user grants an OAuth application consent to perform sensitive actions in an Azure AD environment. It specifically filters for high-risk scopes (such as Mail.Read, Files.ReadWrite, or Directory.ReadWrite) granted to applications with publishers other than Microsoft Corporation, which is often indicative of OAuth consent phishing attacks or malicious application integration.
This rule monitors GCP Audit logs for the creation or deletion of VPN tunnels. It classifies the actor (human vs. service account) and validates the source of the action against expected patterns such as the use of Terraform and authorized network sources. It highlights activity that deviates from standard infrastructure-as-code deployments or originates from unusual network sources, aiding in the detection of unauthorized or suspicious network configuration changes.
This rule monitors Google Cloud Platform (GCP) Audit Logs for changes to VPC network routes, specifically tracking 'insert' and 'delete' operations. It classifies actors as either human or service account, flags non-Terraform service account modifications, and identifies service accounts originating from unexpected network sources to detect potentially unauthorized infrastructure changes.
This rule detects the deletion of Google Cloud Platform (GCP) network firewall rules. It monitors GCP audit logs for 'v1.compute.firewalls.delete' or 'beta.compute.firewalls.delete' actions. The rule categorizes the actor (human vs. service account) and identifies if the deletion originated from Terraform, providing context on whether the action was likely an automated infrastructure-as-code change or manual intervention.
This rule detects instances where a user grants an OAuth application consent to perform sensitive actions in an Azure AD environment. It specifically filters for high-risk scopes (such as Mail.Read, Files.ReadWrite, or Directory.ReadWrite) granted to applications with publishers other than Microsoft Corporation, which is often indicative of OAuth consent phishing attacks or malicious application integration.
This rule monitors GCP audit logs for the modification, creation, or deletion of organization policies. These actions are often associated with an attacker attempting to weaken the security posture of the cloud environment by modifying or disabling restrictive security configurations.
A Compute Engine instance created outside the expected europe-west1/europe-west2 regions.
This rule detects changes to VPC Network Peering configurations in Google Cloud Platform (GCP). VPC peering allows internal IP address connectivity across different VPC networks. Unauthorized modifications, such as adding or updating peering connections, could indicate an adversary attempting to establish lateral movement paths between network environments, facilitate data exfiltration, or modify network architecture to bypass security perimeters.
Detects the creation of a new Service Principal followed by an immediate application of an app role assignment within one hour. The rule specifically targets service principals with names suggestive of automation, AI, or assistant-related roles (e.g., 'copilot', 'llm', 'bot'), which may indicate the use of newly created service principals for potential persistence or unauthorized access.
Detects anomalous OAuth application authorization behavior by a user, specifically monitoring for a spike in authorization events within a short timeframe. This activity is often indicative of consent phishing campaigns where an adversary tricks a user into granting excessive application permissions to a malicious OAuth app, or a compromised account performing bulk authorization grants.
This rule detects the creation of Google Cloud Platform (GCP) persistent disk snapshots. Monitoring for disk snapshot creation is critical as adversaries may use this functionality to create backups of sensitive virtual machine disks for exfiltration, staging, or offline analysis, effectively bypassing traditional network-based egress controls.
An IAM service account deleted or disabled, excluding the known Terraform automation account.
Detects the use of sts:AssumeRoot within an AWS Organization. This action allows an entity within the management account to assume root-level access in a member account, effectively bypassing standard IAM restrictions. This is a high-risk event indicative of potential privilege escalation or management account compromise.
Detects instances where an Azure Automation Runbook interacts with or initiates a sign-in log activity that does not correspond to its own Managed Identity. This anomaly may indicate the abuse of a managed identity token to access unauthorized resources or perform lateral movement within the Azure environment.
This rule detects the addition or update of credentials (certificates and secrets) to Azure AD applications or service principals using AuditLogs. Adversaries often perform this activity to establish persistent access to a cloud environment by 'backdooring' a trusted application or service principal with their own secret, allowing them to authenticate as that identity later.
Detects instances where an Azure Automation Runbook interacts with or initiates a sign-in log activity that does not correspond to its own Managed Identity. This anomaly may indicate the abuse of a managed identity token to access unauthorized resources or perform lateral movement within the Azure environment.
This rule detects modifications to Google Cloud Platform (GCP) Cloud DNS managed zones, including creating, deleting, patching, updating, or changing records within a managed zone. It performs triage by categorizing the actor as either a human or a service account, checks for the use of Infrastructure-as-Code (Terraform), and flags potentially anomalous activity such as service accounts interacting with DNS outside of expected networks or without using automated tooling.
A Compute Engine image created from a disk, which can be used to copy VM disk data out of the environment
This rule detects potential cloud data exfiltration by identifying anomalous device-code authentication sign-ins followed by high-velocity file or mailbox access. It specifically monitors Microsoft 365 sign-in logs for device-code authentication sessions involving either an application (AppId) or a geographic location not seen in the user's previous 14-day baseline. If such a sign-in is immediately followed (within a 2-hour window) by a rapid burst of activity in SharePoint, OneDrive, or Exchange—defined by at least 20 operations at a rate of 5 or more events per minute—the rule flags the sequence as suspicious. This pattern is characteristic of attackers using stolen device-code tokens to programmatically mass-download or exfiltrate sensitive cloud data.
This rule detects potential data exfiltration by monitoring for anomalous user behavior across integrated SaaS applications. It flags accounts that perform high-frequency read, search, or view activities across three or more monitored SaaS platforms (Confluence, Jira, Slack, Google Workspace, Microsoft 365, or Bitbucket) within a 5-minute window, followed immediately by an upload or post activity to an external, non-integrated domain.
Page 70 of 135